joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005d1a1
Capabilities:
Get disk information

Disassembly:
call fcn.1004f860
test eax, eax
je 0x1005d1ae
call eax
jmp 0x1005d1b3
jmp fcn.10055b48
ret

Function at 0x1005dfd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x1005dff3
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.1005dc30
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.1005dc90
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.1005dd50
lea eax, [esp + 0x18]
push eax
call fcn.1005d630
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x1005dfc0
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x1005e0a4
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.1005dfa0
or ax, ax
je 0x1005e06c
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x1005e090
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x1005e090
lea eax, [esp + 0xa]
push esi
push eax
call fcn.1005d740
or al, al
jne 0x1005e0a4
jmp 0x1005e09f
lea eax, [esp + 8]
push esi
push eax
call fcn.1005d690
or al, al
jne 0x1005e0a4
mov word [esi], 0
mov ax, word [esi]
or ax, ax
je 0x1005e0bc
cmp ax, 0xffff
je 0x1005e0bc
mov al, 1
pop esi
pop ebx
add esp, 0x40
ret 8
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x1005e0e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, dword [esp + 0x50]
mov bx, word [esp + 0x4c]
cmp bx, 4
mov word [esi], 0
jbe 0x1005e103
sub al, al
pop esi
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x38]
push 0x10
push eax
call fcn.1005dc30
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.1005dc90
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.1005dd50
lea eax, [esp + 0x18]
push eax
call fcn.1005d630
add bl, 0x31
and eax, 0xffff
mov byte [esp + eax + 0x18], bl
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xc]
push 0x10
push eax
lea eax, [esp + 0x24]
push 0x1005e0d0
push eax
lea eax, [esp + 0x3c]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x1005e1b4
lea eax, [esp + 8]
push 0x2c
push eax
call fcn.1005dfa0
or ax, ax
je 0x1005e1b4
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x1005e1b4
cmp byte [esp + eax + 0xa], 0x3a
jne 0x1005e1b4
push esi
lea eax, [esp + eax + 0xf]
push eax
call fcn.1005d690
or al, al
jne 0x1005e1a0
jmp 0x1005e1af
mov ax, word [esi]
cmp ax, 1
jl 0x1005e1af
cmp ax, 6
jle 0x1005e1b4
mov word [esi], 0
cmp word [esi], 1
sbb al, al
inc al
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x1005e1e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
push esi
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.1005dc30
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.1005dc90
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.1005de40
lea eax, [esp + 4]
push 0x10
push eax
call fcn.1005ddf0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x18]
push 0x10
push eax
lea eax, [esp + 0x40]
push 0x1005e1d0
push eax
lea eax, [esp + 0x38]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov esi, eax
or esi, esi
je 0x1005e24f
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.1005d4c0
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
cmp esi, 1
sbb al, al
inc al
pop esi
add esp, 0x50
ret 8

Function at 0x1005e260
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp + 0x20]
push 0x10
push eax
call fcn.1005dc30
lea eax, [esp]
push 0x10
push eax
call fcn.1005dc90
lea eax, [esp + 0x10]
push 0x10
push eax
call fcn.1005dda0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push 0
push eax
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
mov ecx, dword [esp + 0x34]
cmp eax, 1
mov word [ecx], ax
sbb cl, cl
inc cl
mov al, cl
add esp, 0x30
ret 4

Function at 0x1005e2d0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
push esi
mov esi, dword [esp + 0x78]
push 0x10
mov word [esi], 0
lea eax, [esp + 8]
push 0
push eax
call fcn.1005d650
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.1005dc30
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.1005dc90
lea eax, [esp + 0x54]
push 0x10
push eax
call fcn.1005dcf0
lea eax, [esp + 0x34]
push 0x10
push eax
call fcn.1005dea0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.1005df50
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.1005df00
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 8]
push 0x10
push eax
lea eax, [esp + 0x60]
push 0x1005e2c0
push eax
lea eax, [esp + 0x58]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
or eax, eax
je 0x1005e3a3
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 8]
push eax
call fcn.1005d4c0
or al, al
je 0x1005e371
mov word [esi], 2
jmp 0x1005e3a3
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 8]
push eax
call fcn.1005d4c0
or al, al
je 0x1005e38b
mov word [esi], 3
jmp 0x1005e3a3
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.1005d4c0
or al, al
je 0x1005e3a3
mov word [esi], 1
cmp word [esi], 1
sbb al, al
inc al
pop esi
add esp, 0x70
ret 4
Function at 0x1005e590
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 4
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x18]
mov byte [esp + 0x13], 0
lea eax, [esi + 4]
mov edi, dword [esp + 0x1c]
mov dword [esi], eax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov ax, word [edi + 0xa]
mov word [esi + 6], ax
mov ax, word [edi + 0x14]
mov word [esi + 0x16], ax
mov ax, word [edi + 8]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
lea eax, [esi + 0x24]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
call fcn.1005e490
or al, al
jne 0x1005e71a
test byte [edi + 0x1c], 4
je 0x1005e5f3
mov byte [esp + 0x13], 1
sub cx, cx
sub dx, dx
lea esp, [esp]
mov ebp, ecx
and ebp, 0xffff
lea eax, [ebp*8]
sub eax, ebp
shl eax, 2
lea eax, [eax + eax*4]
lea ebx, [esi + eax]
lea eax, [ebp*4]
mov word [ebx + 0x36], cx
lea eax, [eax + eax*8]
lea ebp, [edi + eax]
mov ax, word [ebp + 0xe]
mov word [ebx + 0x9c], ax
mov ax, word [ebp + 0x12]
mov word [ebx + 0x8e], ax
mov ax, word [ebp + 0x16]
mov word [ebx + 0x34], ax
mov ax, word [ebp + 0x18]
mov word [ebx + 0x32], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x2c], eax
cmp cx, 3
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 0x28], eax
lea eax, [esi + 4]
mov dword [ebx + 0xa4], eax
jne 0x1005e680
mov dword [ebx + 0xa8], 0
jmp 0x1005e68c
lea eax, [ebx + 0xb0]
mov dword [ebx + 0xa8], eax
or cx, cx
jne 0x1005e6a0
mov dword [ebx + 0xac], 0
jmp 0x1005e6a9
lea eax, [ebx - 0x68]
mov dword [ebx + 0xac], eax
cmp byte [esp + 0x13], 0
je 0x1005e6c0
cmp word [ebp + 0xe], 0xffff
jne 0x1005e6c0
or dword [ebx + 0x2c], 8
jmp 0x1005e6c6
mov word [ebx + 0x36], dx
inc dx
inc cx
cmp cx, 4
jb 0x1005e600
push esi
call fcn.1005e500
push esi
call fcn.1005e440
push esi
call fcn.1005e400
mov eax, dword [esi + 0x10]
push eax
call fcn.1005f8c0
mov word [esi + 0xc], ax
or ax, ax
je 0x1005e710
lea eax, [esi + 4]
push eax
call fcn.1005f710
sub ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
push esi
call fcn.1005e3d0
mov ax, 9
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x10060810
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 0xa]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
push eax
push esi
call fcn.1005e730
mov eax, dword [esp + 0xc]
push 0xd
mov ax, word [eax + 4]
push eax
call fcn.10060340
or al, al
jne 0x1006089a
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.10061130
or al, al
jne 0x1006089a
mov eax, dword [esp + 0xc]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.10060ff0
mov di, ax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.10061180
or di, di
je 0x1006089a
mov ax, di
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x10060940
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
mov edi, dword [esp + 0x28]
push eax
mov esi, dword [esp + 0x28]
push edi
push esi
call fcn.1005e730
lea eax, [esp + 0xe]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
call fcn.1005e730
mov eax, dword [esp + 0x10]
push 0xe
mov ax, word [eax + 4]
push eax
call fcn.10060340
or al, al
jne 0x10060a23
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.10061130
mov bx, ax
or bl, bl
jne 0x100609f2
mov eax, dword [esp + 0x10]
mov ax, word [eax + 0xe]
push eax
mov eax, dword [esp + 0x14]
mov ax, word [eax + 0xc]
push eax
mov eax, dword [esp + 0x18]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [esp + 0x1c]
mov al, byte [eax + 8]
push eax
mov eax, dword [esp + 0x20]
mov ax, word [eax + 6]
push eax
mov eax, dword [esp + 0x24]
mov ax, word [eax + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.10061040
mov bx, ax
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.10061180
push esi
call fcn.1005e840
cmp ax, 0xd
jne 0x10060a02
mov bx, 0xd
cmp bl, 0xd
je 0x10060a0d
cmp bx, 3
jne 0x10060a20
mov ax, word [esp + 0xe]
dec word [esp + 0xe]
or ax, ax
jne 0x10060992
mov ax, bx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x100627d0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
push esi
mov byte [esp + 4], 0x52
mov byte [esp + 5], 0x4e
mov byte [esp + 6], 0x42
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x44
mov byte [esp + 9], 0x52
mov byte [esp + 0xa], 0x56
mov ax, word [esp + 0x18]
add al, 0x30
mov byte [esp + 0xb], al
mov esi, dword [esp + 0x14]
mov byte [esp + 0xc], 0
mov dword [esi], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x10062866
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x10062843
cmp eax, 3
jbe 0x1006285b
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10062850
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x80b
pop esi
add esp, 0xc
ret 8
mov ax, 0x80c
pop esi
add esp, 0xc
ret 8
mov ax, 0x800
pop esi
add esp, 0xc
ret 8

Function at 0x10062880
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov esi, dword [esp + 0x18]
push esi
mov word [esi + 6], 0xffff
call fcn.10062770
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov edi, dword [esp + 0x20]
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
or ebx, ebx
je 0x100628d0
lea eax, [esp + 0xc]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
mov eax, dword [edi]
push eax
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
push esi
call fcn.10062730
or ebx, ebx
je 0x100628e2
cmp word [esi + 6], 0xffff
jne 0x100628e8
mov word [esi + 6], 0x83b
mov ax, word [esi + 6]
pop edi
pop esi
pop ebx
add esp, 4
ret 8
Function at 0x10062a10
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
push esi
mov al, byte [esp + 0x1c]
push eax
lea eax, [esp + 8]
push eax
call fcn.100629d0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x10062a80
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x10062a59
cmp eax, 3
jbe 0x10062a71
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10062a66
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x10062a90
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
mov byte [esp + 4], 0x5c
mov byte [esp + 5], 0x5c
mov byte [esp + 6], 0x2e
mov byte [esp + 7], 0x5c
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x74
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xc], 0x6c
mov byte [esp + 0xd], 0x55
mov byte [esp + 0xe], 0x73
mov byte [esp + 0xf], 0x62
mov byte [esp + 0x10], 0
push 0
push 0x80
push 3
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x10062b30
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jb 0x10062b0b
cmp eax, 3
jbe 0x10062b23
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10062b18
push eax
call sub.KERNEL32.dll_CloseHandle
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x10062b50
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
push esi
push edi
mov esi, dword [esp + 0x14]
push esi
mov word [esi + 6], 0xffff
call fcn.10062770
lea eax, [esp + 8]
push 0
push eax
xor eax, eax
mov ax, word [esi + 2]
push eax
mov eax, dword [esp + 0x1c]
push esi
mov eax, dword [eax]
push eax
call sub.KERNEL32.dll_ReadFile
mov edi, eax
push esi
call fcn.10062730
cmp edi, 1
jne 0x10062b95
cmp word [esi + 6], 0xffff
jne 0x10062b9b
mov word [esi + 6], 0x23b
mov ax, word [esi + 6]
pop edi
pop esi
add esp, 4
ret 8
Function at 0x10062d50
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x24
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x49
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0x53
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x70
mov byte [esp + 0x21], 0
mov byte [esp], 0x49
mov byte [esp + 1], 0x6f
lea eax, [esp + 8]
mov byte [esp + 2], 0x45
mov byte [esp + 3], 0x6e
mov byte [esp + 4], 0x74
mov byte [esp + 5], 0x72
mov byte [esp + 6], 0x79
mov byte [esp + 7], 0
push eax
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GetPrivateProfileIntA
add esp, 0x24
ret

Function at 0x10066948
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push esi
push edi
lea esi, [ebp - 0x404]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push esi
call fcn.1004d620
add esp, 4
test eax, eax
je 0x100669b4
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x1006699a
push edi
lea eax, [ebp - 4]
push edi
push edi
push edi
push eax
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1006699a
cmp dword [ebp - 4], edi
jne 0x100669bc
push esi
call fcn.1004d620
add esp, 4
lea esi, [eax + esi + 1]
push esi
call fcn.1004d620
add esp, 4
test eax, eax
jne 0x10066974
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call fcn.100679ce
add esp, 4
jmp 0x100669b6

Function at 0x100669c9
Capabilities:
Get session user name

Disassembly:
push esi
push edi
mov edi, 0x1001a684
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.1004d6a0
lea eax, [esp + 0x18]
add esp, 8
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
mov eax, 0
jne 0x10066a02
push edi
push esi
call fcn.1004d6a0
add esp, 8
mov eax, 0xfffffffe
pop edi
pop esi
ret
Function at 0x10066afc
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push ebx
mov ecx, dword [eax]
push esi
mov edx, dword [eax + 4]
push edi
mov esi, 0xc6ef3720
mov edi, dword [esp + 0x24]
push ebp
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov ebp, dword [edi + 8]
mov dword [esp + 0x14], eax
mov edi, dword [edi + 0xc]
mov dword [esp + 0x18], ebx
mov ebx, 0x1f
mov dword [esp + 0x10], ebp
mov eax, ecx
mov ebp, ecx
shl eax, 4
shr ebp, 5
add eax, dword [esp + 0x10]
add ebp, edi
xor eax, ebp
lea ebp, [ecx + esi]
xor eax, ebp
sub edx, eax
mov ebp, edx
mov eax, edx
shl ebp, 4
shr eax, 5
add ebp, dword [esp + 0x14]
add eax, dword [esp + 0x18]
xor ebp, eax
lea eax, [edx + esi]
xor ebp, eax
add esi, 0x61c88647
sub ecx, ebp
mov eax, ebx
dec ebx
test eax, eax
jne 0x10066b31
mov eax, dword [esp + 0x24]
pop ebp
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov dword [eax + 4], edx
add esp, 0xc
ret

Function at 0x10067da0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4024e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40253b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40253b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402528
cmp esi, edx
jae 0x40253b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x402516
cmp esi, edx
jae 0x40253b
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x40447e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4044bd
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4044bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4044bd
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4044bd
cmp dword [ecx + 0x74], 0xe
jbe 0x4044bd
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40dbff
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40dc9c
push ebx
push esi
call fcn.0040dbc8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040db5c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40dc49
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40dc9b
push edi
push eax
call fcn.0040b581
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40dc69
call fcn.0040b547
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40dc9a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040db5c
add esp, 0x20
test eax, eax
jne 0x40dc88
push edi
call fcn.0040b547
jmp 0x40dc90
push ebx
call fcn.0040b547
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40de9c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417db0
push 0x417da8
push str.FlsAlloc
push 0x1f
call fcn.0040ddb8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ded0
push dword [ebp + 8]
mov ecx, esi
call dword [0x416170]
call esi
jmp 0x40ded6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40df1a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417dc0
push 0x417db8
push str.FlsGetValue
push 0x21
call fcn.0040ddb8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40df51
push dword [ebp + 8]
mov ecx, esi
call dword [0x416170]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40df59
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417dc8
push 0x417dc0
push str.FlsSetValue
push 0x22
call fcn.0040ddb8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40df93
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416170]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x415540
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41556d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41556d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret