joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dbe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47bf8d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4a90d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 8
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x201
mov dword [ebx + 0x18], 6
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0xc], 0
call fcn.00428aa3
mov esi, eax
add esp, 4
test esi, esi
je 0x42dc7d
push 1
mov dword [ebp - 4], 0
call fcn.00426554
add esp, 4
mov dword [esi + 4], eax
jmp 0x42dc7f
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov edi, dword [esi + 4]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push eax
call fcn.00426eb1
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x20]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x14]
mov byte [ebp - 0xd], al
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x42dd0e
mov edx, dword [edi]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x42dd0b
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x47d42c]
mov ecx, edi
call esi
mov al, byte [ebp - 0xd]
cmp dword [ebx + 0x38], 0
mov byte [ebx + 0x40], al
jne 0x42dd2a
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
and eax, 0x13
or eax, 4
mov dword [ebx + 0xc], eax
and ecx, eax
jne 0x42dd4d
cmp byte [ebp + 0xc], 0
je 0x42dd39
push ebx
call fcn.00426c2e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x42dd59
mov esi, str.ios_base::badbit_set
jmp 0x42dd69
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040e790
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.0040d470
push 0x4a5430
lea eax, [ebp - 0x30]
push eax
call fcn.0042eb3c
int3

Function at 0x4475d7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00447254
Function at 0x44d080
Capabilities:
Get storage device properties
Print debug messages
Reference absolute stream path on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov bl, 1
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x47e844
mov dword [ebp - 0x818], eax
xor bh, bh
mov dword [ebp - 0x814], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44d0e1
push str.C:_bambooxml_data_build_dirCRED_CSV2279_JOB1_srcCmgWinNtShield_srcCmgWinNtShieldLibCredGetDriveType.cpp:CredGetDriveTypeInternal____error_opening_CEF_device_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x44d150
push 0
lea eax, [ebp - 0x814]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push 4
lea eax, [ebp - 0x818]
push eax
push 0x83210118
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x44d149
push 0xd
lea eax, [ebp - 0x804]
push str.DeviceSpfd_
push eax
call fcn.004372ef
add esp, 0xc
test eax, eax
je 0x44d147
push 0xe
lea eax, [ebp - 0x804]
push str.DeviceSftVol
push eax
call fcn.004372ef
add esp, 0xc
test eax, eax
je 0x44d147
xor bh, bh
jmp 0x44d149
mov bh, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea eax, [ebp - 0x814]
mov dword [ebp - 0x810], 0
push eax
push 8
lea eax, [ebp - 0x820]
mov dword [ebp - 0x80c], 0
push eax
push 0xc
lea eax, [ebp - 0x810]
push eax
push 0x2d1400
push dword [ebp - 0x818]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x44d1a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
jmp 0x44d234
push dword [ebp - 0x81c]
call fcn.00428fea
mov edi, eax
add esp, 4
test edi, edi
jne 0x44d1b9
xor bl, bl
jmp 0x44d234
push 0
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x81c]
lea eax, [ebp - 0x810]
push edi
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x818]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x44d1fa
push edi
call fcn.00428a5e
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
jmp 0x44d234
mov eax, dword [edi + 0x1c]
dec eax
cmp eax, 0xc
ja case.default.0x44d20a
movzx eax, byte [eax + 0x44d264]
jmp dword [eax*4 + 0x44d258]
mov dword [esi], 4
jmp 0x44d22b
mov dword [esi], 3
jmp 0x44d22b
mov dword [esi], 2
jmp 0x44d22b
xor bl, bl
push edi
call fcn.00428a5e
add esp, 4
cmp dword [esi], 3
mov al, bl
jne 0x44d245
test bh, bh
je 0x44d245
mov dword [esi], 6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00428a63
mov esp, ebp
pop ebp
ret
Function at 0x44d280
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa40
mov eax, dword [0x4a90d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44d2a0
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x44d35e
push 0x104
lea eax, [ebp - 0x834]
push eax
push 0x104
lea eax, [ebp - 0xa3c]
push eax
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x104
lea eax, [ebp - 0x424]
push eax
push edi
call fcn.00438dcf
lea ecx, [ebp - 0x21c]
add esp, 0x24
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44d300
sub ecx, edx
sar ecx, 1
jne 0x44d32f
push 0x104
push 0x47f90c
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0043725b
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push 0x104
push eax
call fcn.004388db
add esp, 0x18
lea eax, [ebp - 0x62c]
push eax
jmp 0x44d35f
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
mov dword [ebp - 0xa40], esi
cmp esi, 3
jne 0x44d3c6
call fcn.0044d410
test al, al
je 0x44d3c6
mov eax, dword [0x496480]
movq xmm0, qword [str..X:]
push 0
push 0
mov dword [ebp - 0xc], eax
movzx eax, word [0x496484]
push esi
push 0
mov word [ebp - 8], ax
movzx eax, word [edi]
push esi
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x14]
push 0x80
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44d3d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428a63
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xa40]
push eax
push edi
call fcn.0044d080
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa40]
xor ecx, ebp
pop edi
pop esi
call fcn.00428a63
mov esp, ebp
pop ebp
ret
Function at 0x459d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov eax, edi
or eax, esi
or eax, edx
test al, 3
jne 0x459daf
shr edx, 2
push edx
push esi
push edi
call fcn.00459e70
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
test edx, edx
je 0x459e5f
push ebx
cmp edx, 0x40
jb 0x459e49
lea eax, [edx - 1]
lea ebx, [edx - 1]
add eax, esi
add ebx, edi
cmp edi, eax
ja 0x459dd5
cmp ebx, esi
jae 0x459e49
mov eax, edx
lea ebx, [esi + 0x30]
and eax, 0xffffffc0
mov edx, esi
sub edx, edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
lea eax, [edi + 0x10]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
movups xmm0, xmmword [eax - 0x10]
add ecx, 0x40
lea ebx, [ebx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ebx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [esi + eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebx - 0x50]
pxor xmm1, xmm0
movups xmm0, xmmword [ebx - 0x40]
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ecx, dword [ebp - 8]
jb 0x459df0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
cmp ecx, edx
jae 0x459e5e
sub esi, edi
lea eax, [ecx + edi]
sub edx, ecx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x459e50
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x459e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 8
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
je 0x459f33
push edi
cmp edx, 0x10
jb 0x459f1d
lea eax, [edx - 1]
lea eax, [esi + eax*4]
lea edi, [edx - 1]
lea edi, [ebx + edi*4]
cmp ebx, eax
ja 0x459ea9
cmp edi, esi
jae 0x459f1d
mov eax, edx
lea edi, [esi + 0x30]
and eax, 0xfffffff0
mov edx, esi
sub edx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
lea eax, [ebx + 0x10]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
movups xmm0, xmmword [eax - 0x10]
add ecx, 0x10
lea eax, [eax + 0x40]
lea edi, [edi + 0x40]
movups xmm1, xmmword [edi - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [esi + eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [edi - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [edi - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ecx, dword [ebp - 8]
jb 0x459ec4
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
cmp ecx, edx
jae 0x459f32
sub esi, ebx
lea eax, [ebx + ecx*4]
sub edx, ecx
mov ecx, dword [eax + esi]
lea eax, [eax + 4]
xor dword [eax - 4], ecx
sub edx, 1
jne 0x459f24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
lea edi, [edi + 3]
shr edi, 2
test edi, edi
je 0x45a0ba
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
sub ebx, esi
nop dword [eax + eax]
mov ecx, dword [ebx + esi]
lea esi, [esi + 4]
mov edx, ecx
mov eax, ecx
shr edx, 8
shl eax, 8
xor edx, eax
shl ecx, 8
and edx, 0xff00ff
xor edx, ecx
rol edx, 0x10
mov dword [esi - 4], edx
sub edi, 1
jne 0x45a090
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x45ca70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [eax]
mov ebx, dword [ebx + 0x44]
mov eax, dword [ebp + 0xc]
add ebx, 8
mov eax, dword [eax]
lea esi, [ebx + 0x40]
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
xor edi, dword [esi - 4]
sub esi, 4
push edi
call fcn.004602b0
mov ecx, eax
mov edx, edi
xor ecx, dword [ebp - 4]
add esp, 8
mov dword [ebp - 4], edx
mov edi, ecx
cmp esi, ebx
jne 0x45ca90
mov eax, dword [esi - 4]
xor eax, ecx
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [ecx], eax
mov eax, dword [esi - 8]
mov ecx, dword [ebp + 8]
xor eax, edx
pop esi
pop ebx
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x45cc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ecx + 0x44]
push edi
mov ebx, dword [ebx]
lea eax, [esi + 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edi, dword [eax]
nop dword [eax]
xor edi, dword [esi]
add esi, 4
push ecx
push edi
call fcn.004602b0
mov ecx, dword [ebp + 0x10]
xor eax, ebx
add esp, 8
mov ebx, edi
mov edi, eax
cmp esi, dword [ebp - 4]
jne 0x45cc40
mov ecx, dword [esi]
xor ecx, eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
xor eax, ebx
pop esi
pop ebx
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x460cc0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x460cf3
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
pop ebp
ret

Function at 0x462a10
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x28]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.00463650
add esp, 8
mov ebx, eax
push esi
test ebx, ebx
je 0x462a9c
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00463500
add esp, 0x18
test eax, eax
jne 0x462a90
mov edx, dword [ebp + 0x24]
xor esi, esi
mov ecx, dword [ebp - 4]
test ecx, ecx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x18]
push edx
push dword [ebp + 0x20]
cmovne eax, esi
test ecx, ecx
push eax
mov eax, dword [ebp + 0x14]
cmovne eax, esi
push eax
push esi
push edx
push dword [ebp + 0x1c]
push dword [ebx + 4]
call sub.bcrypt.dll_BCryptEncrypt
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 3
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.00464a00
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x462ae1
push esi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00464ab0
add esp, 0x14
test eax, eax
js 0x462a90
movzx eax, word [ebp + 0x24]
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push eax
push dword [ebp + 0x1c]
call fcn.004649c0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462af0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0x28]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.00463650
add esp, 8
mov ebx, eax
push esi
test ebx, ebx
je 0x462b7c
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00463500
add esp, 0x18
test eax, eax
jne 0x462b70
mov edx, dword [ebp + 0x24]
xor esi, esi
mov ecx, dword [ebp - 4]
test ecx, ecx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x18]
push edx
push dword [ebp + 0x20]
cmovne eax, esi
test ecx, ecx
push eax
mov eax, dword [ebp + 0x14]
cmovne eax, esi
push eax
push esi
push edx
push dword [ebp + 0x1c]
push dword [ebx + 4]
call sub.bcrypt.dll_BCryptDecrypt
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 3
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.00464a00
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x462bc1
push esi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.00464ab0
add esp, 0x14
test eax, eax
js 0x462b70
movzx eax, word [ebp + 0x24]
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push eax
push dword [ebp + 0x1c]
call fcn.00464890
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x462c70
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
push dword [eax + 0x68]
call fcn.0045bea0
mov esi, eax
add esp, 4
cmp dword [esi], 0
jne 0x462c9c
push 0
push 0
push 0x48b444
push esi
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
jne 0x462cb2
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jne 0x462cb2
pop esi
pop ebp
ret
mov eax, 3
pop esi
pop ebp
ret

Function at 0x46aef0
Capabilities:
Check if file exists

Disassembly:
cmp dword [esp + 4], 0
je 0x46af63
mov eax, dword [esp + 8]
test eax, eax
je 0x46af63
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x46af5c
mov cl, byte [eax + 0xa]
cmp cl, 1
jne 0x46af1e
push 0
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x46af2f
cmp cl, 2
jne 0x46af5c
push 0
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x46af56
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x46af4f
cmp eax, 0x7e
je 0x46af4f
cmp eax, 3
je 0x46af4f
mov eax, 0x2711
pop esi
ret
mov eax, 0x2718
pop esi
ret
mov dword [esi], eax
xor eax, eax
pop esi
ret
mov eax, 0x2721
pop esi
ret
mov eax, 0x2721
ret
Function at 0x401180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
nop
bt eax, 0xe0
xor ah, 0x3d
sub al, 0xb5
test ebp, ebx
xor al, al
xadd eax, eax
xadd ah, al
neg eax
imul eax, ebx, 0x78b3bbf9
inc eax
imul eax, edx, 0xf9539b11
and eax, 0xc7e2d3ce
movsx eax, si
bsf eax, ecx
movsx eax, bx
btc eax, 0xb
dec eax
test cl, bl
mov eax, 0x2e383802
mov ah, 0x3d
mov ah, 0x8e
shrd eax, ebp, cl
movzx eax, dh
movsx eax, bl
test ecx, eax
shrd eax, esi, cl
rcl ah, 0x62
test ecx, edi
imul eax, ebp
bsf eax, edx
xadd al, ah
test edi, esi
dec al
bswap eax
dec ah
sub al, cl
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
je 0x401204
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [ebp - 8], edi
cmp dword [edi], 0x4550
je 0x40121d
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
push 4
push 0x2000
push eax
push ecx
call dword [0x430390]
mov esi, eax
test esi, esi
mov dword [ebp - 4], esi
jne 0x40125e
mov edx, dword [edi + 0x50]
push 4
push 0x2000
push edx
push eax
call dword [0x430390]
test eax, eax
mov dword [ebp - 4], eax
jne 0x40125b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor eax, eax
push 4
push 0x1000
mov dword [ebx + 4], esi
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x50]
push eax
push esi
call dword [0x430390]
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push esi
call dword [0x430390]
mov esi, dword [ebp + 8]
mov edx, dword [edi + 0x54]
mov edi, eax
push ebx
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 4]
push edi
mov edx, dword [ecx + 0x3c]
push ecx
add eax, edx
mov dword [ebx], eax
mov dword [eax + 0x34], esi
call fcn.00401350
mov ecx, dword [edi + 0x34]
mov eax, esi
add esp, 0xc
sub eax, ecx
je 0x4012ef
push eax
push ebx
call fcn.004014f0
add esp, 8
push ebx
call fcn.004015e0
add esp, 4
test eax, eax
je 0x40131f
push ebx
call fcn.00401430
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x401338
add eax, esi
test eax, eax
je 0x40131f
push 0
push 1
push esi
call eax
test eax, eax
jne 0x401331
push ebx
call fcn.004018d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx + 0x10], 1
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401350
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push str.VirtualAlloc
push 0x405040
mov ebp, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi]
xor ecx, ecx
mov dword [esp + 0xc], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x401427
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x4013d2
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x401406
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [0x430390]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x401406
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [0x430390]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x401395
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x401430
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x4014e4
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401487
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4014ca
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov edx, dword [edx*4 + 0x405050]
je 0x40149e
or dh, 2
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x4014b7
test al, 0x40
je 0x4014ae
mov ecx, dword [ebx + 0x20]
jmp 0x4014b5
test al, 0x80
je 0x4014ca
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x4014ca
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x401454
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret