joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4cb7
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4d6040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4a4d02
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004a516f
test al, al
jne 0x4a4cfc
sub edx, 2
cmp edx, edi
jne 0x4a4ce2
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4a4d24
lea eax, [edi + 2]
cmp edx, eax
je 0x4a4d24
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004a48b0
add esp, 0x10
jmp 0x4a4e1e
push esi
lea ecx, [ebp - 0x255]
call fcn.004a516f
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a4d67
push dword [ebp - 0x25c]
jmp 0x4a4d14
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4a4da4
cmp word [ebp - 0x226], 0
je 0x4a4dc5
cmp word [ebp - 0x226], ax
jne 0x4a4da4
cmp word [ebp - 0x224], 0
je 0x4a4dc5
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004a48b0
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4a4e11
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4a4d7e
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4a4df9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4a4e1e
push 0x4a4298
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004054ca
add esp, 0x10
jmp 0x4a4dee
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040303f
leave
ret

Function at 0x4aa780
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004042a5
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4aa7ef
cmp esi, dword [ebp - 4]
je 0x4aa7ea
cmp dword [ebp + 0xc], 0
je 0x4aa7ea
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4aa7c7
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004aa1a8
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x4aa7f1
xor eax, eax
inc eax
jmp 0x4aa7f1
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x41c998
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push ebx
call sub.advapi32.dll_CryptAcquireContextA
add esp, 0xc
test eax, eax
je 0x41c9d4
sub esp, 0xc
lea eax, [ebx + 4]
push eax
push 0
push 0
push 0x8003
push dword [ebx]
call sub.advapi32.dll_CryptCreateHash
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x484fc0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
mov eax, dword [ebp - 0xc]
call fcn.004059cc
mov eax, dword [ebp + 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x4850ed
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4850b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x4215c4]
call 0x421708
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, 0x485108
call fcn.00405974
jne 0x48503a
mov esi, 0x80000002
mov eax, dword [ebp - 4]
mov edx, 0x485114
call fcn.00405974
jne 0x48504e
mov esi, 0x80000001
mov eax, dword [ebp - 8]
mov edx, 0x485114
call fcn.00405974
jne 0x48506a
lea eax, [ebp - 0x10]
mov edx, 0x485120
call fcn.004055c8
mov eax, dword [ebp - 8]
mov edx, 0x485108
call fcn.00405974
jne 0x485086
lea eax, [ebp - 0x10]
mov edx, 0x485120
call fcn.004055c8
mov edx, esi
mov eax, ebx
call fcn.004217a0
mov cl, 1
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.004218e4
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, ebx
call 0x422008
mov eax, ebx
call fcn.00404650
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4850ca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4850f4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405554
lea eax, [ebp + 8]
call fcn.00405530
ret

Function at 0x485150
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004059cc
mov eax, dword [ebp - 8]
call fcn.004059cc
xor eax, eax
push ebp
push 0x48520a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4851de
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x485218
push 0x80000001
call 0x407900
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4851aa
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
push ebx
mov eax, dword [ebp - 8]
call fcn.004059dc
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.004059dc
push eax
mov eax, dword [ebp - 0xc]
push eax
call 0x407920
mov eax, dword [ebp - 0xc]
push eax
call 0x4078c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4851ef
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485211
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405554
ret
Function at 0x4b5670
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x77000]
mov dword [edi + 0x907b8], 0x932e023a
push edi
or ebp, 0xffffffff
jmp 0x4b569a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b56a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b5690
mov eax, 1
add ebx, ebx
jne 0x4b56b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b56c4
jne 0x4b56e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b56e3
dec eax
add ebx, ebx
jne 0x4b56d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b56a8
add ebx, ebx
jne 0x4b56df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b5735
xor ecx, ecx
sub eax, 3
jb 0x4b56fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b576a
sar eax, 1
mov ebp, eax
jmp 0x4b5706
add ebx, ebx
jne 0x4b5706
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b56d4
inc ecx
add ebx, ebx
jne 0x4b5714
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b56d4
add ebx, ebx
jne 0x4b5721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b5716
jne 0x4b5732
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b5716
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b5754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b5746
jmp 0x4b5696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b5754
add edi, ecx
jmp 0x4b5696
pop esi
mov edi, esi
mov ecx, 0x4d24
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b5772
cmp byte [edi], 0x13
jne 0x4b5772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b5777
lea edi, [esi + 0xb1000]
mov eax, dword [edi]
or eax, eax
je 0x4b57e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb5a18]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb5bd0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b57a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb5bd4]
or eax, eax
je 0x4b57e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4b57c1
call dword [esi + 0xb5be4]
mov ebp, dword [esi + 0xb5bd8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b581a
sub esp, 0xffffff80
jmp fcn.0048f888
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407358
nop
nop
mov ecx, 0x7fc51f70
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cdf0
nop
nop
mov ecx, 0x24194d4b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x422377
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004195c7
and dword [ebp - 4], 0
cmp dword [0x42efe8], 0
mov ebx, eax
jne 0x422428
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4224d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4224d9
push eax
call fcn.00419555
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42efe8], eax
call esi
push eax
call fcn.00419555
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42efec], eax
call esi
push eax
call fcn.00419555
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42eff0], eax
call esi
push eax
call fcn.00419555
pop ecx
mov dword [0x42eff8], eax
test eax, eax
je 0x422428
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419555
pop ecx
mov dword [0x42eff4], eax
mov eax, dword [0x42eff4]
cmp eax, ebx
je 0x422480
cmp dword [0x42eff8], ebx
je 0x422480
push eax
call fcn.004195d0
push dword [0x42eff8]
mov esi, eax
call fcn.004195d0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x422480
test edi, edi
je 0x422480
call esi
test eax, eax
je 0x422477
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x422477
test byte [ebp - 0xc], 1
jne 0x422480
or dword [ebp + 0x10], 0x200000
jmp 0x4224b9
mov eax, dword [0x42efec]
cmp eax, ebx
je 0x4224b9
push eax
call fcn.004195d0
pop ecx
test eax, eax
je 0x4224b9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4224b9
mov eax, dword [0x42eff0]
cmp eax, ebx
je 0x4224b9
push eax
call fcn.004195d0
pop ecx
test eax, eax
je 0x4224b9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42efe8]
call fcn.004195d0
pop ecx
test eax, eax
je 0x4224d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4224db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x40de38
mov ecx, 0x11fb42cd
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x4304d8
mov ecx, 0xe570b6c
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001350
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
sub esp, 0x200
mov cl, 0x61
push ebx
mov byte [esp + 8], cl
mov byte [esp + 0xd], cl
mov al, 0x6c
mov dl, 0x65
mov cl, 0x5f
xor ebx, ebx
push esi
mov byte [esp + 8], 0x47
mov byte [esp + 9], al
mov byte [esp + 0xa], 0x6f
mov byte [esp + 0xb], 0x62
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0x5c
mov byte [esp + 0xf], 0x73
mov byte [esp + 0x10], 0x68
mov byte [esp + 0x12], 0x72
mov byte [esp + 0x13], dl
mov byte [esp + 0x14], cl
mov byte [esp + 0x15], 0x66
mov byte [esp + 0x16], 0x69
mov byte [esp + 0x17], al
mov byte [esp + 0x18], dl
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], 0x78
mov byte [esp + 0x1b], 0x6d
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], cl
mov byte [esp + 0x1e], 0x25
mov byte [esp + 0x1f], 0x64
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [esp + 0x108]
push edx
push ebx
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
cmp esi, ebx
je 0x10001457
push edi
push ebx
push ebx
push ebx
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
je 0x1000144f
push ebx
push ebx
push edi
call fcn.10003990
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x200
ret

Function at 0x10001460
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push 0
push 0x100014a0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x1000148f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x10001820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x10007030]
sub esp, 0x18
test eax, eax
jne 0x100018c0
mov al, 0x65
mov cl, 0x73
mov byte [esp + 2], al
mov byte [esp + 0xd], al
mov byte [esp + 0x10], al
mov byte [esp + 0x15], al
mov byte [esp + 1], cl
mov byte [esp + 0x11], cl
mov byte [esp + 0x12], cl
lea eax, [esp + 0xc]
lea ecx, [esp]
mov dl, 0x6c
push eax
push ecx
mov byte [esp + 8], 0x75
mov byte [esp + 0xb], 0x72
mov byte [esp + 0xc], 0x33
mov byte [esp + 0xd], 0x32
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x10], dl
mov byte [esp + 0x11], dl
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x47
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x4d
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1c], 0x67
mov byte [esp + 0x1e], 0x41
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x10007030], eax
je 0x100018da
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ecx
call eax
add esp, 0x18
ret
xor eax, eax
add esp, 0x18
ret
Function at 0x10001f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebp
push esi
mov cl, 0x50
mov al, 0x74
push edi
mov byte [esp + 0xc], 0x7a
mov byte [esp + 0xd], 0x62
mov byte [esp + 0xe], 0x63
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x10], 0x65
mov byte [esp + 0x11], 0x66
mov byte [esp + 0x12], 0x67
mov byte [esp + 0x13], cl
mov byte [esp + 0x14], 0x4a
mov byte [esp + 0x15], 0x4b
mov byte [esp + 0x16], 0x4c
mov byte [esp + 0x17], al
mov byte [esp + 0x18], 0x6a
mov byte [esp + 0x19], 0x4f
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], 0x51
mov byte [esp + 0x1c], 0x72
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x76
mov byte [esp + 0x21], 0x77
mov byte [esp + 0x22], 0x78
mov byte [esp + 0x23], 0x79
mov byte [esp + 0x24], 0x5a
mov byte [esp + 0x25], 0x41
mov byte [esp + 0x26], 0x59
mov byte [esp + 0x27], 0x43
mov byte [esp + 0x28], 0x44
mov byte [esp + 0x29], 0x45
mov byte [esp + 0x2a], 0x46
mov byte [esp + 0x2b], 0x47
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
mov ebp, dword [sym.imp.MSVCRT.dll_rand]
add esp, 4
call ebp
mov esi, eax
and esi, 0x80000007
jns 0x10001fed
dec esi
or esi, 0xfffffff8
inc esi
add esi, 8
xor edi, edi
test esi, esi
jle 0x10002023
push ebx
mov ebx, dword [esp + 0x34]
call ebp
and eax, 0x8000001f
jns 0x10002009
dec eax
or eax, 0xffffffe0
inc eax
mov al, byte [esp + eax + 0x10]
inc al
mov byte [edi + ebx], al
inc edi
cmp edi, esi
jl 0x10001ffb
mov byte [esi + ebx], 0
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20
ret
mov ecx, dword [esp + 0x30]
pop edi
mov byte [esi + ecx], 0
pop esi
pop ebp
add esp, 0x20
ret

Function at 0x100023e0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x60
test eax, eax
push edi
je 0x10002414
push 0
push 0
push 0
push 0x10002a20
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
add esp, 0x60
ret 8
mov edi, 0x10007050
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x1000240b
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
not eax
push eax
lea eax, [esp + 0x74]
lea ecx, [esp + 0xc]
push eax
push ecx
mov byte [esp + 0x7c], 0x25
mov byte [esp + 0x7d], 0x78
mov byte [esp + 0x7e], 0
mov byte [esp + 0x7f], 0
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0x34]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.100035b0
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x10007050
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
add esp, 0x60
ret 8
Function at 0x10002b20
Capabilities:
Hash data with md5

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [edx + 0x14]
mov dword [edx + 0x10], ecx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
Function at 0x10003600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe0
mov ecx, dword [esp + 0xe4]
push ebx
push ebp
push esi
mov eax, dword [ecx + 0x3c]
push edi
add eax, ecx
mov ebp, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + ebp + 0x24]
mov edi, dword [ecx + ebp + 0x1c]
mov edx, dword [ecx + ebp + 0x20]
mov ebx, dword [ecx + ebp + 0x18]
mov esi, dword [ecx + ebp + 0x10]
add eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xf8]
add edi, ecx
add edx, ecx
test eax, 0xffff0000
mov dword [esp + 0x20], edi
jne 0x10003672
cmp eax, esi
jb 0x100036d3
mov edx, dword [ecx + ebp + 0x14]
lea edx, [edx + esi - 1]
cmp eax, edx
ja 0x100036d3
sub eax, esi
mov eax, dword [edi + eax*4]
pop edi
pop esi
pop ebp
add eax, ecx
pop ebx
add esp, 0xe0
ret
test ebx, ebx
mov dword [esp + 0x18], 0
jle 0x100036d3
mov dword [esp + 0x1c], edx
mov esi, dword [edx]
mov edi, eax
add esi, ecx
mov bl, byte [esi]
mov dl, bl
cmp bl, byte [edi]
jne 0x100036ac
test dl, dl
je 0x100036a8
mov bl, byte [esi + 1]
mov dl, bl
cmp bl, byte [edi + 1]
jne 0x100036ac
add esi, 2
add edi, 2
test dl, dl
jne 0x10003688
xor edx, edx
jmp 0x100036b1
sbb edx, edx
sbb edx, 0xffffffff
xor ebx, ebx
cmp edx, ebx
je 0x100036e0
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, dword [ecx + ebp + 0x18]
inc esi
add edx, 4
cmp esi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edx
jl 0x10003682
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xe0
ret
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x18]
xor eax, eax
mov ax, word [edx + esi*2]
mov edx, dword [esp + 0x20]
mov esi, dword [edx + eax*4]
lea eax, [ecx + ebp]
add esi, ecx
cmp esi, eax
jb 0x100037b4
mov edx, dword [esp + 0x10]
add edx, ebp
add edx, ecx
cmp esi, edx
ja 0x100037b4
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x8d]
mov byte [esp + 0x8c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x28]
push esi
push eax
call edi
lea ecx, [esp + 0x28]
push 0x2e
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
cmp eax, ebx
jne 0x1000376f
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe0
ret
mov byte [eax], bl
inc eax
lea edx, [esp + 0x8c]
push eax
push edx
call edi
mov al, 0x6c
lea ecx, [esp + 0x28]
mov byte [esp + 0x12], al
mov byte [esp + 0x13], al
lea eax, [esp + 0x10]
mov byte [esp + 0x10], 0x2e
push eax
push ecx
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1c], bl
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
jne 0x100037c1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe0
ret
lea ecx, [esp + 0x8c]
push ecx
push eax
call fcn.10003600
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe0
ret