joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000df80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.10002a90
mov byte [0x10029220], 1
mov eax, dword [0x100352e0]
mov dword [0x10029a10], eax
mov dword [ebp - 8], 0
mov eax, dword [0x100352e0]
test eax, eax
je 0x1000e0ac
sub eax, 1
je 0x1000dfd4
sub eax, 1
je 0x1000e04c
sub eax, 1
je 0x1000e07c
jmp 0x1000e0f8
call sub.kernel32.dll_GetCurrentThreadId
mov dword [0x100360b0], eax
mov eax, 0x10036170
call fcn.100029e0
test eax, eax
jne 0x1000e030
xor eax, eax
push 0x1000e01a
push ebp
push 0x1000f010
push dword fs:[eax]
mov dword fs:[eax], esp
call dword [0x10035334]
mov dword [ebp - 8], 0xffffffff
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x1000e0f8
cmp dword [0x10034010], 0
sete al
and eax, 0xff
neg eax
mov dword [ebp - 8], eax
jmp 0x1000e0f8
call fcn.1000c190
mov eax, 0x1000000
call fcn.1000be10
cmp dword [0x10029460], 0
je 0x1000e0f8
mov eax, dword [0x100352f0]
call dword [0x10029460]
nop
jmp 0x1000e0f8
cmp dword [0x10029470], 0
je 0x1000e090
mov eax, dword [0x100352f0]
call dword [0x10029470]
mov eax, dword [0x100299b0]
push dword [eax]
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x1000e0f8
call fcn.1000bee0
lea esi, [esi]
jmp 0x1000e0f8
cmp dword [0x100360b0], 0
je 0x1000e102
lea esi, [esi]
mov eax, 0x10036170
call fcn.100029e0
test eax, eax
jne 0x1000e0e4
cmp dword [0x10029450], 0
je 0x1000e0dc
mov eax, dword [0x100352f0]
call dword [0x10029450]
mov esi, esi
call fcn.1000a510
lea esi, [esi]
call fcn.1000c2b0
call fcn.1000c230
mov dword [0x100360b0], 0
mov dword [0x10029a10], 0xffffffff
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10015030
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.10015020
push ebp
push 0x1000ec90
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea esi, [esi]
add ebx, 1
lea eax, [ebx*4 + 0x100367ac]
xor edx, edx
call fcn.10005d90
mov dword [ebx*4 + 0x100367cc], 0xffffffff
cmp ebx, 7
jl 0x10015058
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x100150e4
lea esi, [esi]
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
xor cx, cx
mov edx, 0xa
call fcn.10006780
mov eax, dword [ebp - 0x10]
mov edx, 1
call fcn.1000fb20
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x100150e4
push 4
push ebx
push esi
mov eax, 0x10014f00
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x10014f90
push eax
call sub.kernel32.dll_EnumCalendarInfoA
nop
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10015020
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015830
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x1c]
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor edx, edx
push fcn.10015800
push ebp
push 0x1000ec90
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
call fcn.1000f7f0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.10005d90
lea eax, [ebp - 4]
mov cl, 1
mov dx, 1
call fcn.10007140
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.10005d90
call sub.kernel32.dll_GetEnvironmentStringsA
mov dword [ebp - 0x1c], eax
mov ebx, eax
jmp 0x1001593c
lea ecx, [ebp - 8]
mov eax, ebx
xor dx, dx
call fcn.100066e0
mov eax, dword [ebp - 8]
test eax, eax
je 0x100158c7
mov eax, dword [eax - 4]
mov edi, eax
lea eax, [ebp - 8]
xor cl, cl
mov dx, 1
call fcn.10007140
mov edx, dword [ebp - 8]
mov ecx, 1
mov al, 0x3d
call fcn.10006cc0
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 8]
mov edx, 1
call fcn.10006b60
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.1000f7f0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.10006900
test eax, eax
jne 0x10015934
push dword [ebp - 0x18]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10015923
mov eax, dword [eax - 4]
sub eax, esi
mov ecx, eax
lea edx, [esi + 1]
mov eax, dword [ebp - 8]
call fcn.10006b60
jmp 0x10015945
lea eax, [ebx + edi]
add eax, 1
mov ebx, eax
cmp byte [ebx], 0
jne 0x100158b0
push dword [ebp - 0x1c]
call sub.kernel32.dll_FreeEnvironmentStringsA
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10015800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10015990
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x94]
mov dword [0x10036810], 0
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
mov dword [0x10036670], eax
mov eax, dword [ebp - 0x90]
mov dword [0x10036680], eax
mov eax, dword [ebp - 0x8c]
mov dword [0x10036690], eax
mov eax, dword [ebp - 0x88]
mov dword [0x100366a0], eax
mov edx, 0x100366b1
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.10002330
lea eax, [ebp - 0x80]
call fcn.10002e90
mov byte [0x100366b0], al
mov eax, str.kernel32
push eax
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x10036820], eax
test eax, eax
je 0x10015a30
mov eax, str.GetDiskFreeSpaceExA
push eax
push dword [0x10036820]
call sub.kernel32.dll_GetProcAddress
mov dword [0x10036810], eax
nop
cmp dword [0x10036680], 6
jae 0x10015a44
mov dword [0x10029ba0], 0
nop
cmp dword [0x10036680], 6
jb 0x10015a60
cmp dword [0x10036690], 1
jb 0x10015a60
mov dword [0x10029bb0], 2
mov esp, ebp
pop ebp
ret
Function at 0x10016e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.10016e70
push ebp
push 0x1000ec90
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10016f98
mov al, byte [ebp - 0x110]
test al, al
je 0x10016f61
lea eax, [ebp - 0xc]
call fcn.100027e0
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.10003400
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.10006610
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.10007140
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x10016eea
mov ecx, ebp
call fcn.1000eb50
jmp 0x10016f98
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x10016f61
mov ecx, ebp
call fcn.1000eb50
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10017064
mov al, byte [ebp - 0x110]
test al, al
je 0x1001702d
lea eax, [ebp - 0xc]
call fcn.100027e0
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.10003400
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.10006610
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.10007140
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x10016fb6
mov ecx, ebp
call fcn.1000eb50
jmp 0x10017064
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x1001702d
mov ecx, ebp
call fcn.1000eb50
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.10016b00
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10016e70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10016eea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.10016e70
push ebp
push 0x1000ec90
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10016f98
mov al, byte [ebp - 0x110]
test al, al
je 0x10016f61
lea eax, [ebp - 0xc]
call fcn.100027e0
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.10003400
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.10006610
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.10007140
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x10016eea
mov ecx, ebp
call fcn.1000eb50
jmp 0x10016f98
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x10016f61
mov ecx, ebp
call fcn.1000eb50
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10017064
mov al, byte [ebp - 0x110]
test al, al
je 0x1001702d
lea eax, [ebp - 0xc]
call fcn.100027e0
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.10003400
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.10006610
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.10007140
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x10016fb6
mov ecx, ebp
call fcn.1000eb50
jmp 0x10017064
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x1001702d
mov ecx, ebp
call fcn.1000eb50
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.10016b00
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10016e70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10016f61
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x118]
push ebx
push esi
push edi
mov esi, eax
mov edi, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov al, byte [ebp + 8]
mov byte [ebp - 0x110], al
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.10016e70
push ebp
push 0x1000ec90
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x114]
push dword [ebp - 0x118]
push edi
call sub.kernel32.dll_FindResourceA
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10016f98
mov al, byte [ebp - 0x110]
test al, al
je 0x10016f61
lea eax, [ebp - 0xc]
call fcn.100027e0
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.10003400
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.10006610
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.10007140
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x10016eea
mov ecx, ebp
call fcn.1000eb50
jmp 0x10016f98
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x10016f61
mov ecx, ebp
call fcn.1000eb50
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_LoadResource
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10017064
mov al, byte [ebp - 0x110]
test al, al
je 0x1001702d
lea eax, [ebp - 0xc]
call fcn.100027e0
push 0xff
mov eax, dword [ebp - 0x118]
lea ecx, [ebp - 0x10c]
mov edx, 0xffffffff
call fcn.10003400
lea ecx, [ebp - 0xc]
xor dx, dx
lea eax, [ebp - 0x10c]
call fcn.10006610
xor cl, cl
xor dx, dx
lea eax, [ebp - 0xc]
call fcn.10007140
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xb
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x10016fb6
mov ecx, ebp
call fcn.1000eb50
jmp 0x10017064
mov eax, dword [ebp - 0x118]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 6
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [str.Resource___s__not_found]
mov edx, 1
mov eax, 0x1002e9b0
call fcn.100141f0
mov edx, 0x1001702d
mov ecx, ebp
call fcn.1000eb50
push dword [esi + 0x10]
push edi
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push dword [esi + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, esi
mov ecx, ebx
call fcn.10016b00
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10016e70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10023a70
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x220]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
call fcn.10005d60
mov dword [ebp - 0x220], 0
xor eax, eax
push fcn.10023a50
push ebp
push 0x1000ec90
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push 0x10023b64
push ebp
push 0x1000f010
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x10023acc
lea eax, [ebp - 4]
call fcn.10023a40
lea esi, [esi]
cmp dword [ebp - 4], 0
jne 0x10023ae0
lea eax, [ebp - 4]
mov edx, 0x10030dfc
call fcn.10005d90
nop
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x104
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x220]
call fcn.100027e0
push 0
mov edx, dword [ebp - 4]
mov ecx, 0x10030e0c
lea eax, [ebp - 0x220]
call fcn.10005e90
mov eax, dword [ebp - 0x220]
test eax, eax
jne 0x10023b3c
mov eax, 0x10035310
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0x214]
xor edx, edx
push edx
push eax
mov edx, dword [ebp - 8]
mov eax, 8
call fcn.1000fa10
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x10023b76
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.10023a50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
call fcn.10023b90
test al, al
jne 0x10023f88
push dword [ebp - 8]
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 4], eax
jmp 0x10024000
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x10024000
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x10]
lea eax, [edx + ecx]
mov eax, dword [eax + 0x78]
add eax, dword [ebp - 0x10]
mov edi, eax
mov eax, dword [edi + 0x18]
sub eax, 1
mov esi, eax
test esi, esi
jl 0x10023ff8
mov ebx, 0xffffffff
add ebx, 1
mov eax, dword [edi + 0x20]
add eax, dword [ebp - 0x10]
mov eax, dword [eax + ebx*4]
add eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.1000f470
test eax, eax
jne 0x10023ff4
mov eax, edi
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0x10]
movsx eax, word [eax + ebx*2]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x10]
lea eax, [edx + ecx]
mov dword [ebp - 0xc], eax
cmp esi, ebx
jg 0x10023fb8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov esi, esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48e008]
jne 0x40100a
repz ret
jmp fcn.00401cf1

Function at 0x40773b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402a1a
and dword [ebp - 4], 0
cmp dword [0x490008], 0
mov ebx, eax
jne 0x4077ec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40789d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40789d
push eax
call fcn.004029a8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x490008], eax
call esi
push eax
call fcn.004029a8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x49000c], eax
call esi
push eax
call fcn.004029a8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x490010], eax
call esi
push eax
call fcn.004029a8
pop ecx
mov dword [0x490018], eax
test eax, eax
je 0x4077ec
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004029a8
pop ecx
mov dword [0x490014], eax
mov eax, dword [0x490014]
cmp eax, ebx
je 0x407844
cmp dword [0x490018], ebx
je 0x407844
push eax
call fcn.00402a23
push dword [0x490018]
mov esi, eax
call fcn.00402a23
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407844
test edi, edi
je 0x407844
call esi
test eax, eax
je 0x40783b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40783b
test byte [ebp - 0xc], 1
jne 0x407844
or dword [ebp + 0x10], 0x200000
jmp 0x40787d
mov eax, dword [0x49000c]
cmp eax, ebx
je 0x40787d
push eax
call fcn.00402a23
pop ecx
test eax, eax
je 0x40787d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40787d
mov eax, dword [0x490010]
cmp eax, ebx
je 0x40787d
push eax
call fcn.00402a23
pop ecx
test eax, eax
je 0x40787d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x490008]
call fcn.00402a23
pop ecx
test eax, eax
je 0x40789d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40789f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x486ce0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp edi, 0x19f
jne 0x486cf9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
test edi, edi
jle 0x486d41
nop
lea ecx, [esp + 8]
mov dword [esp], 5
mov dword [esp + 8], 0
call fcn.00486cd0
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp], eax
sub dword [esp], 0x46
movsx eax, byte [edx + esi]
mov dword [esp + 4], eax
mov eax, dword [esp]
xor dword [esp + 4], eax
mov cl, byte [esp + 4]
mov byte [edx + esi], cl
inc edx
cmp edx, edi
jl 0x486d00
cmp edi, 0x2d
jne 0x486d5a
mov dword [0x2b8e220], 0xa62e7790
mov dword [0x2b8e224], 0xffffffff
add esp, 0xc
ret
Function at 0x100013d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0xc]
add ebx, 0x24
mov ebx, dword [ebx + 4]
movzx eax, byte [ebx]
or eax, 0x5c3a00
mov dword [ebp - 8], eax
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
lea eax, [ebp - 8]
push eax
call fcn.100033f8
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x100015ce
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x1bc558ea
push eax
call fcn.10002ac0
mov dword [0x6943588], eax
call fcn.100033e6
mov dword [0x6943584], eax
call fcn.100013d0
mov dword [0x694356c], eax
mov dword [0x6943578], 0x6941fbd
mov dword [0x694357c], 0x6941374
mov dword [ebp - 0xa4], 0x94
lea eax, [ebp - 0xa4]
push eax
call fcn.100033f2
mov eax, dword [ebp - 0xa0]
rol eax, 8
add eax, dword [ebp - 0x9c]
mov dword [0x6943570], eax
push 0x6943590
push 0xffffffffffffffff
call fcn.1000340a
mov dword [0x6943640], 0xffffffff
mov dword [ebp - 0x10], 0xfe363c80
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.100033a4
push 4
push 0x1000
push 0x8000
push 0
call fcn.1000341c
mov dword [ebp - 4], eax
test eax, eax
je 0x100017d8
push 0x8000
push dword [ebp - 4]
push 0x6941176
call fcn.100033da
test eax, eax
je 0x100017d8
push 0
push 0x694117e
call fcn.10003410
push 0x8000
push dword [ebp - 4]
push dword [ebp - 4]
call fcn.100033ec
call fcn.10002377
push dword [0x694356c]
push 0x6941186
lea eax, [ebp - 0x10]
push eax
call fcn.10003506
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0
push 0
call fcn.100033bc
mov dword [0x6943564], eax
call fcn.100033e0
cmp eax, 0xb7
je 0x100017c1
push dword [ebp - 4]
call fcn.100024a7
push dword [ebp - 4]
call fcn.100033c8
push 0x8000
push 0
push dword [ebp - 4]
call fcn.10003422
lea eax, [ebp - 0x236]
push eax
push 0x202
call fcn.100034b8
call fcn.10001d0c
bswap eax
mov dword [0x6943574], eax
push 0
push 0
push 1
push 0
call fcn.100033b6
mov dword [ebp - 0xa8], eax
xor ecx, ecx
push ecx
push ecx
push dword [ebp - 0xa8]
push 0x69429c0
push ecx
push ecx
call fcn.100033c2
push eax
call fcn.100033b0
xor eax, eax
push eax
push eax
push dword [ebp - 0xa8]
push 0x6941410
push eax
push eax
call fcn.100033c2
push eax
push 0x2710
push eax
call fcn.10003428
call fcn.100033b0
xor edx, edx
mov eax, 0x23c34600
mul dword [0x6941140]
not eax
not edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.100033a4
jmp 0x10001776
push dword [ebp - 4]
call fcn.100033c8
push 0x8000
push 0
push dword [ebp - 4]
call fcn.10003422
push 0
call fcn.100033ce
Function at 0x10001c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push esi
xor eax, eax
xor edx, edx
dec edx
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, dl
shr edx, 8
xor edx, dword [eax*4 + 0x6941800]
loop 0x10001c11
mov eax, edx
not eax
pop esi
pop edx
pop ecx
leave
ret 8
Function at 0x4015b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
xor esi, esi
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x20]
add edx, edi
mov ebx, dword [eax + 0x18]
add ecx, edi
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 0x24]
add edx, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
test ebx, ebx
je 0x401616
mov edx, dword [ecx + esi*4]
xor eax, eax
mov cl, byte [edx + edi]
add edx, edi
test cl, cl
je 0x401609
movzx ecx, cl
lea edx, [edx + 1]
or ecx, 0x70
add eax, ecx
mov cl, byte [edx]
add eax, eax
test cl, cl
jne 0x4015f6
cmp eax, dword [ebp - 4]
je 0x40161f
mov ecx, dword [ebp - 8]
inc esi
cmp esi, ebx
jb 0x4015e8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret