joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x1009f810]
xor eax, eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x18], 0x9132f15
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0x1f1a1e
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x16
jb 0x10020d66
mov byte [ebp - 0x10], 0x17
mov al, 0x79
xor al, byte [ebp - 0x10]
mov bl, 0x7b
mov ah, bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x10]
mov dl, 0x73
mov bh, ah
mov byte [ebp - 1], ah
xor bl, al
mov byte [ebp - 6], 0
xor ah, al
mov byte [ebp - 0x11], 0
xor bh, al
mov byte [ebp - 0xb], ah
mov dh, dl
mov byte [ebp - 0xc], bl
xor dl, al
mov byte [ebp - 8], bh
xor dh, al
mov byte [ebp - 0xd], dl
mov cl, 0x63
mov byte [ebp - 9], dh
xor cl, al
mov byte [ebp - 6], 0
mov ch, 0x39
mov byte [ebp - 0xe], cl
xor ch, al
mov al, byte [ebp - 1]
xor al, byte [ebp - 0x10]
mov byte [ebp - 7], al
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0xf]
mov byte [ebp - 0xa], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10020e14
push 0
push 0
push 0x11
test esi, esi
jne 0x10020e05
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
test eax, eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call edi
test eax, eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10020e20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x10020e5e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10020e62
cmp edx, esi
jne 0x10020e47
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10020e82
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10020e86
cmp edx, esi
jne 0x10020e6b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10020ea6
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10020eaa
cmp edx, esi
jne 0x10020e8f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020ed0
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x100a8080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov edi, ecx
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10020f2c
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
cmp dword [ebp - 0x128], edi
je 0x10020f38
lea eax, [ebp - 0x130]
push eax
push esi
call ebx
test eax, eax
jne 0x10020f16
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002105e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x1002105e
push eax
call esi
movaps xmm0, xmmword [str._rHnYOIQYhTNY_X]
xor ecx, ecx
movups xmmword [ebp - 0x150], xmm0
nop word [eax + eax]
mov al, byte [ebp - 0x150]
xor byte [ebp + ecx - 0x14f], al
inc ecx
cmp ecx, 0xe
jb 0x10020f70
mov byte [ebp - 0x140], 0x5b
mov al, 0x35
xor al, byte [ebp - 0x140]
mov bl, 0x37
mov ah, bl
mov byte [ebp - 0x13f], al
mov al, byte [ebp - 0x140]
mov dl, 0x3f
mov bh, ah
mov byte [ebp - 0x131], ah
xor bl, al
mov byte [ebp - 0x136], 0
xor ah, al
mov byte [ebp - 0x141], 0
xor bh, al
mov byte [ebp - 0x13b], ah
mov dh, dl
mov byte [ebp - 0x13c], bl
xor dl, al
mov byte [ebp - 0x138], bh
xor dh, al
mov byte [ebp - 0x13d], dl
mov cl, 0x2f
mov byte [ebp - 0x139], dh
xor cl, al
mov byte [ebp - 0x136], 0
mov ch, 0x75
mov byte [ebp - 0x13e], cl
xor ch, al
mov al, byte [ebp - 0x131]
xor al, byte [ebp - 0x140]
mov byte [ebp - 0x137], al
lea eax, [ebp - 0x14f]
push eax
lea eax, [ebp - 0x13f]
mov byte [ebp - 0x13a], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0xd78dd4
mov ebx, eax
call fcn.100114e0
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1002107e
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push edi
call ebx
test eax, eax
jns 0x10021075
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp - 8], 0
ja 0x1002105e
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10067570
mov esp, ebp
pop ebp
ret
Function at 0x10022250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov byte [ebp - 0x10], 0xb
mov al, 0x69
xor al, byte [ebp - 0x10]
mov bl, 0x78
push esi
mov esi, ecx
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x10]
mov ch, bl
mov dl, 0x6a
mov byte [ebp - 7], 0
mov dh, 0x54
mov byte [ebp - 7], 0
mov cl, 0x64
mov ah, 0x6e
push edi
mov bh, 0x68
xor dl, al
xor dh, al
mov byte [ebp - 0xe], dl
xor cl, al
mov byte [ebp - 0xb], dh
xor ch, al
mov byte [ebp - 9], cl
xor bl, al
mov byte [ebp - 8], ch
xor ah, al
mov byte [ebp - 0xd], bl
xor bh, al
mov byte [ebp - 0xc], ah
sub esp, 0x18
mov byte [ebp - 0xa], bh
mov edx, esp
lea ecx, [ebp - 0xf]
xorps xmm0, xmm0
lea edi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100222c2
sub ecx, edi
lea eax, [ebp - 0xf]
push ecx
push eax
mov ecx, edx
call fcn.10005240
mov ecx, dword [esi]
call fcn.10011100
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add esp, 0x18
mov dword [esi + 4], eax
push 4
push eax
call ebx
test eax, eax
je 0x100222fa
mov dword [esi + 4], 0
movaps xmm0, xmmword [str.B_6_]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10022307
sub esp, 0x18
mov byte [ebp - 5], 0
mov edx, esp
lea ecx, [ebp - 0x13]
xorps xmm0, xmm0
lea edi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10022337
sub ecx, edi
lea eax, [ebp - 0x13]
push ecx
push eax
mov ecx, edx
call fcn.10005240
mov ecx, dword [esi + 4]
call fcn.10011100
add esp, 0x18
mov dword [esi + 8], eax
push 4
push eax
call ebx
test eax, eax
je 0x1002236a
mov dword [esi + 8], 0
cmp dword [esi + 8], 0
je 0x10022384
cmp dword [0x100ad2d4], 0
mov ecx, 0x10b78ba
sete dl
call fcn.10011410
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100633f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008ba1d
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x100a8080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0xf
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmova eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.10063290
cmp byte [ebp - 0x84], 0
jne 0x10063541
xor ecx, ecx
lea edx, [ebp - 0x3f]
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
mov byte [ebp + ecx - 0x18], al
movzx eax, byte [edx - 4]
mov byte [ebp + ecx - 0x17], al
movzx eax, byte [edx - 3]
mov byte [ebp + ecx - 0x16], al
movzx eax, byte [edx - 2]
mov byte [ebp + ecx - 0x15], al
add ecx, 4
cmp ecx, 8
jb 0x10063485
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x100ab2d0
call fcn.10063290
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10063290
xor ecx, ecx
lea edx, [ebp - 0x37]
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
mov byte [ebp + ecx - 0x28], al
movzx eax, byte [edx - 4]
mov byte [ebp + ecx - 0x27], al
movzx eax, byte [edx - 3]
mov byte [ebp + ecx - 0x26], al
movzx eax, byte [edx - 2]
mov byte [ebp + ecx - 0x25], al
add ecx, 4
cmp ecx, 0x10
jb 0x100634f4
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call fcn.1006ae00
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.10063340
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x1006357d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10063573
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10063599
push ecx
push edx
call fcn.100675d1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067570
mov esp, ebp
pop ebp
ret
call fcn.1006cd3b
int3
Function at 0x100648a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10064a70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1006497d
mov edx, dword [ebp - 4]
cmp edx, dword [0x100a8044]
jb 0x100648ea
mov eax, dword [ebp - 4]
cmp eax, dword [0x100a8048]
ja 0x100648ea
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100648ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1006ae00
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1006490f
jmp 0x1006497d
cmp dword [ebp - 0x14], 0x10000
jne 0x10064963
cmp dword [ebp - 0x18], 0x10000
jb 0x10064963
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10064946
mov eax, dword [ebp - 8]
jmp 0x1006497f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10064956
xor eax, eax
jmp 0x1006497f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10064978
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10064a70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100648ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10064990
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10064aa0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10064a65
mov edx, dword [ebp - 4]
cmp edx, dword [0x100a8044]
jb 0x100649d5
mov eax, dword [ebp - 4]
cmp eax, dword [0x100a8048]
ja 0x100649d5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100649a5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1006ae00
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x100649fa
jmp 0x10064a65
cmp dword [ebp - 0x14], 0x10000
jne 0x10064a4e
cmp dword [ebp - 0x18], 0x10000
jb 0x10064a4e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10064a31
mov eax, dword [ebp - 8]
jmp 0x10064a67
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10064a41
xor eax, eax
jmp 0x10064a67
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10064a60
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10064aa0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100649a5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10064ad0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10064ec0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x100abfe8], 0
jne 0x10064b0d
cmp dword [0x100abfe4], 0
je 0x10064b0d
mov eax, dword [0x100abfe4]
mov dword [0x100abfe8], eax
cmp dword [0x100abfe8], 0
je 0x10064b8a
mov ecx, dword [0x100abfe8]
cmp dword [ecx + 8], 0
je 0x10064b8a
mov edx, dword [0x100abfe8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x10064b8a
mov ecx, dword [0x100abfe8]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x10064b8a
mov eax, dword [0x100abfe8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10064b59
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10064b60
xor eax, eax
jmp 0x10064ca9
mov ecx, dword [0x100abfe8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1006ae00
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10064ca9
mov edx, dword [0x100abfe4]
mov dword [0x100abfe8], edx
jmp 0x10064ba6
mov eax, dword [0x100abfe8]
mov ecx, dword [eax + 4]
mov dword [0x100abfe8], ecx
cmp dword [0x100abfe8], 0
je 0x10064be6
cmp dword [0x100abfe8], 0
je 0x10064be4
mov edx, dword [0x100abfe8]
cmp dword [edx + 8], 0
je 0x10064be4
mov eax, dword [0x100abfe8]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10064be4
mov edx, dword [0x100abfe8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10064be4
jmp 0x10064b3e
jmp 0x10064b98
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10064cb0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10064ca7
mov eax, dword [ebp - 0x18]
mov dword [0x100abfe8], eax
mov ecx, dword [0x100abfe8]
mov dword [ecx], 0x52727464
mov edx, dword [0x100abfe8]
mov dword [edx + 8], 0
mov eax, dword [0x100abfe8]
mov ecx, dword [0x100abfe4]
mov dword [eax + 4], ecx
mov edx, dword [0x100abfe8]
mov dword [0x100abfe4], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x100abfe8]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10064c77
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10064c97
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x10064c6e
mov eax, dword [0x100abfe8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x10064b3e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100659f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100abfe4]
mov dword [ebp - 4], eax
jmp 0x10065a09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10065a30
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10065a2e
call sub.KERNEL32.dll_GetLastError
jmp 0x10065a32
jmp 0x10065a00
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10065ed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100abff4], eax
je 0x10065ef4
mov eax, 0x10dd
jmp 0x1006609c
cmp dword [0x100abff8], 0
je 0x10065f07
mov eax, dword [0x100abff8]
jmp 0x1006609c
cmp dword [ebp + 0xc], 0
jne 0x10065f17
mov eax, 0x57
jmp 0x1006609c
cmp dword [ebp + 8], 0
jne 0x10065f27
mov eax, 6
jmp 0x1006609c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10065f50
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x100abff8], ecx
mov edx, dword [ebp + 8]
mov dword [0x100abffc], edx
mov eax, dword [ebp - 8]
jmp 0x1006609c
push 0x18
call fcn.1006757e
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10065fab
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x100abff8], ecx
cmp dword [ebp - 4], 0
je 0x10065f9a
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.100675d1
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x100abffc], ecx
mov eax, dword [ebp - 8]
jmp 0x1006609c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10065eb0
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10065eb0
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x10065feb
cmp dword [ebp - 0xc], 0x1e
jbe 0x10066007
mov dword [ebp - 8], 9
cmp dword [0x100abfec], 0
je 0x10066002
jmp 0x10065f79
jmp 0x10065f70
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1006602e
mov dword [ebp - 8], 9
cmp dword [0x100abfec], 0
je 0x10066029
jmp 0x10065f79
jmp 0x10065f70
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10066059
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x10065f70
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x100ac004]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x100ac004], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x100660b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100abff4], eax
je 0x100660cd
mov eax, 0x10dd
jmp 0x100661b0
mov eax, dword [0x100ac004]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1006614c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10066128
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10066128
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10064f50
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.100675d1
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x100660d5
mov dword [0x100ac004], 0
call fcn.10065830
mov ecx, dword [0x100ac000]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1006619a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100675d1
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10066164
mov dword [0x100ac000], 0
mov dword [0x100abff4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10066690
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100abff8], 0
je 0x100666a9
mov eax, dword [0x100abff8]
jmp 0x10066748
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x100666ba
xor eax, eax
jmp 0x10066748
push 8
call fcn.1006757e
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10066712
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100666fb
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.100675d1
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100abff8], eax
mov dword [0x100abffc], 0
mov eax, dword [ebp - 8]
jmp 0x10066748
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1006672a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x100666da
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100ac000]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100ac000], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10075de6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10075c63

Function at 0x1007d2d3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007cf6d
Function at 0x10087160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1008718d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1008718d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret