joyce8/EMBER2024-capa huggingface dataset:
Function at 0x526c60
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x114
mov eax, dword [0x6b8f0c]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x18]
mov ebx, ecx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x526c87
movsx eax, byte [esi]
push eax
call fcn.0058242a
add esp, 4
test eax, eax
je 0x526d36
lea ecx, [esp + 0x18]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x526ccf
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.Error:__u_n
call fcn.0057fbb0
add esp, 8
xor eax, eax
jmp 0x526da2
movsx edx, word [esi + 0xa]
movsx eax, word [esi + 8]
mov ecx, dword [esi + 4]
push edi
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
push str.name_s_naliases_s_naddrtype_d_nlength_d_n
call fcn.0057fbb0
mov eax, dword [esi + 0xc]
xor edi, edi
add esp, 0x14
cmp dword [eax], edi
je 0x526d35
movsx ecx, word [esi + 0xa]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0057e040
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea edx, [esp + 0x20]
push 0x59b67c
push edx
call fcn.0057dcef
mov eax, dword [esi + 0xc]
inc edi
lea eax, [eax + edi*4]
add esp, 0xc
cmp dword [eax], 0
jne 0x526cf7
pop edi
lea ecx, [esp + 0x18]
push ecx
push 0x20
push 0x6d9a24
call fcn.00582375
mov edx, dword [0x6d9a80]
mov esi, dword [esp + 0x130]
imul edx, edx, 0x58
add esp, 0xc
cmp si, word [edx + 0x6f4dd8]
jne 0x526d7f
cmp dword [0x6d9a48], 0
je 0x526d7f
cmp dword [0x6d9a7c], 0
jne 0x526d7f
mov ecx, 0x6d9a48
call fcn.00516a30
mov eax, dword [ebx + 0x114]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x118], eax
mov eax, ecx
mov ecx, dword [esp + 0x118]
pop esi
pop ebx
xor ecx, esp
call fcn.0057d76e
add esp, 0x114
ret 8
Function at 0x526e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6b8f0c]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x38]
cmp byte [esi + 1], 0x52
push edi
mov edi, ecx
jb 0x526e55
push 0
push 0xb9
push str.MHNetwork.cpp
call fcn.00528360
add esp, 0xc
lea eax, [esp + 0xc]
push ebx
mov dword [esp + 0x10], 0x56734661
mov dword [esp + 0x14], 0x31313561
mov dword [esp + 0x18], 0x76465341
mov dword [esp + 0x1c], 0x534d6163
mov dword [esp + 0x20], 0x215e5953
mov dword [esp + 0x24], 0x76732440
mov dword [esp + 0x28], 0x3172415a
mov dword [esp + 0x2c], 0x21405e26
mov dword [esp + 0x30], 0x7866732a
mov byte [esp + 0x34], 0
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x526eb0
sub eax, ecx
mov ecx, eax
xor edx, edx
lea ebx, [ecx - 1]
mov eax, ebp
div ebx
dec ecx
pop ebx
mov al, byte [esp + edx + 0xc]
xor byte [esi + 1], al
xor edx, edx
mov eax, ebp
div ecx
mov cl, byte [esp + edx + 0xc]
xor byte [esi + 2], cl
mov dl, byte [edi + 0x11c]
mov byte [esi], dl
mov eax, dword [edi + 0x118]
inc byte [edi + 0x11c]
test eax, eax
je 0x526f03
mov edi, dword [edi + 0x114]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push ebp
push esi
push eax
push edi
call edx
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0057d76e
add esp, 0x2c
ret 8
Function at 0x528360
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x6b8f0c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6db480], 0
je 0x5283ba
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.ASSERT___file:_s_line:_d___s__do_you_debug_
push 0x6db380
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0x40004
push 0
push 0x6db380
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x5283b5
int3
jmp 0x528586
cmp dword [ebp + 0x10], 0
je 0x5283e2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_line:_d__msg:_s_
lea eax, [ebp - 0x118]
push eax
call fcn.0057dcef
add esp, 0x14
jmp 0x5283fe
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_line:_d_
lea eax, [ebp - 0x118]
push eax
call fcn.0057dcef
add esp, 0x10
mov byte [ebp - 0x218], 0
push 0xff
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.0057df40
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx ecx, word [ebp - 0x12]
push ecx
movzx edx, word [ebp - 0x14]
push edx
push str.._Log_Assert__4d_02d_02d.txt
lea eax, [ebp - 0x218]
push eax
call fcn.0057dcef
add esp, 0x14
cmp dword [0x6db4d8], 0
jne 0x528586
push 0
lea ecx, [ebp - 0x2b0]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
jne 0x5284df
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5ab874
lea ecx, [ebp - 0x218]
push ecx
call fcn.0057db40
add esp, 8
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
je 0x5284da
call fcn.005286e0
push eax
lea edx, [ebp - 0x118]
push edx
push str._stime:_s_n
mov eax, dword [ebp - 0x2b4]
push eax
call fcn.0057d77d
add esp, 0x10
mov ecx, dword [ebp - 0x2b4]
push ecx
call fcn.0057d8f6
add esp, 4
jmp 0x528586
lea edx, [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x224]
shl ecx, 0x10
or ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x220], 0xf4240
ja 0x52857c
push 0x5ab874
lea eax, [ebp - 0x218]
push eax
call fcn.0057db40
add esp, 8
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
je 0x52857a
call fcn.005286e0
push eax
lea ecx, [ebp - 0x118]
push ecx
push str._stime:_s_n
mov edx, dword [ebp - 0x2b8]
push edx
call fcn.0057d77d
add esp, 0x10
mov eax, dword [ebp - 0x2b8]
push eax
call fcn.0057d8f6
add esp, 4
jmp 0x528586
mov dword [0x6db4d8], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057d76e
mov esp, ebp
pop ebp
ret
Function at 0x529750
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
mov eax, dword [0x6b8f0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x218], 0
push 0x1ff
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.0057df40
add esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x5297a8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_line:_d__msg:_s_
lea ecx, [ebp - 0x218]
push ecx
call fcn.0057dcef
add esp, 0x14
jmp 0x5297c4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_line:_d_
lea ecx, [ebp - 0x218]
push ecx
call fcn.0057dcef
add esp, 0x10
mov byte [ebp - 0x318], 0
push 0xff
push 0
lea edx, [ebp - 0x317]
push edx
call fcn.0057df40
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0xe]
push ecx
movzx edx, word [ebp - 0x12]
push edx
movzx eax, word [ebp - 0x14]
push eax
push str.._Log_Debug__4d_02d_02d.txt
lea ecx, [ebp - 0x318]
push ecx
call fcn.0057dcef
add esp, 0x14
cmp dword [0x6db820], 0
jne 0x52994c
push 0
lea edx, [ebp - 0x3b0]
push edx
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0xffffffff
jne 0x5298a5
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5ab874
lea edx, [ebp - 0x318]
push edx
call fcn.0057db40
add esp, 8
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
je 0x5298a0
call fcn.005286e0
push eax
lea eax, [ebp - 0x218]
push eax
push str._stime:_s_n
mov ecx, dword [ebp - 0x3b4]
push ecx
call fcn.0057d77d
add esp, 0x10
mov edx, dword [ebp - 0x3b4]
push edx
call fcn.0057d8f6
add esp, 4
jmp 0x52994c
lea eax, [ebp - 0x324]
push eax
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x31c], eax
mov edx, dword [ebp - 0x324]
shl edx, 0x10
or edx, dword [ebp - 0x31c]
mov dword [ebp - 0x320], edx
mov eax, dword [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x320], 0xf4240
ja 0x529942
push 0x5ab874
lea ecx, [ebp - 0x318]
push ecx
call fcn.0057db40
add esp, 8
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
je 0x529940
call fcn.005286e0
push eax
lea edx, [ebp - 0x218]
push edx
push str._stime:_s_n
mov eax, dword [ebp - 0x3b8]
push eax
call fcn.0057d77d
add esp, 0x10
mov ecx, dword [ebp - 0x3b8]
push ecx
call fcn.0057d8f6
add esp, 4
jmp 0x52994c
mov dword [0x6db820], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057d76e
mov esp, ebp
pop ebp
ret
Function at 0x54b010
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esi + 0x4c]
add eax, 0x493e0
cmp edi, eax
jbe 0x54b03d
mov ecx, esi
call fcn.0054afd0
push 0x5ae0b0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x4c], edi
pop edi
pop esi
ret

Function at 0x550de0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
mov esi, ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x550e19
pop esi
xor eax, eax
pop ebp
pop ecx
ret 4
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 4
push esi
push ebp
call edi
test al, al
jne 0x550e43
push 0
push 0x45
push str.TileManager.cpp
call fcn.00528360
add esp, 0xc
push 0
lea edx, [esp + 0x14]
push edx
push 4
lea ebx, [esi + 4]
push ebx
push ebp
call edi
test al, al
jne 0x550e68
push 0
push 0x47
push str.TileManager.cpp
call fcn.00528360
add esp, 0xc
mov eax, dword [ebx]
imul eax, dword [esi]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0057d0b8
mov dword [esi + 8], eax
mov eax, dword [ebx]
imul eax, dword [esi]
add esp, 4
xor edi, edi
test eax, eax
je 0x550ee4
mov ecx, dword [esi + 8]
push 0
lea edx, [esp + 0x14]
push edx
push 2
lea eax, [esp + 0x24]
push eax
push ebp
lea ebx, [ecx + edi*2]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test al, al
jne 0x550eb9
push 0
push 0x53
jmp 0x550ec4
cmp dword [esp + 0x10], 0
jne 0x550ed1
push 0
push 0x55
push str.TileManager.cpp
call fcn.00528360
add esp, 0xc
mov cx, word [esp + 0x18]
mov word [ebx], cx
mov edx, dword [esi + 4]
imul edx, dword [esi]
inc edi
cmp edi, edx
jb 0x550e94
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4
Function at 0x55f690
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x55f6ae
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.00528360
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x55f6c6
cmp esi, 0x11
je 0x55f6c6
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
ret 4
Function at 0x5770a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
mov eax, dword [0x6b8f0c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x74c], ecx
cmp dword [ebp + 8], 0
jne 0x5770c6
xor eax, eax
jmp 0x57732b
cmp dword [ebp + 0xc], 0
jne 0x5770d3
xor eax, eax
jmp 0x57732b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x744], eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 1
lea edx, [ebp - 0x331]
push edx
call fcn.00581b33
add esp, 0x10
mov eax, dword [ebp - 0x74c]
add eax, 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0x33c], 0
push 0x200
push 0
lea ecx, [ebp - 0x330]
push ecx
call fcn.0057df40
add esp, 0xc
lea edx, [ebp - 0x130]
push edx
push str._02X
mov eax, dword [ebp - 4]
push eax
call fcn.0057e789
add esp, 0xc
test eax, eax
jle 0x577174
cmp dword [ebp - 0x33c], 0x200
jge 0x577174
mov ecx, dword [ebp - 0x33c]
mov dl, byte [ebp - 0x130]
mov byte [ebp + ecx - 0x330], dl
mov eax, dword [ebp - 0x33c]
add eax, 1
mov dword [ebp - 0x33c], eax
mov ecx, dword [ebp - 4]
add ecx, 2
mov dword [ebp - 4], ecx
jmp 0x57711f
push 0x100
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x128]
push eax
call fcn.00575b40
add esp, 0xc
mov cl, byte [ebp + 0x14]
mov byte [ebp - 5], cl
mov dword [ebp - 0x338], 0
jmp 0x5771b0
mov edx, dword [ebp - 0x338]
add edx, 0x10
mov dword [ebp - 0x338], edx
mov eax, dword [ebp - 0x338]
cmp eax, dword [ebp - 0x744]
jge 0x5772aa
mov ecx, dword [ebp + 8]
push ecx
push 0x10
push 1
lea edx, [ebp - 0x740]
push edx
call fcn.00581b33
add esp, 0x10
cmp eax, 0x10
je 0x577225
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea eax, [ebp - 0x740]
push eax
call fcn.0057df40
add esp, 0xc
push 0x118
push 0
lea ecx, [ebp - 0x128]
push ecx
call fcn.0057df40
add esp, 0xc
xor eax, eax
jmp 0x57732b
lea edx, [ebp - 0x740]
push edx
lea eax, [ebp - 0x740]
push eax
push 0
lea ecx, [ebp - 0x128]
push ecx
call fcn.00575e40
add esp, 0x10
mov dword [ebp - 0x748], 0
jmp 0x57725f
mov edx, dword [ebp - 0x748]
add edx, 1
mov dword [ebp - 0x748], edx
cmp dword [ebp - 0x748], 0x10
jge 0x5772a5
mov eax, dword [ebp - 0x338]
add eax, dword [ebp - 0x748]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x748]
mov dl, byte [ebp + edx - 0x740]
mov byte [ecx + eax], dl
movsx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x338]
add ecx, dword [ebp - 0x748]
mov edx, dword [ebp + 0xc]
movsx ecx, byte [edx + ecx]
add eax, ecx
mov byte [ebp - 5], al
jmp 0x577250
jmp 0x5771a1
mov edx, dword [ebp + 8]
push edx
push 1
push 1
lea eax, [ebp - 0x129]
push eax
call fcn.00581b33
add esp, 0x10
movsx ecx, byte [ebp - 0x331]
movsx edx, byte [ebp - 0x129]
cmp ecx, edx
jne 0x5772e2
movsx eax, byte [ebp - 0x331]
movsx ecx, byte [ebp - 5]
cmp eax, ecx
je 0x577326
push 0
push str.Error__
push str.Header_Version_Error__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
push 0
lea edx, [ebp - 0x740]
push edx
call fcn.0057df40
add esp, 0xc
push 0x118
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.0057df40
add esp, 0xc
xor eax, eax
jmp 0x57732b
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0057d76e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x57d76e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6b8f0c]
jne 0x57d778
repz ret
jmp fcn.00584c3a

Function at 0x58f8bc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6b8f0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.005885cc
and dword [ebp - 0x14], 0
cmp dword [0x6fba50], 0
mov dword [ebp - 0x18], eax
jne 0x58f96f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x58fa17
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x58fa17
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5b5e7c
push ebx
mov dword [0x6fba50], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x6fba54], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x6fba58], eax
call edi
push eax
call esi
mov dword [0x6fba60], eax
test eax, eax
je 0x58f96f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x6fba5c], eax
mov eax, dword [0x6fba5c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x58f9c8
cmp dword [0x6fba60], ecx
je 0x58f9c8
push eax
call esi
push dword [0x6fba60]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x58f9c8
test ebx, ebx
je 0x58f9c8
call edi
test eax, eax
je 0x58f9bf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x58f9bf
test byte [ebp - 8], 1
jne 0x58f9c8
or dword [ebp + 0x10], 0x200000
jmp 0x58f9fb
mov eax, dword [0x6fba54]
cmp eax, dword [ebp - 0x18]
je 0x58f9fb
push eax
call esi
test eax, eax
je 0x58f9fb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x58f9fb
mov eax, dword [0x6fba58]
cmp eax, dword [ebp - 0x18]
je 0x58f9fb
push eax
call esi
test eax, eax
je 0x58f9fb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6fba50]
call esi
test eax, eax
je 0x58fa17
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x58fa19
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057d76e
leave
ret
Function at 0x10001000
Capabilities:
Get common file path
Terminate process

Disassembly:
mov eax, dword [0x10008b60]
sub esp, 0x420
test eax, eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
jne 0x1000108d
lea eax, [esp + 0x1c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x1c]
push 0x10006064
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x10008b60], eax
jne 0x1000108d
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x224]
push eax
push 0x10006044
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x224]
push 0x10
push 0x1000603c
push edx
push 0
call ebx
mov eax, dword [0x10008b60]
test eax, eax
jne 0x1000108d
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [esp + 0x430]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100010e9
mov eax, esi
shr eax, 0x10
jne 0x100010bb
push esi
lea ecx, [esp + 0x10]
push 0x10006038
push ecx
call edi
add esp, 0xc
lea esi, [esp + 0xc]
push esi
lea edx, [esp + 0x124]
push 0x10006010
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x120]
push 0x10
push 0x1000603c
push eax
push 0
call ebx
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
add esp, 0x420
ret 4

Function at 0x10001100
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x30c
cmp eax, 1
jne 0x100011ae
mov eax, dword [esp + 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea ecx, [esp]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp]
push 0x10006064
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x10008b60], eax
jne 0x10001190
lea ecx, [esp]
lea edx, [esp + 0x104]
push ecx
push 0x10006044
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x104]
push 0x10
push 0x1000603c
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x10008b60]
test eax, eax
je 0x100011a3
call fcn.10001850
mov eax, 1
add esp, 0x30c
ret 0xc
xor eax, eax
add esp, 0x30c
ret 0xc
test eax, eax
jne 0x100011c2
mov eax, dword [0x10008b60]
test eax, eax
je 0x100011c2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add esp, 0x30c
ret 0xc
Function at 0x10001f40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100040d8
push 0x10003280
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x10001fdb
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x10001fdb
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
mov esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x10001fdb
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x10001fdb
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002a30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100040e8
push 0x10003280
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10002aba
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
cmp word [eax], 0x5a4d
jne 0x10002ab3
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ecx], 0x4550
jne 0x10002ab3
cmp word [ecx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
je 0x10002aba
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
retf 0xcb00
push ebp
mov ebp, esp
sub esp, 0x78
push esi
mov esi, dword [ebp + 0xc]
mov bl, 0x8d
inc ebp
mov byte [edx + 0x78], ch
push eax
push esi
call 0x11a86e0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
enter 0x40c0, 0
push eax
push ecx
add edx, 0x40
push 0x78d4ac
push edx
add dword [0x8440c180], edx
jbe 0x401e1f
add al, byte [ecx + 0x5c]
add esp, 0x14
test eax, eax
je 0x401e8c
push eax
push 0x5fd254
call ebp
rol dword fs:[eax], 0xc1
les ecx, [eax]
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
sbb eax, 0x9090906d
nop
nop
nop
Function at 0x412281
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x412290
pop dword [ebp - 0x50]
mov eax, 0xd173a969
add eax, 0x2ecd7927
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x369ea
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x9cb7389c
add ecx, 0x634905af
mov edx, eax
mov esi, 0x436e00
add esi, dword [ebp - 0x50]
mov ebx, 0xb26ac8f0
mov edi, dword [esi]
add edi, ebx
xor dword [ebp - 0x40], edx
mov dword [edx], edi
add dword [ebp - 0x34], 0x6dfa5934
add edx, 4
add esi, 4
loop 0x4122de
add eax, 0x35b5e893
sub eax, 0x35b4fc94
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa7a93d86
sub ecx, 0xa7693d86
add ecx, dword [ebp - 0x50]
call ebx
leave
ret