joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e14b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], 0x38223456
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0x393a3509
mov dl, 0x56
mov word [ebp - 0xc], 0x3325
mov byte [ebp - 0xa], bl
mov ecx, ebx
xor dl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 9
jae 0x1002e185
mov dl, byte [ebp - 0x14]
jmp 0x1002e172
sub esp, 0x18
mov byte [ebp - 0xa], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.1000289a
mov ecx, dword [esi]
call fcn.1000b929
add esp, 0x18
mov dword [esi + 4], eax
mov cl, 0x7e
mov dword [ebp - 0x14], 0x171a1b7e
mov dword [ebp - 0x10], 0x1f0a210a
mov edx, ebx
mov word [ebp - 0xc], 0x19
xor cl, byte [ebp + edx - 0x13]
mov byte [ebp + edx - 0x13], cl
inc edx
cmp edx, 8
jae 0x1002e1ce
mov cl, byte [ebp - 0x14]
jmp 0x1002e1bb
sub esp, 0x18
mov byte [ebp - 0xb], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.1000289a
mov ecx, dword [esi]
call fcn.1000b929
add esp, 0x18
mov dword [esi + 8], eax
mov dl, 0x6c
mov dword [ebp - 0x14], 0x2180e6c
mov dword [ebp - 0x10], 0x2030f33
mov ecx, ebx
mov dword [ebp - 0xc], 0x11e050a
mov byte [ebp - 8], bl
xor dl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 0xb
jae 0x1002e21b
mov dl, byte [ebp - 0x14]
jmp 0x1002e208
sub esp, 0x18
mov byte [ebp - 8], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.1000289a
mov ecx, dword [esi]
call fcn.1000b929
add esp, 0x18
mov dword [esi + 0xc], eax
mov dl, 0x7a
mov dword [ebp - 0x14], 0x140e187a
mov dword [ebp - 0x10], 0x161f1e25
mov ecx, ebx
mov dword [ebp - 0xc], 0x1f0e1f
xor dl, byte [ebp + ecx - 0x13]
mov byte [ebp + ecx - 0x13], dl
inc ecx
cmp ecx, 0xa
jae 0x1002e265
mov dl, byte [ebp - 0x14]
jmp 0x1002e252
sub esp, 0x18
mov byte [ebp - 9], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.1000289a
mov ecx, dword [esi]
call fcn.1000b929
mov dword [esi + 0x10], eax
add esp, 0x18
mov cl, 0x77
mov dword [ebp - 0x14], 0x101a1e77
mov dword [ebp - 0x10], 0x1b160728
mov eax, ebx
mov dword [ebp - 0xc], 0x12030312
mov byte [ebp - 8], bl
xor byte [ebp + eax - 0x13], cl
inc eax
cmp eax, 0xb
jae 0x1002e2ae
mov cl, byte [ebp - 0x14]
jmp 0x1002e29f
sub esp, 0x18
mov byte [ebp - 8], bl
lea eax, [ebp - 0x13]
mov ecx, esp
push eax
call fcn.1000289a
mov ecx, dword [esi]
call fcn.1000b929
add esp, 0x18
mov dword [esi + 0x14], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e2d2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x48
mov eax, 0x1006c473
call fcn.10035d00
mov esi, ecx
mov eax, dword [esi]
mov dword [0x1008edd0], eax
mov ecx, dword [esi]
call fcn.1000bc9a
test al, al
je 0x1002e3c7
cmp byte [ebp + 8], 0
jne 0x1002e3c7
xor ebx, ebx
mov dword [ebp - 0x3c], 0x5943682d
mov cl, 0x2d
mov dword [ebp - 0x38], 0x790d5f48
mov dword [ebp - 0x34], 0x640d4a4c
mov edx, ebx
mov word [ebp - 0x30], 0x69
xor cl, byte [ebp + edx - 0x3b]
mov byte [ebp + edx - 0x3b], cl
inc edx
cmp edx, 0xc
jae 0x1002e334
mov cl, byte [ebp - 0x3c]
jmp 0x1002e321
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x2f], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.1000289a
lea eax, [ebp - 0x2b]
mov dword [ebp - 4], ebx
mov word [ebp - 0x2c], 8
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 0x2b], bl
call fcn.1000289a
mov byte [ebp - 4], 1
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 8]
call fcn.1000bec1
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.1000274f
mov ecx, dword [esi + 8]
or edx, 0xffffffff
call fcn.1000bf13
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x54]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.1000289a
mov byte [ebp - 4], 2
lea edx, [ebp - 0x54]
mov ecx, dword [esi + 8]
call fcn.1000c342
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.1000274f
mov ecx, dword [esi + 8]
call fcn.1000bf76
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.1000274f
call fcn.10035caa
ret 0xc
Function at 0x1002ee47
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x38223456
mov esi, ecx
mov dword [ebp - 0x14], 0x39243209
mov cl, 0x56
mov word [ebp - 0x10], 0x26
mov edx, ebx
xor cl, byte [ebp + edx - 0x17]
mov byte [ebp + edx - 0x17], cl
inc edx
cmp edx, 8
jae 0x1002ee7e
mov cl, byte [ebp - 0x18]
jmp 0x1002ee6b
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.1000289a
mov ecx, dword [esi]
call fcn.1000b929
movaps xmm0, xmmword [0x10080340]
add esp, 0x18
mov dword [esi + 0x10], eax
mov edx, ebx
movups xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 0xc], bl
mov cl, byte [ebp - 0x1c]
xor byte [ebp + edx - 0x1b], cl
inc edx
cmp edx, 0xf
jb 0x1002eeac
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.1000289a
mov ecx, dword [esi]
call fcn.1000b929
movaps xmm0, xmmword [0x100807f0]
add esp, 0x18
mov dword [esi + 0x14], eax
mov edx, ebx
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x90f0d1e
mov byte [ebp - 0xc], bl
mov cl, byte [ebp - 0x20]
xor byte [ebp + edx - 0x1f], cl
inc edx
cmp edx, 0x13
jb 0x1002eeee
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x1f]
mov ecx, esp
push eax
call fcn.1000289a
mov ecx, dword [esi]
call fcn.1000b929
add esp, 0x18
mov dword [esi + 4], eax
mov dl, 0x7a
mov dword [ebp - 0x1c], 0x140e187a
mov dword [ebp - 0x18], 0x140f1c25
mov ecx, ebx
mov dword [ebp - 0x14], 0x91b1619
mov word [ebp - 0x10], 9
xor dl, byte [ebp + ecx - 0x1b]
mov byte [ebp + ecx - 0x1b], dl
inc ecx
cmp ecx, 0xc
jae 0x1002ef4b
mov dl, byte [ebp - 0x1c]
jmp 0x1002ef38
sub esp, 0x18
mov byte [ebp - 0xf], bl
lea eax, [ebp - 0x1b]
mov ecx, esp
push eax
call fcn.1000289a
mov ecx, dword [esi]
call fcn.1000b929
mov dword [esi + 8], eax
add esp, 0x18
mov cl, 0x77
mov dword [ebp - 0x18], 0x19031577
mov dword [ebp - 0x14], 0x3181b28
mov eax, ebx
mov dword [ebp - 0x10], 0xe051203
mov byte [ebp - 0xc], bl
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xb
jae 0x1002ef94
mov cl, byte [ebp - 0x18]
jmp 0x1002ef85
sub esp, 0x18
mov byte [ebp - 0xc], bl
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.1000289a
mov ecx, dword [esi]
call fcn.1000b929
mov ecx, dword [0x1008eaf0]
add esp, 0x18
mov dword [esi + 0xc], eax
test ecx, ecx
je 0x1002efda
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x1002efda
mov ecx, dword [ecx]
call fcn.1000ba75
mov ecx, dword [esi]
add edx, 0xf5
push 5
call fcn.1000bb10
pop ecx
mov ecx, dword [esi]
push 0x14
pop edx
call fcn.1000bc77
mov ecx, dword [esi]
mov dl, 1
call fcn.1000bb59
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1002effb
xor dl, dl
call fcn.1000bb59
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1002f009
xor dl, dl
call fcn.1000bb59
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1002f017
xor dl, dl
call fcn.1000bb59
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030218
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ecx, ecx
mov dword [0x100b4080], 0xea60
push esi
mov eax, 0x1f4
mov dword [0x100b407c], ecx
push edi
push ecx
mov dword [0x100b4078], eax
mov dword [0x100b4084], ecx
mov dword [0x100b4088], eax
mov dword [0x100b408c], ecx
mov dword [0x100b4090], ecx
call fcn.100568ab
mov edi, eax
mov esi, edx
mov eax, 0x55555555
mov dword [0x100b40a0], edi
xor ebx, ebx
mov dword [0x100b5420], eax
pop ecx
mov dword [0x100b5424], eax
inc ebx
mov dword [0x100b40a4], esi
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.10035ed0
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov eax, 0x138
mov dword [ebx*8 + 0x100b40a0], edi
adc esi, edx
mov dword [ebx*8 + 0x100b40a4], esi
inc ebx
cmp ebx, eax
jl 0x10030277
movaps xmm0, xmmword [0x10080960]
pop edi
pop esi
mov dword [0x100b4098], eax
mov eax, 0x100b4078
movups xmmword [0x100b5428], xmm0
pop ebx
ret 0x10

Function at 0x10032420
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100325f0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100324fd
mov edx, dword [ebp - 4]
cmp edx, dword [0x1008a064]
jb 0x1003246a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1008a068]
ja 0x1003246a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003243a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1004d6e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1003248f
jmp 0x100324fd
cmp dword [ebp - 0x14], 0x10000
jne 0x100324e3
cmp dword [ebp - 0x18], 0x10000
jb 0x100324e3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100324c6
mov eax, dword [ebp - 8]
jmp 0x100324ff
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x100324d6
xor eax, eax
jmp 0x100324ff
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100324f8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100325f0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003243a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10032510
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10032620
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100325e5
mov edx, dword [ebp - 4]
cmp edx, dword [0x1008a064]
jb 0x10032555
mov eax, dword [ebp - 4]
cmp eax, dword [0x1008a068]
ja 0x10032555
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10032525
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1004d6e0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1003257a
jmp 0x100325e5
cmp dword [ebp - 0x14], 0x10000
jne 0x100325ce
cmp dword [ebp - 0x18], 0x10000
jb 0x100325ce
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100325b1
mov eax, dword [ebp - 8]
jmp 0x100325e7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x100325c1
xor eax, eax
jmp 0x100325e7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100325e0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10032620
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10032525
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10032650
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10032a40
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1008da00], 0
jne 0x1003268d
cmp dword [0x1008d9fc], 0
je 0x1003268d
mov eax, dword [0x1008d9fc]
mov dword [0x1008da00], eax
cmp dword [0x1008da00], 0
je 0x1003270a
mov ecx, dword [0x1008da00]
cmp dword [ecx + 8], 0
je 0x1003270a
mov edx, dword [0x1008da00]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1003270a
mov ecx, dword [0x1008da00]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1003270a
mov eax, dword [0x1008da00]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x100326d9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x100326e0
xor eax, eax
jmp 0x10032829
mov ecx, dword [0x1008da00]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1004d6e0
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10032829
mov edx, dword [0x1008d9fc]
mov dword [0x1008da00], edx
jmp 0x10032726
mov eax, dword [0x1008da00]
mov ecx, dword [eax + 4]
mov dword [0x1008da00], ecx
cmp dword [0x1008da00], 0
je 0x10032766
cmp dword [0x1008da00], 0
je 0x10032764
mov edx, dword [0x1008da00]
cmp dword [edx + 8], 0
je 0x10032764
mov eax, dword [0x1008da00]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10032764
mov edx, dword [0x1008da00]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10032764
jmp 0x100326be
jmp 0x10032718
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10032830
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10032827
mov eax, dword [ebp - 0x18]
mov dword [0x1008da00], eax
mov ecx, dword [0x1008da00]
mov dword [ecx], 0x52727464
mov edx, dword [0x1008da00]
mov dword [edx + 8], 0
mov eax, dword [0x1008da00]
mov ecx, dword [0x1008d9fc]
mov dword [eax + 4], ecx
mov edx, dword [0x1008da00]
mov dword [0x1008d9fc], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1008da00]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x100327f7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10032817
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x100327ee
mov eax, dword [0x1008da00]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x100326be
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10033570
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008d9fc]
mov dword [ebp - 4], eax
jmp 0x10033589
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100335b0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x100335ae
call sub.KERNEL32.dll_GetLastError
jmp 0x100335b2
jmp 0x10033580
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10033a50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1008da0c], eax
je 0x10033a74
mov eax, 0x10dd
jmp 0x10033c1c
cmp dword [0x1008da10], 0
je 0x10033a87
mov eax, dword [0x1008da10]
jmp 0x10033c1c
cmp dword [ebp + 0xc], 0
jne 0x10033a97
mov eax, 0x57
jmp 0x10033c1c
cmp dword [ebp + 8], 0
jne 0x10033aa7
mov eax, 6
jmp 0x10033c1c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10033ad0
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x1008da10], ecx
mov edx, dword [ebp + 8]
mov dword [0x1008da14], edx
mov eax, dword [ebp - 8]
jmp 0x10033c1c
push 0x18
call fcn.10035106
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10033b2b
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x1008da10], ecx
cmp dword [ebp - 4], 0
je 0x10033b1a
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.1003515c
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x1008da14], ecx
mov eax, dword [ebp - 8]
jmp 0x10033c1c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10033a30
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10033a30
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x10033b6b
cmp dword [ebp - 0xc], 0x1e
jbe 0x10033b87
mov dword [ebp - 8], 9
cmp dword [0x1008da04], 0
je 0x10033b82
jmp 0x10033af9
jmp 0x10033af0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x10033bae
mov dword [ebp - 8], 9
cmp dword [0x1008da04], 0
je 0x10033ba9
jmp 0x10033af9
jmp 0x10033af0
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10033bd9
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x10033af0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x1008da1c]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1008da1c], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10033c30
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1008da0c], eax
je 0x10033c4d
mov eax, 0x10dd
jmp 0x10033d30
mov eax, dword [0x1008da1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10033ccc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10033ca8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10033ca8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10032ad0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.1003515c
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10033c55
mov dword [0x1008da1c], 0
call fcn.100333b0
mov ecx, dword [0x1008da18]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10033d1a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1003515c
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10033ce4
mov dword [0x1008da18], 0
mov dword [0x1008da0c], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10034210
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1008da10], 0
je 0x10034229
mov eax, dword [0x1008da10]
jmp 0x100342c8
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1003423a
xor eax, eax
jmp 0x100342c8
push 8
call fcn.10035106
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10034292
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1003427b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.1003515c
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1008da10], eax
mov dword [0x1008da14], 0
mov eax, dword [ebp - 8]
jmp 0x100342c8
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x100342aa
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1003425a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1008da18]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1008da18], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10037ef2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10058afb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005897a

Function at 0x10060762
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10060422
Function at 0x40374e
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
push esi
push edi
lea eax, [ebp - 0x22c]
push eax
xor bl, bl
push 0x104
mov byte [ebp - 5], bl
xor bh, bh
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 6]
push eax
push dword [ebp + 8]
call fcn.00404257
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x4721b7
mov eax, dword [0x4c1124]
test eax, eax
je 0x40386d
xor edi, edi
inc edi
mov esi, 0x4c22e8
cmp eax, edi
je 0x4721d0
lea eax, [ebp - 5]
push eax
push ecx
push 0x4c1124
push 0x4c113c
mov ecx, esi
call fcn.00403bff
test al, al
je 0x403876
mov al, byte [0x4c22e8]
mov bh, byte [0x4c22e9]
push 0x4c1120
mov byte [0x4c1128], al
lea eax, [ebp - 0x43c]
push eax
push 0x104
push 0x4c113c
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov bl, byte [ebp - 5]
push dword [0x4c1124]
push 0x4c113c
call fcn.004034f3
test eax, eax
jne 0x4721ef
cmp bh, 1
je 0x47220e
call fcn.004030a5
call fcn.00402e9d
cmp byte [0x4c1128], 0
mov ebx, 0x4c18f0
jne 0x403837
mov ecx, ebx
call fcn.00403598
push edi
mov ecx, 0x4c1348
call fcn.0040e1f0
cmp byte [0x4c1128], 0
jne 0x403852
mov ecx, ebx
call fcn.00402b94
mov ecx, esi
call fcn.00402c7d
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
leave
ret 4
or dword [0x4c10bc], 0xffffffff
jmp 0x403859
mov dword [0x4c10bc], edi
jmp 0x403859
push 0x10
push 0x4b2934
push 0x4b2938
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403866
push 0xffffffffffffffff
push dword [0x4c112c]
mov ecx, esi
push edi
call fcn.00442f5b
mov al, byte [0x4c10c2]
mov byte [0x4c22ea], al
jmp 0x4037f7
mov ecx, esi
call fcn.00402c7d
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x4c10bc], edi
jmp 0x403866
call fcn.0043be31
test al, al
jne 0x403818
cmp byte [ebp - 6], al
jne 0x403818
push 0x104
lea eax, [ebp - 0x43c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x49daa4
lea ecx, [ebp - 0x18]
call fcn.0040caee
lea ecx, [ebp - 0x18]
test bl, bl
je 0x472271
mov edi, 0x4b29a0
push edi
call fcn.004039e8
push 0x4c113c
lea ecx, [ebp - 0x18]
call fcn.004039e8
push edi
lea ecx, [ebp - 0x18]
call fcn.004039e8
push 1
jmp 0x47227a
push dword [ebp + 8]
call fcn.004039e8
push edi
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x43c]
push eax
push 0x4b29a4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.00405cd3
jmp 0x403852

Function at 0x40417d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x47587d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004244ae
add esp, 0x10
leave
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
mov edx, dword [ecx]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0x4041a3