joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f000
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
movzx eax, word [ecx + 0x14]
push edi
lea esi, [eax + ecx + 0x18]
cmp ebx, dword [esi + 0xc]
lea edx, [esi + 0xc]
jae 0x42f021
mov eax, ebx
jmp 0x42f060
movzx edi, word [ecx + 6]
xor eax, eax
test edi, edi
jbe 0x42f05d
mov dword [ebp + 0xc], edx
lea edx, [eax + 1]
cmp edx, edi
mov dword [ebp - 4], edx
jne 0x42f03d
mov edx, dword [ecx + 0x50]
jmp 0x42f043
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x28]
mov dword [ebp + 0x10], edx
mov edx, dword [ebp + 0xc]
cmp ebx, dword [edx]
jb 0x42f052
cmp ebx, dword [ebp + 0x10]
jb 0x42f065
mov eax, dword [ebp - 4]
add dword [ebp + 0xc], 0x28
cmp eax, edi
jb 0x42f02e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
lea eax, [eax + eax*4]
lea ecx, [esi + eax*8]
mov eax, dword [esi + eax*8 + 0x14]
sub eax, dword [ecx + 0xc]
add eax, ebx
jmp 0x42f060

Function at 0x42ff44
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x13436a37
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x3424c7c
jmp 0x13436aa8
mov dword [esp + 0xc], ebp
jmp 0x13436a5a
jmp 0x13436a69
lea esp, [esp]
jmp 0x13436abf
lea esp, [esp]
mov dword [esp + 0x10], edi
lea esp, [esp + 0x10]
jmp 0x13436ac7
push si
push word [esp]
mov dword [esp + 0xc], esi
call fcn.13436a37
lea esp, [esp + 2]
mov byte [esp], al
pushfd
push word [esp + 2]
jge 0x13436a39
jl 0x13436a42
mov ebp, 0x3bc8a939
sub eax, 0xef881a9d
sbb dl, byte [0x894dd2fb]
and al, 8
pushfd
push dword [esp + 3]
jg 0x13436a12
mov dword [esp + 0xc], ebp
push si
push word [esp]
mov dword [esp + 0xc], esi
jmp 0x13436a64
jmp 0x13436ae3
mov dword [esp + 0x10], edi
lea esp, [esp + 0x10]
pushfd
jmp 0x13435bbd
bsr si, bx
xchg bp, dx
jmp 0x13436b0d
adc bx, 0x5acf
jo 0x13436acd
bsr si, bx
xchg bp, dx
bswap ebx
jmp 0x13436b0f
jmp 0x13436b5b
lea esp, [esp + 2]
jmp 0x13436b3c
bswap ebx
mov ebp, dword [esp + 0x2c]
bt bx, sp
jo 0x13436af5
cpuid
lea edi, [ebx*4]
sub esp, 0x12
lea esp, [esp + 2]
jmp 0x13436b3c
lea esi, [esp + 0x10]
mov al, cl
bswap ecx
xchg bx, ax
jmp 0x13436d40
cpuid
lea edi, [ebx*4]
sub esp, 0x12
jmp 0x13436af7
rdtsc
mov ax, word [esp]
push si
jmp 0x13436bd8
jo 0x13436bc6
lea ebx, [ebx*4]
neg dx
jmp 0x13436b69
inc bh
mov ebx, dword [esp]
lea edx, [ebx - 0x93c1]
sub esp, 0x19
jmp 0x13436c22
lea esp, [esp + 2]
sub ebp, 0x4ab6d94a
mov ax, word [esp]
xchg dx, ax
bsf ax, dx
jmp 0x13436bf8
lea ebx, [ebx*4]
neg dx
rdtsc
mov ax, word [esp]
push si
mov byte [esp], ch
jmp 0x13436ba3
lea edx, [ebx - 0x93c1]
sub esp, 0x19
lea esp, [esp + 1]
jmp 0x13436c26
jge 0x13436b8d
inc bh
mov ebx, dword [esp]
jmp 0x13436bdd
inc bl
jl 0x13436c45
bswap ebx
xchg al, ah
jmp 0x13436c2f
rdtsc
cmc
jg 0x13436c4b
bts ebx, eax
jmp 0x13436c56
lea esp, [esp + 1]
rol ebp, 0
xchg edx, eax
setbe al
jmp 0x13436c01
lea esp, [esp + 0x18]
dec ebp
lea eax, [eax - 0x6d]
xchg bh, al
xchg bx, dx
jmp 0x13436c0b
bswap ebx
xchg al, ah
jmp 0x13436c2f
bts ebx, eax
neg ebx
jmp 0x13436c82
neg ebx
not eax
mov ax, word [esp]
jmp 0x13436c88
mov ecx, ebp
mov dx, 0x4e62
xchg ebx, eax
mov bx, si
lea ebx, [ecx - 0x4b21]
clc
jmp 0x13436b7f
not eax
mov ax, word [esp]
xor ebp, 0x3ee1b810
call fcn.13436ccb
adc ah, byte [esi - 0x75]
add al, 0x24
mov bh, bl
xchg dl, ah
mov edx, esp
call fcn.13436d0d
test dword [0x1a17e49d], ecx
sbb al, 0x6f
xchg word [esp + 0x11], cx
pop ebx
pop dx
jmp 0x13436c6c
jmp 0x13436cab
sub esp, 0xb0
mov edi, esp
sub esp, 0x1a
js 0x13436d0b
xchg word [esp + 0x11], cx
pop ebx
pop dx
jmp 0x13436c6c
Function at 0x1343837e
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esi, 4
dec ebx
jmp 0x13438350
xchg ebx, edx
rdtsc
mov eax, 0xf08c9cda
jmp fcn.13436e13
inc edi
pop esi
aam 0x4a
sub eax, 0x80c1d3dc
inc ebx
cli
aad 0x44
mov dword [eax + edi], ebx
bswap ebx
xchg dl, ah
xchg edx, eax
sub esp, 0xc
jmp 0x1343834c
js 0x13438310
jns 0x13438310
jns 0x1343831a
xchg ebx, edx
rdtsc
jmp 0x13438394
push eax
pushfd
push word [esp]
jp 0x134383cf
jnp 0x134383cf
push 0xffffffffffffffe4
jp 0x134383a9
in al, dx
mov ss, word [ecx - 0x5af56cf0]
aam 0xb8
ficomp dword [esp + ecx*4 - 0x158a1610]
invalid
mov eax, 0xf08c9cda
jmp fcn.13436e13
loopne 0x13438412
loop 0x1343832d
je 0x13438425
jnp 0x134383a4
stc
fdivr dword [ebx]
adc cl, byte [ebp - 0x64f00f76]
ret
call fcn.134383b9
out 0xc9, al
push 0x677c228b
sub byte [ebp + 0x26], bh

Function at 0x1343fa78
Capabilities:
Execute anti-debugging instructions

Disassembly:
add bl, dl
call fcn.1343f722
not eax
mov edx, dword [esp + 1]
mov edx, 0x7e3fe26b
jmp 0x1343f917
lea esp, [esp + 4]
add cl, 0x4a
shl ax, cl
ja 0x1343f96b
jbe 0x1343f94f
mov ebp, 0x3acfa83a
xor eax, 0x648df29b
and al, 4
not cl
xchg dl, dh
call fcn.1343f8e8
jmp 0x1343f9a9
neg ah
rdtsc
rol ax, cl
jmp 0x1343f97c
neg ah
rdtsc
rol ax, cl
bsr ax, sp
jmp 0x1343f9c6
bsr ax, sp
xchg edx, eax
jmp 0x1343f9c8
add cl, 0x49
mov eax, dword [esp]
mov ah, bh
bsf dx, cx
jno 0x1343f9b0
lea edx, [edi*4]
sub esp, 0x1c
jmp 0x1343f9f4
mov bh, 0xf6
neg ah
jmp 0x1343f9ef
jmp 0x1343fa0a
xchg edx, eax
mov eax, dword [esp]
lea eax, [edx + 0x3c6c433c]
not edx
jmp 0x1343f984
jmp 0x1343f83c
shl eax, 0x10
neg eax
pop word [esp + 4]
jmp 0x1343fa1e
lea edx, [edi*4]
sub esp, 0x1c
shl eax, 0x10
neg eax
pop word [esp + 4]
fsub dword [esi - 0x71]
inc esp
and al, 4
lea esp, [esp + 2]
jmp 0x1343fa3e
xchg dh, dl
push dword [esp + 3]
rdtsc
call 0x1343fa4b
cmc
cmp bh, byte [edi - 0x2c46b5d1]
adc cl, byte [ebp + 0x61766f1c]
lea esp, [esp + 0x18]
neg cl
sub esp, 0x14
jge 0x1343fa24
jl 0x1343fa9c
mov dh, byte [esp]
mov edx, dword [esp]
mov dx, 0x1dee
mov edx, 0x305a29d8
jmp 0x1343fa77
or dx, sp
xchg dword [esp], edx
call 0x1343fa83
xchg edi, eax
push dword [esp + 1]
lea edx, [edx + 0x30]
call 0x1343faaa
cld
jl 0x1343faa4
jne 0x1343fa18
mov ecx, edx
dec ecx
fnstcw word [eax - 0x7997d4b5]
salc
xchg dh, dl
push dword [esp + 3]
rdtsc
call fcn.13440433
mov ah, 0xff
je 0x1343fad1
add eax, dword [edi - 0x16efdbac]
jb 0x1343fad2
add byte [eax], al
jns 0x1343fb1f
bsf dx, dx
bsf edx, edx
push dword [esp]
ret 4
add edx, 0x9061ec28
in al, dx
popal
nop
xchg dword [esp], edi
lea edx, [ecx - 0x839a]
setp dl
lea edx, [eax*4]
mov edx, 0xaa8a04b7
jmp 0x1343fab8
shl dx, 0xf
jmp 0x1343face
Function at 0x1343fa83
Capabilities:
Execute anti-debugging instructions

Disassembly:
add bl, dl
call fcn.1343f722
not eax
mov edx, dword [esp + 1]
mov edx, 0x7e3fe26b
jmp 0x1343f917
lea esp, [esp + 4]
add cl, 0x4a
shl ax, cl
ja 0x1343f96b
jbe 0x1343f94f
mov ebp, 0x3acfa83a
xor eax, 0x648df29b
and al, 4
not cl
xchg dl, dh
call fcn.1343f8e8
jmp 0x1343f9a9
neg ah
rdtsc
rol ax, cl
jmp 0x1343f97c
neg ah
rdtsc
rol ax, cl
bsr ax, sp
jmp 0x1343f9c6
bsr ax, sp
xchg edx, eax
jmp 0x1343f9c8
add cl, 0x49
mov eax, dword [esp]
mov ah, bh
bsf dx, cx
jno 0x1343f9b0
lea edx, [edi*4]
sub esp, 0x1c
jmp 0x1343f9f4
mov bh, 0xf6
neg ah
jmp 0x1343f9ef
jmp 0x1343fa0a
xchg edx, eax
mov eax, dword [esp]
lea eax, [edx + 0x3c6c433c]
not edx
jmp 0x1343f984
jmp 0x1343f83c
shl eax, 0x10
neg eax
pop word [esp + 4]
jmp 0x1343fa1e
lea edx, [edi*4]
sub esp, 0x1c
shl eax, 0x10
neg eax
pop word [esp + 4]
fsub dword [esi - 0x71]
inc esp
and al, 4
lea esp, [esp + 2]
jmp 0x1343fa3e
xchg dh, dl
push dword [esp + 3]
rdtsc
call 0x1343fa4b
cmc
cmp bh, byte [edi - 0x2c46b5d1]
adc cl, byte [ebp + 0x61766f1c]
lea esp, [esp + 0x18]
neg cl
sub esp, 0x14
jge 0x1343fa24
jl 0x1343fa9c
mov dh, byte [esp]
mov edx, dword [esp]
mov dx, 0x1dee
mov edx, 0x305a29d8
jmp 0x1343fa77
or dx, sp
xchg dword [esp], edx
call 0x1343fa83
xchg edi, eax
push dword [esp + 1]
lea edx, [edx + 0x30]
call 0x1343faaa
cld
jl 0x1343faa4
jne 0x1343fa18
mov ecx, edx
dec ecx
fnstcw word [eax - 0x7997d4b5]
salc
xchg dh, dl
push dword [esp + 3]
rdtsc
call fcn.13440433
mov ah, 0xff
je 0x1343fad1
add eax, dword [edi - 0x16efdbac]
jb 0x1343fad2
add byte [eax], al
jns 0x1343fb1f
bsf dx, dx
bsf edx, edx
push dword [esp]
ret 4
add edx, 0x9061ec28
in al, dx
popal
nop
xchg dword [esp], edi
lea edx, [ecx - 0x839a]
setp dl
lea edx, [eax*4]
mov edx, 0xaa8a04b7
jmp 0x1343fab8
shl dx, 0xf
jmp 0x1343face
Function at 0x134742cf
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, 0x1dbd34a3
jmp 0x134742d7
movzx esi, byte [eax + 3]
mov bh, 0x97
jmp 0x134742ad
shl edx, 8
xor edx, esi
mov dword [ecx], edx
jmp 0x1347431c
movzx esi, byte [eax + 5]
jmp 0x13474343
sub esp, 2
lea esp, [esp + 2]
movzx edx, byte [eax + 4]
mov bp, word [esp]
jmp 0x13474306
xor edx, esi
bswap ebp
jmp 0x1347434f
shl edx, 8
bsr bx, bx
stc
dec bl
jmp 0x1347432d
movzx esi, byte [eax + 6]
shl edx, 8
neg bx
cmc
jmp 0x13474360
xor edx, esi
sub esp, 8
bsf bp, bx
jmp 0x134743ae
shl edx, 8
mov bh, cl
xchg bp, di
xor edx, esi
mov esi, esp
jmp 0x134743d1
movzx edx, byte [eax + 8]
mov di, 0x1db0
jmp 0x134743bb
movzx esi, byte [eax + 7]
lea ebx, [ecx + edi]
not bl
mov ebx, esi
jmp 0x13474387
movzx esi, byte [eax + 9]
btr edi, ebp
lea ebx, [0x163b6e42]
jmp 0x13474572
mov dword [ecx + 4], edx
jmp 0x13474395
shl edx, 8
jmp 0x13474488
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
jmp 0x13474407
movzx esi, byte [eax + 0xd]
jmp 0x13474462
lea edi, [edi + 8]
mov dword [edi], edx
pop edi
movzx edx, byte [eax + 0xc]
jmp 0x13474428
movzx eax, byte [eax + 0xf]
jmp 0x1347446d
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
jmp 0x1347444c
shl edx, 8
xor edx, esi
shl edx, 8
jmp 0x134744a5
xor edx, esi
push edi
mov edi, ecx
jmp 0x13474440
lea edi, [edi + 0xc]
mov dword [edi], edx
pop edi
jmp 0x134744ac
xor edx, eax
push edi
mov edi, ecx
jmp 0x1347448f
pushal
mov si, 0xa9e0
lea ecx, [esp + eax]
mov dword [esp + 0x1c], edx
popal
jmp 0x134744fa
push esi
jmp 0x134744dd
pushal
xor edx, esi
movzx esi, byte [eax + 0xa]
jmp 0x1347441d
mov esi, eax
lea esi, [esi*4]
lea esi, [esi + 0x1342f8ac]
mov eax, dword [esi]
jmp 0x13474532
shr eax, 0x10
mov esi, 0xff
and eax, esi
jmp 0x134744bb
sub ebx, 0x20055826
shr edi, 8
bsr bx, sp
setnp bl
clc
jmp 0x13474556
mov edi, dword [edi*4 + 0x1342f8ac]
xchg bp, bx
mov bh, byte [esp]
jmp 0x13474540
pop esi
lea esp, [esp + 0x44]
xor eax, 0x1000000
mov edi, edx
jmp 0x13474506
and edi, 0xff0000
mov ebp, esp
jmp 0x13474898
and edi, esi
mov ebp, 0x3f6bae57
jmp 0x13474519
lea edi, [edx*4]
shl edx, 8
mov bx, word [esp]
setge bh
dec bh
jmp 0x134744d1
mov dword [esp + 0x1c], edi
sub esp, 6
lea esp, [esp + 2]
lea esp, [esp + 8]
popal
jmp 0x134745aa
pushal
dec ah
mov eax, esi
pushfd
xchg dx, ax
jmp 0x1347458a
lea ecx, [ecx*4]
lea ecx, [ecx + 0x1342f8ac]
movzx edi, byte [ecx]
pop ecx
neg bp
jmp 0x134745e2
mov edi, edx
shr edi, 0x18
push ecx
jmp 0x134745a0
mov edi, edx
call fcn.13474604
add byte [eax], al
je 0x134745d1
xchg edx, eax
cmc
add al, 0x10
inc edx
leave
pop ecx
cmp bl, cl
invalid
mov ebp, dword [esp]
xor eax, edi
mov bp, ax
mov ebp, edi
jmp 0x134745cc
and eax, 0xff000000
xor eax, edi
mov edi, 0x5cbf830a
not bp
bts bp, ax
jmp 0x134745c4
mov ebx, dword [ecx + 4]
mov bp, 0x3c0b
bswap ebp
mov bp, sp
jmp 0x13474631
Function at 0x13474604
Capabilities:
Encrypt data using aes

Disassembly:
lea ebp, [edx + ebp]
mov ebp, 0x954e80ab
push edi
jmp 0x13474610
stc
and edi, esi
mov edi, dword [edi*4 + 0x1342f8ac]
jmp 0x134745ee
mov ebp, 0xff00
and edi, ebp
xor eax, edi
jmp 0x134747f5
add esp, 9
pop dword [esp]
sub esp, 0xc
lea esp, [esp + 1]
mov eax, dword [ecx + 8]
jmp 0x13474697
push eax
mov eax, ecx
add eax, 0x14
jmp 0x13474681
lea esp, [esp + 2]
xor ebx, eax
mov dword [edi], eax
sub esp, 0x16
jmp 0x13474649
mov dword [eax], ebx
pop eax
jmp 0x1347475c
push bx
mov byte [esp], bh
add esp, 0
lea esp, [esp + 2]
xor eax, ebx
jmp 0x1347465b
mov edi, 0x1a73b8e9
lea edi, [ecx + 0x10]
stc
sub esp, 0x1f
add esp, 1
jmp 0x13474674
xor edx, eax
mov al, 0x7b
sub esp, 0xa
call fcn.134746e3
mov ecx, edx
lea edi, [ebx + esi]
shr edi, 0x1b
add di, cx
jmp 0x134747c9
mov dword [ecx + 0x18], eax
bsr bx, si
mov ebx, 0x7e4d8d30
not bl
jmp 0x1347471a
shr ecx, 8
dec edi
neg di
call fcn.13474782
lea esp, [esp + 0x4c]
and ecx, 0xff0000
and edi, 0xff000000
call fcn.1347485e
add byte [ebp - 0x7d7083eb], al
mov ah, 0xa7
into
pop ecx
mov eax, 0x8dd7a30f
cmp al, 0
bt edi, edx
lea edi, [eax + eax]
lea esp, [esp + 8]
xor eax, dword [ecx]
lea edi, [eax + 0xbf96]
jmp 0x134746bc

Function at 0x1347482e
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + 0x1342f8ac]
jmp 0x13474876
pushfd
lea esp, [esp + 3]
jmp 0x134748ee
shr edi, 0x18
stc
movzx edi, byte [edi*4 + 0x1342f8ac]
sub esp, 0x13
jmp 0x13474860
lea edi, [eax + 0x10]
jmp 0x134748cb
xor ecx, edx
lea esp, [esp + 0x3c]
xor ecx, dword [ebx]
neg edx
jmp 0x134748a9
xor ecx, dword [eax]
sets dh
add ebx, 4
add edx, edi
jmp 0x13474933
mov esi, edi
mov dword [esi], ecx
pop esi
mov dh, bl
call fcn.1347490f
sbb eax, 0xa66b0c9e
mov dl, 0x6f
jbe 0x1347494d
mov al, byte [0x21cf33e3]
ljmp 0xeb16
xor ecx, edi
and edx, ebp
mov edi, 0x162bd5c1
jmp 0x134748bf
mov dx, 0x64b8
mov dx, 0x675c
not dx
push esi
jmp 0x134748d7
bswap ecx
mov ecx, dword [eax + 8]
jmp 0x13474984
and dword [ecx + 0xcfd9a04], eax
sbb byte [ecx], dh
xor byte [ebx], dh
sub al, byte [ebp - 0xc]
xor edx, ecx
dec cx
mov dword [eax + 0x14], edx
lea ecx, [esi + edi]
cmp cx, dx
jmp 0x13474941
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
jmp 0x13474994
xor ecx, edx
lea edx, [ebp - 0x87]
mov dl, byte [esp]
mov dword [eax + 0x18], ecx
jmp 0x13474969
lea esp, [esp + 8]
cmp ebx, 0x134310d4
call fcn.134749f5
mov esi, 0xd2c64b2c
add al, 0x93
add esp, dword [esi - 0x6b]
pushfd
lcall 0x17e, 0x1ced8a14
mov edx, dword [ebx]
pop ebx
sub esp, 0x18
add esp, 0xf
lea esp, [esp + 1]
jmp 0x1347495a

Function at 0x13474eab
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
popal
jmp 0x13474ecb
mov di, word [esp]
pushal
mov dword [esp], edx
jmp 0x13474e95
mov edi, dword [edi*4 + 0x1342fcac]
jmp 0x13474f85
shr edi, 0x18
mov edi, dword [edi*4 + 0x1342f8ac]
and edi, ecx
jmp 0x13474eb5
push edx
mov edx, esi
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + 0x134304ac]
bsf ebx, ecx
jmp 0x13474f38
Function at 0x13474fd4
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
clc
push ebx
lea esp, [esp + 0x14]
jmp 0x13474fd7
stc
jmp 0x13474fb8
xor edi, dword [edx*4 + 0x134308ac]
neg dx
push eax
mov eax, esi
jmp 0x13474fea
add eax, 8
mov edx, dword [eax]
pop eax
pushal
push word [esp + 0x10]
jmp 0x13475031
lea esp, [esp + 2]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + 0x1342f8ac]
bsr di, cx
jmp 0x13475012

Function at 0x13475045
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
jmp 0x1347507e
mov edi, dword [edi*4 + 0x1342fcac]
jmp 0x13475068

Function at 0x134750be
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + 0x134308ac]
jmp 0x134750d6
jmp 0x134750a0
pushal
mov ax, bx
pushfd
mov di, si
mov dword [esp + 0x18], esi
call fcn.134750dd
adc al, 0x87
cmp dword cs:[eax], ebx
mov edx, dword [esi + 0xc]
stc
push edx
jmp 0x134750c0

Function at 0x134750dd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 8]
jmp 0x134750e7
popal
add edx, 8
mov dword [edx], edi
pop edx
jmp 0x13475146
shr edi, 0x18
sub esp, 0x17
lea esp, [esp + 3]
jmp 0x13475112
mov ebx, dword [ebx*4 + 0x1342f8ac]
cmc
mov edi, edx
jmp 0x13475128
Function at 0x40004544
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4000459d
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4000458e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4000458a
cmp esi, ecx
jae 0x4000458e
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x4000457a
cmp esi, ecx
jb 0x40004592
xor eax, eax
jmp 0x4000459c
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x400046d3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x308
lea eax, [ebp - 0x308]
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.40054740
add esp, 0xc
lea eax, [ebp - 0x308]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, str.Core.fx
lea eax, [ebp - 0x308]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x4000474e
push ebx
push str.WARNING
push str.Core.fx_is_not_exists_in_the_same_folder_
push ebx
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x400973b8], eax
test eax, eax
jne 0x4000479f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x100
mov esi, eax
lea eax, [ebp - 0x100]
push ebx
push eax
call fcn.40054740
push esi
lea eax, [ebp - 0x100]
push str.Failed_LoadLibrary_Core.fx___ErrorCode_lu_
push eax
call fcn.400033f6
add esp, 0x18
lea eax, [ebp - 0x100]
push ebx
push str.ERROR
push eax
push ebx
call edi
jmp 0x400047f7
push str.GetFunction
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x400047bc
push ebx
push str.ERROR
push str.Core.fx_is_broken__There_hasnt_GetFunction___
jmp 0x4000479a
push str.GetServiceCore
call eax
test eax, eax
jne 0x400047d4
push ebx
push str.ERROR
push str.Core.fx_is_broken__Error_in_GetFunction___
jmp 0x4000479a
push 0x400973b4
call eax
test eax, eax
jns 0x400047ec
push ebx
push str.ERROR
push str.Core.fx_isnt_return_ServiceCore...
jmp 0x4000479a
mov eax, dword [0x400973b4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40008379
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4007053e
call fcn.4006f3a0
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.boost::detail::thread_data_base.0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
call fcn.40008e9c
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
xor ecx, ecx
mov byte [ebp - 4], 3
inc ecx
call fcn.4000238c
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, esi
mov byte [esi + 0x38], 1
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4000849e
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, 0x4006fe68
call fcn.4006f3a0
sub esp, 0x2c
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x4002bc50
push 0
push 0
call fcn.4005b3ba
add esp, 0x18
test eax, eax
je 0x400084fd
mov ecx, dword [esi]
xor edx, edx
add ecx, 4
inc edx
lock xadd dword [ecx], edx
mov ecx, dword [esi]
push eax
add ecx, 8
call fcn.4002ad60
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push str.boost::thread_resource_error
push 0xb
lea ecx, [ebp - 0x38]
call fcn.40002315
mov dword [ebp - 0x38], vtable.boost::thread_resource_error.0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.400033bc
int3
Function at 0x400086c4
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x40097aac]
sub esp, 0x2d4
push ebx
push esi
push edi
mov edi, dword [0x4009726c]
test al, 1
jne 0x400086f9
or eax, 1
push str.Fenrir_Require_Acknowledge_Message
mov dword [0x40097aac], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x40097ab0], eax
jmp 0x400086fe
mov eax, dword [0x40097ab0]
xor ebx, ebx
push ebx
push 0x3e8
push 0x22
push ebx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x4000872a
mov dword [edi + 0x20], ebx
mov al, 1
jmp 0x400087f0
cmp eax, 0x5b4
jne 0x40008720
inc dword [edi + 0x20]
mov eax, dword [edi + 0x20]
cmp eax, 0x1e
jb 0x40008723
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, dword [0x400946dc]
mov ecx, dword [0x400946d8]
push ebx
push dword [0x40096024]
mov dword [ebp - 8], 0x400946d8
push ebx
push eax
mov eax, dword [0x400946e4]
sub eax, edx
push eax
mov eax, dword [0x400946e0]
sub eax, ecx
push eax
push edx
push ecx
push ebx
push ebx
push str.FenrirMainHiddenMessageWindow
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edx, dword [edi + 0x10]
push ecx
push ecx
push dword [edi + 0x14]
mov ecx, eax
call fcn.40048d40
cmp eax, 1
jne 0x40008720
push 0x2cc
lea eax, [ebp - 0x2d4]
push ebx
push eax
call fcn.40054740
add esp, 0xc
mov dword [ebp - 0x2d4], 0x1003f
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2d4]
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x400087e5
mov edx, dword [edi + 8]
push ecx
push dword [edi + 0xc]
lea ecx, [ebp - 0x2d4]
call fcn.4000cb22
pop ecx
pop ecx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40009402
Capabilities:
Get session user name

Disassembly:
mov eax, 0x40070178
call fcn.4006f3a0
sub esp, 0x10
and dword [ebp - 0x1c], 0
push esi
push edi
mov dword [ebp - 0x18], edx
mov edi, ecx
call fcn.40001ce1
push eax
lea ecx, [ebp - 0x10]
call fcn.40006f05
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
mov ecx, 0x101
push eax
mov dword [ebp - 0x14], ecx
push ecx
lea ecx, [ebp - 0x10]
call fcn.40006b63
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x40009494
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
jne 0x4000947f
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.40006b9b
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.40006b63
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x40009494
call esi
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.400073ec
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
jmp 0x400094ac
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.40006b9b
mov esi, dword [ebp - 0x10]
lea ecx, [esi - 0x10]
call fcn.400073ec
lea ecx, [esi - 0x10]
add eax, 0x10
mov dword [edi], eax
call fcn.40004636
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret