joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003440e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x100344a8
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003445b
push 0
push 0
push 0
push 0
push 0xc4d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x100344a6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10034489
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x100344a6
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10010148
mov dword [eax], 9
jmp 0x1003447e
jmp 0x100344fb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
push 1
push 0x4954
push dword [ebp - 0x20]
push 0x196d
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.10024678
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x10036b98
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071622
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10036be6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
push 0x44cd
push 0x6dda
call fcn.10036d7a
add esp, 0x14
jmp 0x10036d6c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10036d66
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0x23dd
cmp dword [ebp - 0x40], 0xda8
jge 0x10036d0f
lea ecx, [ebp - 0x5c]
call fcn.1000fd26
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
jmp 0x10036c4e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x5c]
mov ecx, 0x106643e0
call fcn.10012ef8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 4]
call fcn.10022ec0
movzx eax, al
test eax, eax
je 0x10036d03
mov edx, 0x1000947c
lea ecx, [ebp - 0x5c]
call fcn.10047534
movzx eax, al
test eax, eax
je 0x10036d03
push dword [ebp - 0x18]
mov edx, 0x100095f0
mov ecx, 0x10664338
call fcn.100130d7
mov ecx, eax
call fcn.1001ff61
mov edx, 0x100090b8
mov ecx, eax
call fcn.100130d7
mov edx, 0x100095f8
lea ecx, [ebp - 0x5c]
call fcn.10022392
movzx eax, al
test eax, eax
je 0x10036ce3
push fcn.100132ae
mov edx, 0x10009600
mov ecx, 0x10664338
call fcn.100130d7
mov ecx, eax
call fcn.1000fea3
jmp 0x10036cfe
push fcn.100132ae
mov edx, 0x10009610
mov ecx, 0x10664338
call fcn.100130d7
mov ecx, eax
call fcn.1000fea3
jmp 0x10036c47
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.1000fd66
mov eax, dword [ebp - 0x10]
mov dword [eax], 9
jmp 0x10036d25
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x36
jg 0x10036d64
mov dword [ebp - 0x20], 0xfffe
mov eax, dword [ebp - 0x14]
mov dword [eax], 0xfffffff3
jmp 0x10036d4a
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0xb
jl 0x10036d62
mov dword [ebp - 0x44], 0xfbe58499
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
jmp 0x10036d3f
jmp 0x10036d1a
jmp 0x10036d6c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003740a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10037432
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0x7f5
push 1
push dword [ebp - 8]
call fcn.10037477
add esp, 0xc
jmp 0x10037473
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10037456
push 0xda2
push 1
push 0x2634
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x10037473
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10037473
push 0
push 0x245d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esp, ebp
pop ebp
ret
Function at 0x1003dd24
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003dd6b
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.1003ddad
add esp, 0x18
jmp 0x1003dda9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1003dd8b
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1003dda9
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1003dda9
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret

Function at 0x1003fac4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003fb38
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003fb0e
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003fb0c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1003fb36
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1003fb36
push 0xda2
push 1
push 0x2634
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x1003fb67
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
push 0x60f7
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x5c84
push dword [ebp - 0x28]
call fcn.10031a0d
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x10040056
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100400f4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100400d4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100400b8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100400d2
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10010148
and dword [eax], 0
jmp 0x100400ad
jmp 0x100400f2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100400f2
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1004010c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0x68fb
push 0
call fcn.10033786
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100403c4
Capabilities:
Get file attributes
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x1004041e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100403fe
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100403fc
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1004041c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1004041c
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10040455
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.10024cbd
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1004057e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100405b9
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push 0x2b58
push 0x450b
push 0x2f1c
push dword [ebp - 8]
push dword [ebp - 0xc]
push 1
call fcn.10040619
add esp, 0x18
jmp 0x10040615
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100405fe
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100405fc
push 0
push 0x245d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10040615
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x10040787
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100407ce
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100407b8
push 0xda2
push 1
push 0x2634
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x100407cc
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100407cc
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x100407e2
push 0x7a94
push 0xab
push 1
call fcn.100234de
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100429fc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10042a7d
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10042a30
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10042a7b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10042a5e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10042a7b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10010148
mov dword [eax], 1
jmp 0x10042a53
jmp 0x10042a95
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 1
push 0x6a3e
push dword [ebp - 0x20]
call fcn.10030923
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1004a62b
Capabilities:
Get disk information

Disassembly:
mov eax, 0x10071a6b
call fcn.100701b8
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x5746
cmp dword [ebp - 0x1c], 0x599e
push edi
mov dword [ebp - 0x10], esp
jle 0x1004a6b5
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x20], 0
cdq
mov edi, esi
idiv ebx
mov esi, dword [ebp - 0x20]
mov ecx, edx
sar edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10664338
cdq
push edx
push eax
call fcn.10046c94
inc esi
cmp esi, 0x3066
jl 0x1004a66c
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x14]
cmp ebx, 0xd37
jl 0x1004a65a
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x6b98
jl 0x1004a658
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xbd0
jl 0x1004a653
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x553e
jge 0x1004a6d1
mov edx, 0x10009844
mov ecx, 0x10664338
call fcn.100130d7
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004b735
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100707a7
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x1004b859
cmp byte [ebx + 0x45], 0
je 0x1004b859
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x1004b77f
xor al, al
jmp 0x1004b85b
xor eax, eax
mov dword [esp + 0x24], 0xf
push eax
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
call fcn.10012651
and dword [esp + 0x34], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1004b7e4
dec eax
je 0x1004b7e8
dec eax
dec eax
je 0x1004b846
xor bl, bl
jmp 0x1004b848
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x1004b827
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.10059bf9
add esp, 0x10
cmp esi, eax
jne 0x1004b7e0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp byte [ebx + 0x45], 0
je 0x1004b846
test esi, esi
jne 0x1004b7aa
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.10010603
jmp 0x1004b7a2
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1001080a
mov al, bl
jmp 0x1004b85b
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006c725
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10078750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005c798
mov dword [ebp - 0x14], eax
cmp dword [0x10665450], esi
jne 0x1006c818
push 0x800
push esi
push 0x10008fe0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006c7a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006c8f8
push esi
push esi
push 0x10008fe0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006c8f8
push 0x10008ff8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006c8f8
push eax
call ebx
push 0x10009004
push edi
mov dword [0x10665450], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10009014
push edi
mov dword [0x10665454], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10009028
push edi
mov dword [0x10665458], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10665460], eax
test eax, eax
je 0x1006c815
push 0x10009044
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1066545c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006c83d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006c830
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006c852
push 4
pop eax
jmp 0x1006c8fa
cmp dword [ebp - 0x14], esi
je 0x1006c852
push dword [0x10665450]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006c837
mov eax, dword [0x1066545c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006c8b0
cmp dword [0x10665460], edi
je 0x1006c8b0
push eax
call ebx
push dword [0x10665460]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006c8b0
test eax, eax
je 0x1006c8b0
call ecx
test eax, eax
je 0x1006c8a5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006c8a5
test byte [ebp - 8], 1
jne 0x1006c8b0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006c8e0
mov eax, dword [0x10665454]
cmp eax, edi
je 0x1006c8dd
push eax
call ebx
test eax, eax
je 0x1006c8dd
call eax
mov esi, eax
test esi, esi
je 0x1006c8dd
mov eax, dword [0x10665458]
cmp eax, edi
je 0x1006c8dd
push eax
call ebx
test eax, eax
je 0x1006c8dd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10665450]
call ebx
test eax, eax
je 0x1006c8f8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006c8fa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005a4a2
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x409d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x409d2f
pop dword [ebp - 0x14]
mov eax, 0xe6589af2
sub eax, 0xe617fdc3
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x32cc6
push 0
mov eax, 0x28c09553
add eax, 0xd7804b85
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x73aea380
sub ecx, 0x73ae751f
mov esi, eax
mov edi, 0x85d91730
add edi, 0x7a682494
add edi, dword [ebp - 0x14]
mov edx, 0x47a73d29
sub edx, 0x8f10475
mov ebx, dword [edi]
add dword [ebp - 4], edi
sub ebx, edx
mov dword [esi], ebx
xor dword [ebp - 4], edx
add esi, 0x60b2d2c7
sub esi, 0x60b2d2c3
add edi, 0xf6bb29dc
sub edi, 0xf6bb29d8
loop 0x409d8e
add eax, 0x50b4056b
sub eax, 0x50b35914
mov ebx, eax
add eax, 5
mov ecx, 0x33d07bb0
add ecx, 0xcc6f8450
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10011ee0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi - 4]
mov dword [esp + 0x24], ebx
cmp eax, 0x1d
ja 0x1001279f
jmp dword [eax*4 + 0x100127a8]
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10012737
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10012755
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100127b3
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1001279a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100127a3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100127ad
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1001278f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10012719
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10012800
dec eax
je 0x100127f7
sub eax, 3
je 0x100127ee
mov dword [ebp - 4], 0x40
jmp 0x1001281d
mov dword [ebp - 4], 4
jmp 0x10012803
mov dword [ebp - 4], 0x20
jmp 0x10012803
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1001284f
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x100127cf
invalid

Function at 0x10015730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, dword [esp + 4]
mov dword [ecx + 0x12c], eax
cmp eax, 2
je 0x10015751
cmp eax, 1
je 0x10015751
mov byte [ecx + 0x141], 0
ret 4
mov byte [ecx + 0x141], 1
mov dword [esp + 4], 1
jmp fcn.10013a20