joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x2d89695f
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x24502d47
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1a6d2ee3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4d75517d
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0xf9207e9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x17e47b29
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x16b920c5
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x42f3f8
nop
mov ecx, 0x70310a34
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10012470
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1001f5a4], 0
je 0x10012489
mov eax, dword [0x1001f5a4]
jmp 0x10012626
mov dword [0x1001f5a4], 0x1001f574
push 0x28
push 0
push 0x1001f574
call fcn.100111e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1001f574], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1001f578], eax
cmp dword [0x1001f578], 0
jne 0x100124cf
xor eax, eax
jmp 0x10012626
push str.ImagehlpApiVersionEx
mov eax, dword [0x1001f578]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001f57c], eax
push str.SymInitialize
mov ecx, dword [0x1001f578]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001f580], eax
push str.SymSetOptions
mov edx, dword [0x1001f578]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001f584], eax
push str.SymGetOptions
mov eax, dword [0x1001f578]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001f588], eax
push str.SymLoadModule
mov ecx, dword [0x1001f578]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001f58c], eax
push str.SymGetModuleInfo
mov edx, dword [0x1001f578]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001f590], eax
push str.SymGetSymFromName
mov eax, dword [0x1001f578]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001f594], eax
push str.BindImage
mov ecx, dword [0x1001f578]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1001f598], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.100111e0
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x1001f57c], 0
je 0x100125ad
lea eax, [ebp - 8]
push eax
call dword [0x1001f57c]
cmp dword [0x1001f57c], 0
je 0x100125bf
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x100125da
mov edx, dword [0x1001f578]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1001f578], 0
xor eax, eax
jmp 0x10012626
cmp dword [0x1001f580], 0
je 0x100125f3
push 0
push 0
mov eax, dword [0x1001f574]
push eax
call dword [0x1001f580]
cmp dword [0x1001f588], 0
je 0x10012621
cmp dword [0x1001f584], 0
je 0x10012621
call dword [0x1001f588]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x1001f584]
mov eax, dword [0x1001f5a4]
mov esp, ebp
pop ebp
ret
Function at 0x10012fc0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b888
push 0x100112ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
jne 0x10012ffd
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10013033
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
jmp 0x10013191
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0x4550
je 0x1001306b
push 0xbf
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
jmp 0x10013191
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 0x14]
test ecx, ecx
jne 0x10013097
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3c]
jmp 0x10013191
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0
jmp 0x100130ba
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x28], edx
jae 0x1001316b
push str..detour
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
add ecx, eax
push ecx
call fcn.10011037
add esp, 8
test eax, eax
jne 0x10013166
mov edx, dword [ebp - 0x28]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x20]
cmp dword [eax + edx + 0xc], 0
je 0x10013107
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x20]
cmp dword [edx + ecx + 0x10], 0
jne 0x10013109
jmp 0x1001316b
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx], 0x30
jb 0x10013136
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 4], 0x727444
je 0x10013138
jmp 0x1001316b
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 8], 0
jne 0x1001314c
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ecx + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x40]
jmp 0x10013191
jmp 0x100130b1
mov dword [ebp - 4], 0xffffffff
jmp 0x10013184
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10001140
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x354
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x350], eax
push ebx
push esi
push edi
push 0
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001270
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10001269
push dword [esp + 0x18]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10001255
push 0x104
lea eax, [esp + 0x154]
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x1000124e
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x13c]
call fcn.10001620
cmp dword [edi + 0x14], 7
mov ecx, edi
jbe 0x100011e7
mov ecx, dword [edi]
cmp dword [esp + 0x14c], 7
lea eax, [esp + 0x138]
push ecx
cmova eax, dword [esp + 0x13c]
push eax
call fcn.10004fcd
add esp, 8
test eax, eax
je 0x10001287
mov ecx, dword [esp + 0x14c]
cmp ecx, 7
jbe 0x1000124e
mov edx, dword [esp + 0x138]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10001244
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100012e8
push ecx
push edx
call fcn.1000181a
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10001190
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x350]
xor ecx, esp
call fcn.100017d7
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov ecx, dword [esp + 0x14c]
cmp ecx, 7
jbe 0x100012d1
mov edx, dword [esp + 0x138]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100012c7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100012e8
push ecx
push edx
call fcn.1000181a
add esp, 8
mov ecx, dword [esp + 0x35c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100017d7
mov esp, ebp
pop ebp
ret
call fcn.10004f00
int3

Function at 0x1000555d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000559c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000559c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000559c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000559c
cmp dword [ecx + 0x74], 0xe
jbe 0x1000559c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10008037
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100080d4
push ebx
push esi
call fcn.10008000
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10007f94
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10008081
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100080d3
push edi
push eax
call fcn.10006a67
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100080a1
call fcn.10006ab5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100080d2
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10007f94
add esp, 0x20
test eax, eax
jne 0x100080c0
push edi
call fcn.10006ab5
jmp 0x100080c8
push ebx
call fcn.10006ab5
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10008341
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10011238
push 0x10011230
push str.FlsAlloc
push 0x1f
call fcn.1000825d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008375
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f134]
call esi
jmp 0x1000837b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100083bf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10011248
push 0x10011240
push str.FlsGetValue
push 0x21
call fcn.1000825d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100083f6
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100083fe
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10011250
push 0x10011248
push str.FlsSetValue
push 0x22
call fcn.1000825d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008438
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000f134]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000df90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000dfbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000dfbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d38
cmp byte [esi + ebx - 1], 0xa
je 0x401d0c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4040f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x402f00
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x402f8b
cmp ax, 9
je 0x402f78
cmp ax, 0x20
je 0x402f78
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x402fe0
cmp ax, 0x22
je 0x402ff0
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x402f8b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x402f30
test edi, 1
jne 0x402f30
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x402f78
cmp ax, 0x20
je 0x402f78
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x403008
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x402f4b
and dword [ebp - 0x54], 1
jne 0x402f44
xor edi, 1
jmp 0x402f4b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x402fa4

Function at 0x403020
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x10009f40
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0xa183d5d1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
sub eax, 0xa183d5d1
je 0x1000a06a
jmp 0x10009f73
mov eax, dword [ebp - 0x18]
nop word cs:[eax + eax]
sub eax, 0xa19e10d1
je 0x1000a151
jmp 0x10009f90
mov eax, dword [ebp - 0x18]
sub eax, 0xb0ba4360
je 0x1000a172
nop
jmp 0x10009fa5
mov eax, dword [ebp - 0x18]
sub eax, 0xc907540c
je 0x1000a085
jmp 0x10009fb8
mov eax, dword [ebp - 0x18]
nop dword [eax + eax]
sub eax, 0xdebba706
je 0x1000a185
jmp 0x10009fd0
mov eax, dword [ebp - 0x18]
sub eax, 0xfac923a8
je 0x1000a145
nop
jmp 0x10009fe5
mov eax, dword [ebp - 0x18]
sub eax, 0xfe15e28a
je 0x1000a12f
jmp 0x10009ff8
mov eax, dword [ebp - 0x18]
nop dword [eax + eax]
sub eax, 0x326c8d24
je 0x1000a0da
jmp 0x1000a010
mov eax, dword [ebp - 0x18]
sub eax, 0x3bec9a81
je 0x1000a0ed
nop
jmp 0x1000a025
mov eax, dword [ebp - 0x18]
sub eax, 0x461469b2
je 0x1000a108
jmp 0x1000a038
mov eax, dword [ebp - 0x18]
nop dword [eax + eax]
sub eax, 0x47650534
je 0x1000a0a6
jmp 0x1000a050
mov eax, dword [ebp - 0x18]
sub eax, 0x5c8d082b
je 0x1000a0c7
nop
jmp 0x1000a065
jmp 0x1000a18e
mov edx, dword [ebp - 8]
mov eax, 0x326c8d24
mov ecx, 0xc907540c
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x1000a18e
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
mov eax, 0x326c8d24
mov ecx, 0x47650534
cmp edx, 0x90
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x1000a18e
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
mov eax, 0x326c8d24
mov ecx, 0x5c8d082b
cmp edx, 0xcc
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x1000a18e
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0xdebba706
jmp 0x1000a18e
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0x3bec9a81
jmp 0x1000a18e
mov edx, dword [ebp - 0x10]
mov eax, 0xb0ba4360
mov ecx, 0x461469b2
cmp edx, dword [ebp + 0xc]
cmovb eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x1000a18e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [eax + ecx]
mov eax, dword [ebp + 8]
movzx esi, byte [eax]
mov eax, 0xfac923a8
mov ecx, 0xfe15e28a
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x1000a18e
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0xdebba706
nop dword [eax]
jmp 0x1000a18e
mov dword [ebp - 0x14], 0xa19e10d1
jmp 0x1000a18e
mov eax, dword [ebp - 0x10]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x3bec9a81
jmp 0x1000a18e
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], 0xdebba706
jmp 0x1000a18e
mov eax, dword [ebp - 0xc]
add esp, 0x14
pop esi
pop ebp
ret
jmp 0x10009f5d
Function at 0x100276e0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0x1505
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0xaa01231d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub eax, 0xaa01231d
je 0x1002778a
jmp 0x1002771e
mov eax, dword [ebp - 0x14]
sub eax, 0xb82c7436
je 0x10027825
jmp 0x10027731
mov eax, dword [ebp - 0x14]
sub eax, 0xc1b0fcda
je 0x100277d9
nop
jmp 0x10027745
mov eax, dword [ebp - 0x14]
sub eax, 0xdca41093
je 0x100277cd
jmp 0x10027758
mov eax, dword [ebp - 0x14]
nop dword [eax + eax]
sub eax, 0x1298b9f9
je 0x10027809
jmp 0x10027770
mov eax, dword [ebp - 0x14]
sub eax, 0x403b25e9
je 0x100277a5
nop
jmp 0x10027785
jmp 0x1002782d
mov edx, dword [ebp - 0xc]
mov eax, 0xb82c7436
mov ecx, 0x403b25e9
cmp edx, dword [ebp + 0xc]
cmovb eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x1002782d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov al, byte [eax + ecx]
mov byte [ebp - 5], al
movzx edx, byte [ebp - 5]
mov eax, 0xc1b0fcda
mov ecx, 0xdca41093
cmp edx, 0
cmove eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x1002782d
mov dword [ebp - 0x10], 0xb82c7436
jmp 0x1002782d
mov eax, dword [ebp - 4]
shl eax, 5
mov edx, dword [ebp - 4]
xor ecx, ecx
sub ecx, edx
sub eax, ecx
movzx edx, byte [ebp - 5]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x1298b9f9
jmp 0x1002782d
mov eax, dword [ebp - 0xc]
xor ecx, ecx
sub ecx, 1
sub eax, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xaa01231d
nop dword [eax]
jmp 0x1002782d
mov eax, dword [ebp - 4]
add esp, 0x14
pop ebp
ret
jmp 0x10027708
Function at 0x10047b6c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10047bab
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10047bab
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10047bab
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10047bab
cmp dword [ecx + 0x74], 0xe
jbe 0x10047bab
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1004bf50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004bf7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004bf7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1004c2a0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005cd40
push 0x1005cd38
push str.FlsAlloc
push 0x1f
call fcn.1004c583
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004c2d4
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1004c2da
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1004c31e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005cd50
push 0x1005cd48
push str.FlsGetValue
push 0x21
call fcn.1004c583
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004c355
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1004c35d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005cd58
push 0x1005cd50
push str.FlsSetValue
push 0x22
call fcn.1004c583
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004c397
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]