joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004b23
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
je 0x1004bb0
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.01004a6e
test eax, eax
je 0x1004c0d
lea eax, [ebp - 0x128]
mov esi, 0x100ae84
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100b6d4], 0x20
je 0x1004ba3
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
sub eax, ebx
je 0x1004b98
dec eax
je 0x1004b91
dec eax
je 0x1004b8a
dec eax
jne 0x1004ba3
push 0x1001494
jmp 0x1004b9d
push 0x100148c
jmp 0x1004b9d
push 0x1001484
jmp 0x1004b9d
push 0x100147c
push esi
call fcn.01005a72
push 0x10012c4
push esi
call fcn.01005a72
jmp 0x1004bbf
push dword [ebp + 8]
mov esi, 0x100ae84
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.01004f08
test eax, eax
jne 0x1004bdf
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1004c15
mov dword [0x100aaa0], 1
push ebx
push dword [ebp + 0x10]
push esi
call fcn.01004fa7
test eax, eax
je 0x1004bf8
push 1
mov dword [0x100b704], ebx
pop eax
jmp 0x1004c0f
cmp dword [0x100aaa0], ebx
je 0x1004c0d
push esi
mov dword [0x100aaa0], ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
call fcn.01005723
mov dword [0x100b704], eax
jmp 0x1004c0d
Function at 0x1004f08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x14
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x1004f4e
push ebp
push 0x10
push ebp
push ebp
push 0x4b5
push ebp
call fcn.01003cba
call fcn.01005723
mov dword [0x100b704], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x10014ac
push esi
call fcn.01005a72
push ebp
push 0x4000080
push 1
push ebp
push ebp
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, 0xffffffff
je 0x1004f3b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1004f3b
test al, 0x10
je 0x1004f3b
push 1
mov dword [0x100b704], ebp
pop eax
jmp 0x1004f47
Function at 0x10056d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1005711
push eax
push 0x10
push eax
push eax
push 0x4f0
push eax
call fcn.01003cba
call fcn.01005723
mov dword [0x100b704], eax
xor eax, eax
leave
ret
push 2
lea eax, [ebp - 0x104]
push 2
push eax
call fcn.01004fa7
leave
ret

Function at 0x1005742
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x24]
push edi
push 0x1001370
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
call ebx
add esp, 0xc
lea eax, [ebp - 0x24]
push 0xa
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100580b
jmp 0x1005785
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x10057f1
mov eax, dword [esi]
lea edi, [esi + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + edi + 1]
push eax
push edi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [ebp + 8]
test eax, eax
je 0x1005800
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
inc dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp - 4]
push 0x1001370
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x24]
push 0xa
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x1005783
jmp 0x100580b
mov dword [0x100b704], 0x80070714
mov dword [ebp - 8], edi
jmp 0x100580b
and dword [ebp - 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10058f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push 0x100ae84
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.01005a72
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1005943
test al, 0x10
jne 0x1005943
push 8
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x100594c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4

Function at 0x1005a22
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005a35
xor eax, eax
jmp 0x1005a3d
not eax
shr eax, 4
and eax, 1
ret 4
Function at 0x440260
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4663d4]
jne 0x44026a
repz ret
jmp fcn.004516b0
Function at 0x461290
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d4
cmp dword [0x892738], 0x37
jne 0x461392
push 0
push 0x40a330
push 0
push 0x40a390
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor eax, eax
mov word [ebp - 0x4cc], ax
xor ecx, ecx
mov word [ebp - 0x4ca], cx
lea edx, [ebp - 0xc8]
push edx
mov eax, dword [ebp - 0x4cc]
push eax
lea ecx, [ebp - 0x4d4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
push 0
push 0
push 0
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push 0x40a3e4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push 0x40a41c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
mov ecx, dword [ebp - 0x20]
push ecx
lea edx, [ebp - 0x4c8]
push edx
mov eax, dword [ebp - 0xc4]
push eax
push 0x40a444
call dword [sym.imp.KERNEL32.dll_FindFirstFileExA]
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFileEx]
push 0
push 0x40a45c
push 0
push 0x40a478
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov eax, dword [0x88a184]
add eax, dword [ebp + 8]
mov ecx, dword [0x89273c]
add ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x12336]
mov byte [eax], dl
mov esp, ebp
pop ebp
ret 4

Function at 0x4615e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
jmp 0x461610
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jae 0x461661
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
cmp dword [0x892738], 0x1c
jne 0x46164c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*4]
push edx
call fcn.00461420
jmp 0x461607
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001205f
Capabilities:
Get memory capacity
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100120dd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001209b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jg 0x100120db
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x100120b9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 2
jg 0x100120d9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100120d7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x100120ae
jmp 0x10012090
jmp 0x100120e5
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esp, ebp
pop ebp
ret
Function at 0x10014f21
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10014f46
push 0
push 0x659
push 0
push 0
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10014f85
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.10016dc0
mov ecx, dword [ebp - 0x1c]
mov cl, byte [ecx]
mov byte [eax], cl
mov esp, ebp
pop ebp
ret
Function at 0x1001c928
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001c949
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov byte [eax], 1
jmp 0x1001c95e
push 0
push 0x659
push 0
push 0
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x100278ee
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10027a1e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x100279f4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jge 0x1002795d
mov dword [ebp - 0x10], 1
jmp 0x10027961
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jle 0x10027976
mov dword [ebp - 0xc], 1
jmp 0x1002797a
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jle 0x10027993
mov dword [ebp - 0x14], 1
jmp 0x10027997
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
neg ecx
mov edx, dword [ebp - 8]
add ecx, dword [edx]
sub eax, ecx
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jg 0x100279c0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100279c0
mov dword [ebp - 0x3c], 1
jmp 0x100279c4
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x100279f4
and dword [ebp - 0x1c], 0
jmp 0x100279fb
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
jne 0x10027a0a
mov dword [ebp - 0x20], 1
jmp 0x10027a0e
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
imul eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
jmp 0x10027a2f
push 0x26fe
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov esp, ebp
pop ebp
ret
Function at 0x1002de19
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002de65
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov eax, dword [eax]
add eax, dword [ecx + 0x3c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x1002de7a
push 0
push 0x659
push 0
push 0
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x1002e0f6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002e11a
xor eax, eax
jmp 0x1002e22a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002e138
xor eax, eax
jmp 0x1002e22a
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
call fcn.1002d55f
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002e156
xor eax, eax
jmp 0x1002e22a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 1
call fcn.1002dfe2
add esp, 0x18
push dword [ebp - 4]
push dword [ebp + 8]
push 0
push dword [ebp - 8]
call fcn.1002a75f
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002e1b3
lea eax, [ebp - 4]
push eax
push 0x2339
push 0x43
push 1
lea eax, [ebp - 0x14]
push eax
push 0x1aa7
call fcn.1002e06f
add esp, 0x18
push dword [ebp - 4]
call fcn.1002c8b1
pop ecx
test eax, eax
jne 0x1002e1c4
xor eax, eax
jmp 0x1002e22a
push 0
push dword [ebp - 4]
call fcn.1002588a
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002e212
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002e1ef
xor eax, eax
jmp 0x1002e22a
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002e208
xor eax, eax
jmp 0x1002e22a
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002e223
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002e227
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100425ea
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004274e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10042636
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xb
jne 0x1004274c
mov dword [ebp - 8], 1
mov dword [ebp - 0x10], 0xe9646b8d
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0xc], 0
jmp 0x1004266e
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x10042681
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x48], 7
jmp 0x10042667
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 8], eax
jg 0x10042692
mov dword [ebp - 0x14], 1
jmp 0x10042696
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jg 0x100426ba
mov eax, 0x6fd4
test eax, eax
jne 0x100426ba
cmp dword [ebp - 8], 0
jne 0x100426ba
and dword [ebp - 0x18], 0
jmp 0x100426c1
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jle 0x100426d2
mov dword [ebp - 0x1c], 1
jmp 0x100426d6
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0x7289fff1
jne 0x100426e8
mov dword [ebp - 0x20], 1
jmp 0x100426ec
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x20]
jne 0x10042700
cmp dword [ebp - 0x24], 0
jne 0x10042700
and dword [ebp - 0x28], 0
jmp 0x10042707
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x28], eax
jle 0x1004271a
mov dword [ebp - 0x40], 1
jmp 0x1004271e
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp + eax - 0x48], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x1004262b
jmp 0x1004275f
push 0x144a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esp, ebp
pop ebp
ret
Function at 0x10042804
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10042842
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1004283d
push 0
push 0x659
push 0
push 0
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1004297e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x1004287c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xffffffe5
jl 0x1004297e
mov dword [ebp - 4], 0x95e17ca0
mov dword [ebp - 4], 0
jmp 0x1004289f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jl 0x10042979
mov dword [ebp - 8], 0x5fa2ef7
cmp dword [ebp - 4], 0
jne 0x1004294e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 4], eax
jge 0x100428cd
mov dword [ebp - 0x14], 1
jmp 0x100428d1
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jle 0x100428e2
mov dword [ebp - 0x10], 1
jmp 0x100428e6
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jle 0x100428ff
mov dword [ebp - 0x18], 1
jmp 0x10042903
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
neg ecx
add ecx, dword [ebp - 4]
sub eax, ecx
cmp eax, dword [ebp - 8]
jg 0x10042924
cmp dword [ebp - 8], 0
je 0x10042924
mov dword [ebp - 0x3c], 1
jmp 0x10042928
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1004294e
and dword [ebp - 0x20], 0
jmp 0x10042955
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0
jne 0x10042964
mov dword [ebp - 0x24], 1
jmp 0x10042968
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
jmp 0x10042898
jmp 0x10042871
mov esp, ebp
pop ebp
ret
Function at 0x1005a3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov ah, 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1005a168
pop esp
add esi, dword [ecx - 0x57ba7247]
push eax
call fcn.1005a178
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1005a12d
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1005a456
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
invalid
inc ebp
invalid

Function at 0x1005a4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1005a178
push eax
push esi
push dword [ebp + 8]
call fcn.1005a12d
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1005a178
push eax
push esi
push dword [ebp + 8]
call fcn.1005a12d
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1005a178
push eax
push esi
push dword [ebp + 8]
call fcn.1005a12d
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1005a168
retf
Function at 0x1005ad70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x39c], eax
call fcn.1005a168
neg byte [ebx]
clc
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.1005a178
pop ecx
push eax
push dword [ebp + 0x18]