joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461120
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x51b7bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.004647d0
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.00460130
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x46118a
mov al, byte [edi + ecx]
test al, al
je 0x46118a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x461171
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x4611ab
inc eax
sub ecx, 1
jne 0x4611a0
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x461200
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x4611f5
lea edi, [ebp - 0x84]
mov eax, SysReAllocString
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x4611f4
mov bl, byte [edi + ecx]
test bl, bl
je 0x4611f4
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x4611e0
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.004647d0
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x4f9540
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x4612ba
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x461284
test cl, cl
je 0x461280
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x461284
add eax, 2
add esi, 2
test cl, cl
jne 0x461264
xor eax, eax
jmp 0x461289
sbb eax, eax
or eax, 1
test eax, eax
je 0x4612ba
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x461296
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4612c3
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x4f9540
push str.SoftwareComMaster
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00458638
mov esp, ebp
pop ebp
ret

Function at 0x4a3a37
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a31bb

Function at 0x4a3a42
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a33fa

Function at 0x4a45a2
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a446f

Function at 0x4abcbb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ab8bb
Function at 0x4abcc6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004aba3e

Function at 0x4b0dbd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x522e28]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4b0dfe
cmp byte [edx], 0xa
jne 0x4b0dfe
or byte [eax + edi + 0x28], 4
jmp 0x4b0e03
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x4b0ef4
mov al, byte [ebx]
cmp al, 0x1a
je 0x4b0ed5
cmp al, 0xd
je 0x4b0e2c
mov byte [esi], al
inc esi
inc ebx
jmp 0x4b0eca
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x4b0e4c
cmp byte [eax], 0xa
jne 0x4b0e41
push 2
mov byte [esi], 0xa
pop eax
jmp 0x4b0e47
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x4b0eca
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b0ec3
cmp dword [ebp - 0x14], 0
je 0x4b0ec3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x522e28]
test byte [eax + edi + 0x28], 0x48
je 0x4b0e9a
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x4b0e8a
mov byte [esi], dl
jmp 0x4b0ec6
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x522e28]
mov byte [eax + edi + 0x2a], dl
jmp 0x4b0ec6
cmp byte [ebp - 1], 0xa
jne 0x4b0eac
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4b0eac
mov byte [esi], 0xa
jmp 0x4b0e49
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004ae833
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4b0ec7
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x4b0e15
jmp 0x4b0ef4
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x522e28]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4b0eef
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4b0ef4
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b0eff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x522e28]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x4b0f43
cmp word [edx], bx
jne 0x4b0f43
or byte [edi + eax + 0x28], 4
jmp 0x4b0f48
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x4b109c
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x4b107c
cmp ax, word [ebp - 0x10]
je 0x4b0f81
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x4b1071
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x4b0fa7
push 0xa
pop ecx
cmp word [eax], cx
jne 0x4b0f97
push ecx
pop eax
push 4
jmp 0x4b0f9c
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x4b106b
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4b1062
cmp dword [ebp - 0x18], 0
je 0x4b1062
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x522e28]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4b102e
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4b0ff2
mov word [esi], ax
jmp 0x4b1026
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x522e28]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x522e28]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x522e28]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x4b1071
cmp word [ebp - 4], ax
jne 0x4b1043
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x4b1043
mov word [esi], ax
add esi, 2
jmp 0x4b1071
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004ae833
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x4b106e
jmp 0x4b1065
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x4b0f61
jmp 0x4b109c
mov ecx, dword [ecx*4 + 0x522e28]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x4b1093
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x4b109c
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b50b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.004b56c0
add esp, 8
test al, al
je 0x4b50d5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4b50d5
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x4b56c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x4b6b70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b6b9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4b6b9b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x408941
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.00408969
push ebx
pop edx
sub ebx, 0x41d24ce8
xor dword [ecx], eax
and edx, ebx
inc ecx
sub edx, edx
add ebx, edx
cmp ecx, esi
jne fcn.00408941
and edx, ebx
ret
Function at 0x406710
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41f86b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4044b4
call fcn.004092a4
push 4
mov dword [esp + 0x18], 0
call fcn.0040aa56
mov edi, eax
add esp, 4
test edi, edi
je 0x406784
push ebx
call fcn.0040909f
mov dword [edi], eax
call fcn.00408e5e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409265
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406778
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040928d
pop ebx
jmp 0x406786
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b54e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4233dc]
jne 0x40b558
repz ret
jmp fcn.004126ec
Function at 0x41807b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4233dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e385
and dword [ebp - 0x14], 0
cmp dword [0x82cfd4], 0
mov dword [ebp - 0x18], eax
jne 0x41812e
push 0x403fc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4181d6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fb4
push ebx
call edi
test eax, eax
je 0x4181d6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fa4
push ebx
mov dword [0x82cfd4], eax
call edi
push eax
call esi
push 0x403f90
push ebx
mov dword [0x82cfd8], eax
call edi
push eax
call esi
push 0x403f74
push ebx
mov dword [0x82cfdc], eax
call edi
push eax
call esi
mov dword [0x82cfe4], eax
test eax, eax
je 0x41812e
push 0x403f5c
push ebx
call edi
push eax
call esi
mov dword [0x82cfe0], eax
mov eax, dword [0x82cfe0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x418187
cmp dword [0x82cfe4], ecx
je 0x418187
push eax
call esi
push dword [0x82cfe4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x418187
test ebx, ebx
je 0x418187
call edi
test eax, eax
je 0x41817e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41817e
test byte [ebp - 8], 1
jne 0x418187
or dword [ebp + 0x10], 0x200000
jmp 0x4181ba
mov eax, dword [0x82cfd8]
cmp eax, dword [ebp - 0x18]
je 0x4181ba
push eax
call esi
test eax, eax
je 0x4181ba
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4181ba
mov eax, dword [0x82cfdc]
cmp eax, dword [ebp - 0x18]
je 0x4181ba
push eax
call esi
test eax, eax
je 0x4181ba
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x82cfd4]
call esi
test eax, eax
je 0x4181d6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4181d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b54e
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x406720
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41fc9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4044bc
call fcn.004092b4
push 4
mov dword [esp + 0x18], 0
call fcn.0040aa66
mov edi, eax
add esp, 4
test edi, edi
je 0x406794
push ebx
call fcn.004090af
mov dword [edi], eax
call fcn.00408e6e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409275
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406788
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040929d
pop ebx
jmp 0x406796
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b55e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4233dc]
jne 0x40b568
repz ret
jmp fcn.004126cc
Function at 0x41808b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4233dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e395
and dword [ebp - 0x14], 0
cmp dword [0x82d0d4], 0
mov dword [ebp - 0x18], eax
jne 0x41813e
push 0x403fc0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4181e6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fb4
push ebx
call edi
test eax, eax
je 0x4181e6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fa4
push ebx
mov dword [0x82d0d4], eax
call edi
push eax
call esi
push 0x403f90
push ebx
mov dword [0x82d0d8], eax
call edi
push eax
call esi
push 0x403f74
push ebx
mov dword [0x82d0dc], eax
call edi
push eax
call esi
mov dword [0x82d0e4], eax
test eax, eax
je 0x41813e
push 0x403f5c
push ebx
call edi
push eax
call esi
mov dword [0x82d0e0], eax
mov eax, dword [0x82d0e0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x418197
cmp dword [0x82d0e4], ecx
je 0x418197
push eax
call esi
push dword [0x82d0e4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x418197
test ebx, ebx
je 0x418197
call edi
test eax, eax
je 0x41818e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41818e
test byte [ebp - 8], 1
jne 0x418197
or dword [ebp + 0x10], 0x200000
jmp 0x4181ca
mov eax, dword [0x82d0d8]
cmp eax, dword [ebp - 0x18]
je 0x4181ca
push eax
call esi
test eax, eax
je 0x4181ca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4181ca
mov eax, dword [0x82d0dc]
cmp eax, dword [ebp - 0x18]
je 0x4181ca
push eax
call esi
test eax, eax
je 0x4181ca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x82d0d4]
call esi
test eax, eax
je 0x4181e6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4181e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b55e
leave
ret
Function at 0x402a7e
Capabilities:
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
mov eax, dword [0x432018]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push esi
push edi
mov dword [esp + 0xc], edx
mov esi, ecx
push edi
push edx
add esp, 4
xor edi, 0x9ef3
sub edi, 0x14f61
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0x15cfb
pop ecx
push esi
add esi, 0x19cb
and esi, 0xf4f7
xor esi, 0x79c6
pop esi
cmp byte [esi + 9], 0
je 0x402c3e
mov edi, dword [esi + 4]
sub edi, dword [esi]
push ebx
push edi
add esp, 4
or ebx, 0x11dc8
jmp 0x402ae8
add ebx, 0x1838
or ebx, 0xa5ee
pop ebx
push esi
push ecx
add esp, 4
sub esi, 0xeac5
jmp 0x402b07
pop esi
je 0x402c3e
and dword [esp + 0x10], 0
push eax
push edx
add esp, 4
xor eax, 0x2ed3
jmp 0x402b23
call 0x402b31
add byte [edi + 0x3d], cl
dec ecx
dec esi
cmp dword [eax], edi
dec esi
inc esp
add esp, 4
pop eax
push ebx
sub ebx, 0xdd57
jmp 0x402b44
pop ebx
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push edi
push dword [esi]
call ebp
test eax, eax
je 0x402c3e
push ebx
mov ebx, dword [esi]
lea eax, [ebx + edi]
cmp ebx, eax
jae 0x402bc3
mov ebp, dword [esp + 0x10]
push esi
add esi, 0x5702
call 0x402b83
add byte [0x4744424e], bh
inc ebp
dec ecx
dec ecx
add esp, 4
sub esi, 0x1349e
add esi, 0x961a
pop esi
push ecx
push edx
add esp, 4
add ecx, 0x4ac3
pop ecx
mov eax, dword [ebp]
mov ecx, ebp
mov edx, dword [eax]
mov al, byte [esi + 8]
mov byte [esp + 0x10], al
push dword [esp + 0x10]
push ebx
call edx
mov eax, dword [esi]
inc ebx
add eax, edi
cmp ebx, eax
jb 0x402b6d
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push ebx
add esp, 4
or ebx, 0x174f1
call 0x402bdd
add byte [ebx + 0x3a], cl
aaa
inc edx
xor al, byte [edx + 0x4d]
dec ebx
dec ebx
add esp, 4
jmp 0x402be6
pop ebx
push esi
add esi, 0x1077d
xor esi, 0x1844b
pop esi
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push edi
push dword [esi]
call ebp
pop ebx
test eax, eax
je 0x402c3e
push ebx
jmp 0x402c0f
add ebx, 0x2140
call 0x402c23
add byte [ebx + 0x36], cl
xor bh, byte [ecx]
inc edi
dec ebx
xor al, byte [esi - 0x7d]
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [ecx + 0x46], al
cmp byte [edi + 0x3b464739], dh
dec ecx
add esp, 4
pop ebx
mov al, 1
jmp 0x402c40
xor al, al
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004117ed
add esp, 0xc
ret
Function at 0x402b31
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
mov eax, dword [0x432018]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push esi
push edi
mov dword [esp + 0xc], edx
mov esi, ecx
push edi
push edx
add esp, 4
xor edi, 0x9ef3
sub edi, 0x14f61
pop edi
push ecx
push ebx
add esp, 4
xor ecx, 0x15cfb
pop ecx
push esi
add esi, 0x19cb
and esi, 0xf4f7
xor esi, 0x79c6
pop esi
cmp byte [esi + 9], 0
je 0x402c3e
mov edi, dword [esi + 4]
sub edi, dword [esi]
push ebx
push edi
add esp, 4
or ebx, 0x11dc8
jmp 0x402ae8
add ebx, 0x1838
or ebx, 0xa5ee
pop ebx
push esi
push ecx
add esp, 4
sub esi, 0xeac5
jmp 0x402b07
pop esi
je 0x402c3e
and dword [esp + 0x10], 0
push eax
push edx
add esp, 4
xor eax, 0x2ed3
jmp 0x402b23
call 0x402b31
add byte [edi + 0x3d], cl
dec ecx
dec esi
cmp dword [eax], edi
dec esi
inc esp
add esp, 4
pop eax
push ebx
sub ebx, 0xdd57
jmp 0x402b44
pop ebx
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push edi
push dword [esi]
call ebp
test eax, eax
je 0x402c3e
push ebx
mov ebx, dword [esi]
lea eax, [ebx + edi]
cmp ebx, eax
jae 0x402bc3
mov ebp, dword [esp + 0x10]
push esi
add esi, 0x5702
call 0x402b83
add byte [0x4744424e], bh
inc ebp
dec ecx
dec ecx
add esp, 4
sub esi, 0x1349e
add esi, 0x961a
pop esi
push ecx
push edx
add esp, 4
add ecx, 0x4ac3
pop ecx
mov eax, dword [ebp]
mov ecx, ebp
mov edx, dword [eax]
mov al, byte [esi + 8]
mov byte [esp + 0x10], al
push dword [esp + 0x10]
push ebx
call edx
mov eax, dword [esi]
inc ebx
add eax, edi
cmp ebx, eax
jb 0x402b6d
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push ebx
add esp, 4
or ebx, 0x174f1
call 0x402bdd
add byte [ebx + 0x3a], cl
aaa
inc edx
xor al, byte [edx + 0x4d]
dec ebx
dec ebx
add esp, 4
jmp 0x402be6
pop ebx
push esi
add esi, 0x1077d
xor esi, 0x1844b
pop esi
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push edi
push dword [esi]
call ebp
pop ebx
test eax, eax
je 0x402c3e
push ebx
jmp 0x402c0f
add ebx, 0x2140
call 0x402c23
add byte [ebx + 0x36], cl
xor bh, byte [ecx]
inc edi
dec ebx
xor al, byte [esi - 0x7d]
les eax, [eax + ebp*8]
or eax, dword [eax]
add byte [eax], al
add byte [ecx + 0x46], al
cmp byte [edi + 0x3b464739], dh
dec ecx
add esp, 4
pop ebx
mov al, 1
jmp 0x402c40
xor al, al
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004117ed
add esp, 0xc
ret
Function at 0x403100
Capabilities:
Create thread

Disassembly:
push 0x2c
mov eax, 0x42357c
call fcn.00412071
mov eax, dword [ebp + 8]
xor edi, edi
mov esi, dword [eax]
test esi, esi
je 0x403196
mov esi, dword [esi]
lea eax, [ecx + 4]
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call fcn.00402da1
mov dword [ebp - 0x20], esi
push 0x1c
mov dword [ebp - 4], edi
call fcn.004117fb
mov esi, eax
lea eax, [ebp - 0x38]
pop ecx
push eax
mov ecx, esi
call fcn.00402cb8
mov ecx, dword [ebp - 0x20]
mov dword [esi + 0x18], ecx
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push edi
push esi
push 0x403816
push edi
push edi
call fcn.0041530c
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x40319e
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.004037fc
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00402c85
cmp dword [ebp - 0x18], edi
jne 0x4031a8
lea ecx, [ebp - 0x38]
call fcn.00402d36
call fcn.0041202f
ret 4
push 6
mov dword [ebp - 0x18], edi
call fcn.00410dee
call fcn.0041539d
int3