joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522de8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405198
xor eax, eax
push ebp
push 0x522e66
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404ce8
mov eax, dword [ebp - 4]
call fcn.00404fa8
mov ebx, eax
test ebx, ebx
jle 0x522e4b
mov edi, 1
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
xor dl, 0xff
call fcn.00404ed0
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00404fb0
inc edi
dec ebx
jne 0x522e2b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522e6d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404d0c
ret
Function at 0x442f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0xc]
call fcn.00420e10
xor esi, esi
pop ecx
cmp dword [ebp + 0xc], esi
mov ebx, eax
jle 0x442f98
push edi
mov edi, dword [ebp + 8]
sub edi, ebx
mov eax, esi
lea ecx, [esi + ebx]
cdq
idiv dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov al, byte [edx + eax]
xor al, byte [edi + ecx]
inc esi
cmp esi, dword [ebp + 0xc]
mov byte [ecx], al
jl 0x442f7d
pop edi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1002aaee
pop dword [ebp - 4]
mov eax, 0x2b83f824
sub eax, 0x1b814d36
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xc22fcab7
add dword [ebp - 0x14], 0x8c227a94
mov dword [ebp - 0x10], 0x970313ee
add dword [ebp - 0x10], 0x9b303857
mov dword [ebp - 0xc], 0x982406a7
add dword [ebp - 0xc], 0xb4283d87
mov dword [ebp - 8], 0x7bed5def
sub dword [ebp - 8], 0x7bed5def
lea eax, [ebp - 0x14]
push eax
mov eax, 0xff777112
add eax, 0x108b4f26
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xed78d982
add dword [ebp - 0x14], 0x86f98fd4
mov dword [ebp - 0x10], 0x60f0ebd2
add dword [ebp - 0x10], 0xe07b75a3
mov dword [ebp - 0xc], 0x2348d2f0
sub dword [ebp - 0xc], 0xbfd96684
mov dword [ebp - 8], 0x53abd3b2
add dword [ebp - 8], 0xac542c4e
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x38128
push 0
call eax
mov ecx, 0x27c60eff
add ecx, 0xd83a3f6c
mov edx, eax
mov edi, 0x4bb3f48f
add edi, 0xc44fa171
add edi, dword [ebp - 4]
mov esi, 0x8b63003a
mov ebx, dword [edi]
xor ebx, esi
mov dword [edx], ebx
add edx, 0x2c397e68
add edx, 0xd3c6819c
add edi, 0x35eec570
sub edi, 0x35eec56c
loop 0x1002ac05
add eax, 0x2c9b8096
add eax, 0xd365abe9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1575a938
add ecx, 0xfa8a56c8
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x10008fff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000900e
pop dword [ebp - 0x30]
mov eax, 0xe5d094fd
add eax, 0x2a2ffb11
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xe5d1fd02
sub dword [ebp - 0x40], 0x977fb7b7
mov dword [ebp - 0x3c], 0x7bb65a75
sub dword [ebp - 0x3c], 0x49830e30
mov dword [ebp - 0x38], 0xeff35ba2
sub dword [ebp - 0x38], 0xa3a71774
mov dword [ebp - 0x34], 0x9bf42900
sub dword [ebp - 0x34], 0x9bf42900
lea eax, [ebp - 0x40]
push eax
mov eax, 0x2d0472b5
sub eax, 0x1d03d2b1
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x2008781a
add dword [ebp - 0x40], 0x5469f13c
mov dword [ebp - 0x3c], 0xdc709f8d
sub dword [ebp - 0x3c], 0x9b043e18
mov dword [ebp - 0x38], 0x9e661978
add dword [ebp - 0x38], 0xc50952f4
mov dword [ebp - 0x34], 0x6af95b22
sub dword [ebp - 0x34], 0x6af95b22
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x7c8647d5
sub eax, 0x6c85a7cd
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x378b2
push 0
call eax
mov ecx, 0xfbb063ba
sub ecx, 0xfbb017b2
mov edi, eax
mov esi, 0x1000f800
add esi, dword [ebp - 0x30]
mov ebx, 0xdd107567
add dword [ebp - 0x24], 0xf878a242
mov edx, dword [esi]
sub edx, ebx
xor dword [ebp - 4], 0xcea4c56b
mov dword [edi], edx
add dword [ebp - 0xc], 0x1cc2a685
add edi, 0x5fc30c6c
sub edi, 0x5fc30c68
add esi, 4
loop 0x10009124
add eax, 0xa48acdf3
sub eax, 0xa489ab00
mov ebx, eax
add eax, 0x39a04609
sub eax, 0x39a04604
mov ecx, 0x7931eed2
sub ecx, 0x6931eed2
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4110d2
Capabilities:
Terminate process

Disassembly:
jmp 0x41e190
jmp fcn.0041f5a0
cmp ecx, dword [0x42f0c0]
jne 0x41e19a
repz ret
jmp 0x4112da

Function at 0x411866
Capabilities:
Encode data using xor

Disassembly:
test ch, 0xa8
xchg ah, al
cmp al, 0x86
imul ecx, esi
scasd eax, dword es:[edi]
into
and eax, 0xcd725a7f
sub edx, 0xfffce148
invalid
invalid
jne 0x411830
pop eax
add ebx, 0xb59faee5
push 0x8d1046
mov edx, ebp
mov esi, 0xd3d8402f
mov edi, 0x1fd0605c
imul edx, edi, 0xb21f89e7
dec ch
test ebp, edi
jno 0x411899
lea ebp, [0x47af863c]
imul edi, ebp, 0x8be9855b
lea esi, [0x74c764a6]
jmp 0x4118ad
dec esi
lea edx, [0x92c4f745]
add eax, 0xfffa382e
jmp 0x4118c3
add eax, 0x86071
lea edi, [0xa6564a38]
mov edx, esi
mov esi, 0x6bdca302
push 0x655ebc
mov bh, 0x74
xchg edi, ecx
add dh, dl
imul edx, eax, 0x37caaab1
movsx ebx, bx
xchg ebx, ecx
inc edi
sub ebp, esi
imul ebx, eax, 0xc29ee7a
sbb dl, dh
adc ecx, edi
test ah, ah
lea edi, [0x2c58929e]
push ebx
push 0xebb0e
xchg dh, dl
imul ebp, ebx
imul esi, edx, 0x1135e53a
add bl, bl
mov bh, 0x9b
push eax
test edx, eax
mov edx, 0x129b2a41
or ebp, 0x46cd71db
inc edi
mov ebx, edx
mov bl, 0x98
inc dh
inc esi
mov edi, 0x9c
mov bl, 0xca
mov bh, 0x84
imul edx, edx
imul edi, edi, 0x105
dec esi
xor ecx, edi
xchg dh, bh
mov edx, ebp
test ch, ch
ret
Function at 0xa47ef0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4d7000]
push edi
or ebp, 0xffffffff
jmp 0xa47f12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa47f19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa47f08
mov eax, 1
add ebx, ebx
jne 0xa47f2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa47f3c
jne 0xa47f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa47f5b
dec eax
add ebx, ebx
jne 0xa47f48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa47f20
add ebx, ebx
jne 0xa47f57
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa47fad
xor ecx, ecx
sub eax, 3
jb 0xa47f73
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa47fe2
sar eax, 1
mov ebp, eax
jmp 0xa47f7e
add ebx, ebx
jne 0xa47f7e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa47f4c
inc ecx
add ebx, ebx
jne 0xa47f8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa47f4c
add ebx, ebx
jne 0xa47f99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa47f8e
jne 0xa47faa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa47f8e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa47fcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa47fbe
jmp 0xa47f0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa47fcc
add edi, ecx
jmp 0xa47f0e
pop esi
mov edi, esi
mov ecx, 0x13755
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa47fea
cmp byte [edi], 0x82
jne 0xa47fea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa47fef
lea edi, [esi + 0x61b000]
mov eax, dword [edi]
or eax, eax
je 0xa4805e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x65d064]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65d154]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa4801c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65d158]
or eax, eax
je 0xa48058
mov dword [ebx], eax
add ebx, 4
jmp 0xa48039
call dword [esi + 0x65d168]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xa4808f
cmp al, 0xef
ja 0xa48082
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xa48064
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xa48071
mov ebp, dword [esi + 0x65d15c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa480c3
sub esp, 0xffffff80
jmp 0x7cb600
Function at 0x2427058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.024271a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x242707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x242706a
add dl, dl
jne 0x2427089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x24270dc
xor eax, eax
add dl, dl
jne 0x2427096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x242717d
add dl, dl
jne 0x24270a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24270b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24270bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24270c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x24270d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x2427075
mov eax, 1
add dl, dl
jne 0x24270ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x24270f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x24270e1
sub eax, ebx
mov ebx, 1
jne 0x2427128
mov ecx, 1
add dl, dl
jne 0x242710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2427119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2427105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2427075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x242713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x242714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2427136
cmp eax, 0x7d00
jae 0x242716d
cmp eax, 0x500
jb 0x2427168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2427075
cmp eax, 0x7f
ja 0x2427170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2427075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x242719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x2427075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x425070
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42509d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42509d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x428610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x414015
lea edi, [esi - 0x13015]
push edi
or ebp, 0xffffffff
jmp 0x428632
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x428639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x428628
mov eax, 1
add ebx, ebx
jne 0x42864b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x428640
jne 0x42865c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428640
xor ecx, ecx
sub eax, 3
jb 0x428670
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4286e2
mov ebp, eax
add ebx, ebx
jne 0x42867b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428688
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4286ac
inc ecx
add ebx, ebx
jne 0x428698
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42868d
jne 0x4286a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42868d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4286cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4286bd
jmp 0x42862e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4286cc
add edi, ecx
jmp 0x42862e
pop esi
mov edi, esi
mov ecx, 0x98e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4286ea
cmp byte [edi], 9
jne 0x4286ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4286ef
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x42875e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2806c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42871c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x28074]
or eax, eax
je 0x428758
mov dword [ebx], eax
add ebx, 4
jmp 0x428739
call dword [esi + 0x28070]
mov ebp, dword [esi + 0x28078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x428792
sub esp, 0xffffff80
jmp 0x401130
Function at 0x40109b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
xor edi, edi
mov esi, dword [ecx + eax + 0x78]
lea ecx, [ecx + eax + 0x78]
add esi, eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x20]
add ebx, eax
add ecx, eax
add edx, eax
test word [ebp + 0xe], 0xffff
jne 0x4010ed
movzx ecx, word [ebp + 0xc]
mov edx, dword [esi + 0x10]
cmp ecx, edx
jb 0x401154
mov edi, dword [esi + 0x14]
add edi, edx
cmp ecx, edi
ja 0x401154
sub ecx, edx
mov edi, dword [ebx + ecx*4]
add edi, eax
jmp 0x401137
and dword [ebp - 0xc], 0
cmp dword [esi + 0x18], 0
jbe 0x401137
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
jmp 0x401102
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
add ecx, eax
push ecx
push dword [ebp + 0xc]
call fcn.0041a730
pop ecx
test eax, eax
pop ecx
jne 0x401124
mov eax, dword [ebp - 8]
movzx eax, word [eax]
mov edi, dword [ebx + eax*4]
add edi, dword [ebp + 8]
inc dword [ebp - 0xc]
add dword [ebp - 4], 4
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], 2
cmp eax, dword [esi + 0x18]
jb 0x4010ff
cmp edi, esi
jb 0x401192
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add eax, esi
cmp edi, eax
jae 0x401192
push edi
call fcn.0041b4fb
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x401158
xor eax, eax
jmp 0x401194
push 0x2e
push ebx
xor edi, edi
call fcn.0041a670
pop ecx
mov esi, eax
pop ecx
and byte [esi], 0
push ebx
inc esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401180
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x40118b
push esi
push eax
call fcn.0040109b
pop ecx
mov edi, eax
pop ecx
push ebx
call fcn.0041a60b
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401199
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
xor esi, esi
push str.CryptStringToBinaryA
push eax
mov word [ebp - 0x18], 0x43
mov word [ebp - 0x16], 0x72
mov word [ebp - 0x14], 0x59
mov word [ebp - 0x12], 0x70
mov word [ebp - 0x10], 0x54
mov word [ebp - 0xe], 0x33
mov word [ebp - 0xc], 0x32
mov word [ebp - 0xa], 0x2e
mov word [ebp - 8], 0x44
mov word [ebp - 6], 0x6c
mov word [ebp - 4], 0x4c
mov word [ebp - 2], si
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call fcn.0040109b
mov edi, dword [ebp + 0xc]
pop ecx
pop ecx
mov ebx, eax
push esi
push esi
push edi
push esi
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call ebx
test eax, eax
jne 0x40121c
xor al, al
jmp 0x40123e
mov eax, dword [edi]
inc eax
push eax
call fcn.0041a7b4
pop ecx
mov ecx, dword [ebp + 8]
push esi
push esi
push edi
push eax
push 1
push dword [ebp + 0x14]
mov dword [ecx], eax
push dword [ebp + 0x10]
call ebx
test eax, eax
setne al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e8b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x44a368
cmp edx, dword [eax]
je 0x41e8d3
add eax, 8
inc ecx
cmp eax, 0x44a3f8
jl 0x41e8c4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x44a368]
jne 0x41ea01
mov eax, dword [0x44d4b4]
cmp eax, 1
je 0x41e9db
test eax, eax
jne 0x41e904
cmp dword [0x449e9c], 1
je 0x41e9db
cmp edx, 0xfc
je 0x41ea01
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41e93b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call main
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041ab80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41e97e
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041ab80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43cef4
push edi
call fcn.00420190
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call main
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041ea20
lea eax, [ebp - 0xa0]
push 0x43ced4
push eax
call fcn.0041ea20
push dword [esi + 0x44a36c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041ea20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00420107
add esp, 0x2c
pop edi
jmp 0x41ea01
lea eax, [ebp + 8]
lea esi, [esi + 0x44a36c]
push 0
push eax
push dword [esi]
call fcn.0041ab80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4289a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0041afe0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x428a6b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x428a6b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x428a1e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x428a29
or bh, 8
and edi, 0x8000000
je 0x428a44
mov eax, dword [0x44f0fc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x428a6b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x428e6b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x428e8f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x428eaa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x42e72c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x42e76e
call fcn.00432c9b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x42e76e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x42e765
xor eax, eax
jmp 0x42e776
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0042e77c
pop edi
pop esi
pop ebx
ret 4

Function at 0x433389
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4333b7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4333d5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004332ef
jmp 0x4333d5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4333d5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004332ef
test edi, edi
mov eax, edi
jne 0x4333bf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8