joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a8b9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov al, byte [0x471b14]
push edi
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
leave
ret

Function at 0x41a948
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov al, byte [0x471b14]
push esi
push edi
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi + 4]
test eax, eax
jne 0x41a97d
mov eax, 0x45561c
lea ecx, [ebp - 0x104]
push 0
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp - 0x104]
push eax
call fcn.00432d00
pop ecx
push eax
lea eax, [ebp - 0x104]
push eax
mov ecx, esi
call fcn.00405170
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov eax, ecx
pop esi
leave
ret

Function at 0x41aa2e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov al, byte [0x471b14]
push esi
push edi
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push 0
mov esi, 0x104
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov edi, eax
test edi, edi
je 0x41aa94
cmp edi, esi
ja 0x41aa94
push dword [ebp + 8]
call fcn.00432d00
cmp edi, eax
pop ecx
jae 0x41aa94
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.00433ce0
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov eax, ecx
pop esi
leave
ret

Function at 0x41ad9d
Capabilities:
Identify system language via api

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x41adee
call fcn.0041b9c0
mov eax, dword [edi + 0x120]
mov ecx, dword [edi + 0x114]
mov esi, dword [eax]
mov ebx, dword [ecx]
cmp esi, eax
je 0x41adee
push dword [esp + 0x10]
call fcn.00432d00
pop ecx
push eax
lea ecx, [esi + 8]
push dword [esp + 0x14]
push dword [ecx + 8]
push 0
call fcn.004052d0
test eax, eax
je 0x41adfa
mov esi, dword [esi]
mov ebx, dword [ebx]
cmp esi, dword [edi + 0x120]
jne 0x41adc2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
pop edi
pop esi
pop ebx
ret 4
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x41ae06
mov ebx, 0x45561c
push 0x10
push 0
push ebx
call fcn.00432b6b
add esp, 0xc
jmp 0x41adf4
Function at 0x41f7cf
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4529b0
call fcn.00432d7c
sub esp, 0x160
push ebx
xor ebx, ebx
cmp byte [0x4821a0], bl
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, 0x4821a0
jne 0x41f80c
cmp esi, ebx
je 0x41f821
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [0x4821a0], bl
je 0x41f821
cmp esi, ebx
je 0x41f821
push edi
call fcn.00432d00
push eax
push esi
push edi
call fcn.00431ac8
add esp, 0x10
call fcn.004166db
test eax, eax
je 0x41f99c
cmp esi, ebx
je 0x41f844
push esi
call fcn.0041a8b9
test eax, eax
pop ecx
mov dword [ebp + 0x14], 1
jne 0x41f847
mov dword [ebp + 0x14], ebx
cmp dword [ebp + 8], ebx
mov edi, 0xffdc
je 0x41f886
cmp dword [ebp + 0xc], ebx
je 0x41f886
cmp dword [ebp + 0x10], ebx
je 0x41f886
push dword [ebp + 8]
call fcn.00432d00
push dword [ebp + 0xc]
add edi, 0xfffffffa
sub edi, eax
call fcn.00432d00
push 0xfffffffffffffffd
pop ebx
push dword [ebp + 0x10]
sub ebx, eax
call fcn.00432d00
sub ebx, eax
add esp, 0xc
add edi, ebx
xor ebx, ebx
cmp esi, ebx
je 0x41f988
cmp dword [ebp + 0x14], ebx
je 0x41f8c1
lea eax, [ebp - 0x16c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41f8e4
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x41f8e4
cmp dword [ebp - 0x150], ebx
jne 0x41f8e4
cmp dword [ebp - 0x14c], edi
jae 0x41f8e4
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push esi
push ebx
push ebx
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, edi
jmp 0x41f9ac
cmp dword [ebp + 0x14], ebx
je 0x41f8c1
cmp dword [0x4822a4], ebx
je 0x41f988
mov al, byte [ebp + 0x13]
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2c], al
call fcn.004017f0
push esi
call fcn.00432d00
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405170
mov ecx, dword [0x4822a4]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0x14]
push eax
mov dword [ebp - 4], ebx
call fcn.004212ea
mov edi, dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x2c]
call fcn.004017f0
mov eax, dword [0x4822a4]
cmp edi, dword [eax + 4]
je 0x41f988
mov al, byte [ebp + 0x13]
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x1c], al
call fcn.004017f0
push esi
call fcn.00432d00
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.00405170
mov ecx, dword [0x4822a4]
push 1
pop edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], edi
call fcn.00421299
or dword [ebp - 4], 0xffffffff
push edi
lea ecx, [ebp - 0x1c]
call fcn.004017f0
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041e553
add esp, 0x10
jmp 0x41f9ac
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x422ee5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, eax
push esi
shr eax, 4
and ebx, 0xf
inc eax
push edi
push dword [esp + 0x18]
movzx eax, ax
push eax
push 6
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x422f49
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x422f49
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x422f49
mov edi, eax
xor ecx, ecx
mov ax, word [edi]
test ax, ax
je 0x422f41
inc edi
inc edi
cmp ecx, ebx
movzx esi, ax
je 0x422f4f
lea edi, [edi + esi*2]
jmp 0x422f43
inc edi
inc edi
inc ecx
cmp ecx, 0x10
jl 0x422f2b
xor eax, eax
pop edi
pop esi
pop ebx
ret
lea eax, [esi + esi + 2]
push eax
call fcn.00447dd1
pop ecx
mov ebx, eax
test ebx, ebx
je 0x422f70
push esi
push edi
push ebx
call fcn.0043443e
add esp, 0xc
and word [ebx + esi*2], 0
mov eax, ebx
jmp 0x422f4b
Function at 0x4257e0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x10
mov al, byte [0x471b14]
push ebx
push ebp
push esi
xor ecx, ecx
push edi
lea edx, [esp + 0x14]
mov dword [esp + 0x15], ecx
push 0xa
push edx
xor esi, esi
mov dword [esp + 0x21], ecx
push 0x5a
push 0x400
mov dword [esp + 0x20], esi
mov byte [esp + 0x24], al
mov byte [esp + 0x2d], cl
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x42587a
mov ebx, dword [esp + 0x24]
mov al, byte [esp + 0x24]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
mov byte [ebx], al
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
call fcn.00401860
test al, al
je 0x42586e
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
lea esi, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetLocaleInfo___failed_with__d.__Returning__us_
push 1
push 0x471d20
call fcn.00401200
mov ebp, dword [esp + 0x34]
mov cl, byte [esp + 0x34]
mov edi, 0x469aac
xor eax, eax
mov byte [ebp], cl
or ecx, 0xffffffff
add esp, 0x10
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
mov ecx, ebp
call fcn.004056d0
cmp eax, ebx
jae 0x4258ca
call fcn.00441cc0
mov ecx, dword [ebp + 4]
cmp ecx, esi
je 0x4258f9
mov al, byte [ecx - 1]
test al, al
je 0x4258f9
cmp al, 0xff
je 0x4258f9
cmp ebx, esi
jne 0x425927
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebp
call fcn.004017f0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
cmp ebx, esi
jne 0x425912
push 1
mov ecx, ebp
call fcn.004017f0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x42591e
cmp eax, ebx
jae 0x42592f
push 1
mov ecx, ebp
call fcn.004017f0
push ebx
mov ecx, ebp
call fcn.00401980
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
mov esi, 0x469aac
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
pop edi
pop esi
mov byte [eax + ebx], 0
mov eax, ebp
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x438cef
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x438d0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00434e20
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x438d32
test byte [esp + 8], 2
je 0x438d32
call fcn.00434e93
mov dword [eax], 0xd
call fcn.00434e9c
mov dword [eax], 5
jmp 0x438d0b
xor eax, eax
ret

Function at 0x43b661
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x470c18
cmp edx, dword [eax]
je 0x43b683
add eax, 8
inc ecx
cmp eax, 0x470ca8
jl 0x43b674
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x470c18]
jne 0x43b7b1
mov eax, dword [0x4844c0]
cmp eax, 1
je 0x43b78b
test eax, eax
jne 0x43b6b4
cmp dword [0x46e4c4], 1
je 0x43b78b
cmp edx, 0xfc
je 0x43b7b1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43b6eb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00433ce0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00432d00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x43b72e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00432d00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x459290
push edi
call fcn.00437360
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00433ce0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00433cf0
lea eax, [ebp - 0xa0]
push 0x459270
push eax
call fcn.00433cf0
push dword [esi + 0x470c1c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00433cf0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0043d782
add esp, 0x2c
pop edi
jmp 0x43b7b1
lea eax, [ebp + 8]
lea esi, [esi + 0x470c1c]
push 0
push eax
push dword [esi]
call fcn.00432d00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x446ee9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x446f2b
call fcn.0044d61a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x446f2b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x446f22
xor eax, eax
jmp 0x446f33
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00446f39
pop edi
pop esi
pop ebx
ret 4
Function at 0x44c215
Capabilities:
Create http request

Disassembly:
mov eax, 0x4534c0
call fcn.00432d7c
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x44c24d
call fcn.0044d61a
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x44c272
push eax
push dword [esi + 4]
call fcn.0044ce4b
jmp 0x44c27e
push esi
push eax
mov ecx, 0x483df0
call fcn.0044c28f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x44c3f2
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4534fb
call fcn.00432d7c
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00448bde
mov eax, dword [0x46d5c4]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x483df0
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.0044c28f
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.00448219
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.004293ef
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004481c9
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.00448090
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x44e1f1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44e21f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44e23d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0044e157
jmp 0x44e23d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44e23d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0044e157
test edi, edi
mov eax, edi
jne 0x44e227
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x100012f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80
mov dword [esp + 0x7c], 0
jmp 0x1000131e
jmp 0x1000151a
cmp dword [esp + 0x74], 0xa
jne 0x100014aa
jmp 0x10001515
cmp dword [esp + 0x7c], 0xfb
jne 0x1000139e
jmp 0x10001339
mov eax, dword [esp + 0x78]
add eax, 1
mov dword [esp + 0x78], eax
jmp 0x1000133d
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x78], 0x251
jne 0x100013df
jmp 0x1000144c
mov eax, esp
mov dword [eax], 0x41acd0
mov eax, dword [sym.imp.GDI32.dll_GetROP2]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 0x10], 0xe23
mov dword [ecx + 0xc], 0x8b8
mov dword [ecx + 8], 0x8b8
mov dword [ecx + 4], 0x2f2
mov dword [ecx], 0x192986
mov ecx, dword [sym.imp.GDI32.dll_SetRectRgn]
mov dword [esp + 0x5c], eax
call ecx
sub esp, 0x14
mov dword [esp + 0x58], eax
jmp 0x10001306
mov eax, esp
mov dword [eax], 0xb6a3d6
mov eax, dword [sym.imp.KERNEL32.dll_FreeResource]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0x189
mov dword [ecx], 0xb995ea
mov ecx, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov dword [esp + 0x54], eax
call ecx
sub esp, 8
mov dword [esp + 0x78], 0
mov dword [esp + 0x50], eax
jmp 0x1000133d
mov eax, dword [esp + 0x78]
mov ecx, 0x4ec4ec4f
mov dword [esp + 0x4c], eax
mul ecx
shr edx, 2
imul eax, edx, 0xd
mov ecx, dword [esp + 0x4c]
sub ecx, eax
mov eax, ecx
sub eax, 0xa
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], eax
je 0x1000141c
jmp 0x1000140b
mov eax, dword [esp + 0x48]
sub eax, 3
mov dword [esp + 0x40], eax
jne 0x10001447
jmp 0x1000141a
jmp 0x1000141c
mov eax, esp
mov dword [eax + 0xc], 0xc4a
mov dword [eax + 8], 0xffc
mov dword [eax + 4], 0x6ab63a
mov dword [eax], 0x6ab63a
mov eax, dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
call eax
sub esp, 0x10
mov dword [esp + 0x3c], eax
jmp 0x1000132a
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x38], eax
mov eax, 0xcc29786d
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x34], eax
mov eax, ecx
mov edx, dword [esp + 0x34]
mul edx
shr edx, 8
imul eax, edx, 0x141
sub ecx, eax
mov eax, ecx
sub eax, 7
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
je 0x10001350
jmp 0x10001489
mov eax, dword [esp + 0x30]
sub eax, 0x4b
mov dword [esp + 0x28], eax
jne 0x1000149d
jmp 0x10001498
jmp 0x10001350
mov dword [esp + 0x74], 0
jmp 0x1000130b
mov eax, esp
mov dword [eax], 0x16d418
mov eax, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call eax
sub esp, 4
mov ecx, esp
lea edx, [esp + 0x60]
mov dword [ecx], edx
mov dword [ecx + 4], 0x809
mov ecx, dword [sym.imp.USER32.dll_MonitorFromRect]
mov dword [esp + 0x24], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 8], 0xba5ec1
mov dword [ecx + 4], 0xca0a4b
mov dword [ecx], 0x3d8207
mov ecx, dword [sym.imp.GDI32.dll_FillRgn]
mov dword [esp + 0x20], eax
call ecx
sub esp, 0xc
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x74]
add eax, 1
mov dword [esp + 0x74], eax
jmp 0x1000130b
jmp 0x10001306
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add eax, 1
mov dword [esp + 0x7c], eax
jmp 0x1000131e
Function at 0x10167900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.10167900]
mov dword [0x102adc14], 0x83f
mov dword [ebp - 4], eax
mov dword [0x102adc14], 0x19e4
jmp 0x10167970
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
mov dword [0x102adc18], 0x773
jmp 0x1016798b
mov dword [0x102adc14], 0x24f
mov dword [ebp - 8], 0
jmp 0x10167993
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 4]
cmp dword [ecx + eax], 0x4550
je 0x10167968
jmp 0x10167925
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x10167993
mov eax, dword [ebp - 4]
mov cx, word [eax]
mov word [ebp - 0xa], cx
mov ax, word [ebp - 0xa]
movzx ecx, ax
cmp ecx, 0x5a4d
je 0x10167954
jmp 0x10167925
mov al, 1
test al, 1
jne 0x10167970
jmp 0x10167941
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebp
ret

Function at 0x101679b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x102adc18], 0x3cb
mov dword [ebp - 8], 0
mov dword [0x102adc18], 0x4f5
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x102adc14], 0x650
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x104
jl 0x10167a57
jmp 0x10167a77
jmp 0x10167a50
mov dword [0x102adc18], 0x1280
mov dword [ebp - 4], 0
jmp 0x10167b46
mov dword [0x102adc14], 0xe50
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
je 0x10167adc
jmp 0x10167a05
mov dword [0x102adc18], 0xab6
jmp 0x10167a6a
jmp 0x10167b3c
jmp 0x10167b41
jmp 0x10167a4b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
jne 0x10167a3f
jmp 0x10167a77
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x101679fa
mov eax, dword [0x102adc18]
sub eax, 0x21b9
mov dword [0x102adc18], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x10167a07
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
jne 0x10167b41
mov eax, dword [0x102adc18]
add eax, 0x20dc
mov dword [0x102adc14], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
je 0x10167a1d
jmp 0x10167a50
mov eax, dword [0x102adc14]
add eax, 0x5c9
mov dword [0x102adc14], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x10167b3c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
jne 0x10167a4b
mov dword [0x102adc18], 0x7a0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x10167a55
mov dword [ebp - 4], 1
jmp 0x10167b46
jmp 0x10167a05
jmp 0x10167a07
mov eax, dword [ebp - 4]
add esp, 0x10
pop ebp
ret
Function at 0x100c24fd
Capabilities:
Encode data using xor

Disassembly:
sub dword [eax], ebx
dec ebx
cmp eax, 0x3f66ea5f
pop edi
add ch, byte [ebx + 0x40]
pop edi
or ch, byte [edi + 0x6e]
retf 0x6802
stc
adc eax, 3
jmp 0x100c23cb
cdq
cli
xchg esp, eax
test byte [edi - 0x5aab0b56], ch
shl byte [ecx + 0x5bb7ff23], cl
sti
test al, 0x65
invalid
add dword [eax], 0x16a1732c
jmp 0x100c237c
dec edx
stc
jb 0x100c2567
adc byte [ecx + eax - 0x24e90000], 0xd1
pop ss
fcmovnbe st(0), st(1)
pop esp
out 0x7c, al
push cs
mov ch, dh
int 0xdc
and dword [ebx - 0xe], ebp
sbb al, 0x8c
loope 0x100c238f
add ebx, 0xffffff38
jmp 0x100c25f0
call fcn.100c259b
dec edx
inc eax
mov ch, 0xa7
xchg edx, eax
jge 0x100c23ce
push cs
jo 0x100c2416
cmpsb byte [esi], byte es:[edi]
test dword [edx], ecx
xor dword [edi + 0x5ac27e37], 0x361e4c55
cmp al, 0x6e
push ds
cmp al, 0x6e
js 0x100c2446
cdq
jmp 0xb1dda9b3
sub ebx, 0xfffffffc
jmp 0x100c26cb
dec ebp
push 0xffffffffffffffe5
in al, dx
mov al, byte [0x123d1c99]
push edi
in eax, dx
in al, dx
cmp eax, 0xeced5712
salc
salc
dec esi
outsd dx, dword [esi]
popfd
salc
xchg ecx, eax
pop ds
fsub st(2)
jne 0x100c26cb
jmp 0x100c2492
pop ecx
pop esi
pop eax
pop edi
pop ebx
pop edx
stc
jb 0x100c2530
pop ss
or al, 0x5d
dec ebx
mov word [ebx + 0x35fdbd29], ds
shl dword [eax + 0x44e86fff], 1
add al, byte [eax]
add cl, ch
invalid
call fcn.100c26db
jmp 0x100c2477
push ebp
ja 0x100c244d
invalid
add eax, ebx
clc
jmp 0x100c2686
push edx
push ebx
push edi
stc
push eax
push esi
push ecx
jb 0x100c23fb
and eax, 0xf93151db
xor ecx, edi
fdiv qword [eax]
sub dword [edx + 0x5d41bbf6], ecx
jb 0x100c24bd
scasd eax, dword es:[edi]
fdiv st(1)
cwde
mov edi, 0x3070b12b
sub byte [ebx + ebp*4], cl
ficom dword [ecx + eax*2 + 0x1c]
xchg ebp, eax
ja 0x100c250d
push edi
ud0
jmp 0x1009ef14
jne 0x100c23ac
jmp 0x100c264d
je 0x100c2477
test byte [esi + 0xffffffe], bh
sbb eax, 0
add byte [eax], al
jae 0x100c2697
push ebx
or al, 0xc0
stosd dword es:[edi], eax
les ebx, [ebx]
mov byte [0x4ed8917], al
cmpsd dword [esi], dword es:[edi]
hlt
cmp dword [ebx], 0
clc
jae 0x100c25b3
fdivr qword [ebx - 0x14]
fidivr dword [edx + 0xa4c66cf]
xor byte [ecx - 0x4268ffb2], cl
mov ebx, 0x6217c1e1
or ch, byte [eax]
jle 0x100c25b4
xor al, 0x31
or al, 0x37
mul byte [edi + 0x688b53b6]
xor al, dh
dec dword [edi]
jmp 0x100c245e
stc
adc ebx, 7
jmp 0x100c261e
mov edx, dword [ebx + 4]
jae 0x100c23ac
sbb eax, 0xe93d3d2e
dec ebp
cdq
mov edi, ebx
jae 0x100c242d
movsb byte es:[edi], byte [esi]
invalid
mov eax, dword [ebx]
jmp 0x100c24cf