joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100166a2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1000ea0c
xor ebx, ebx
cmp dword [0x1002b3d0], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10016778
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10016858
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x10016858
push eax
call fcn.1000e99e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1002b3d0], eax
call esi
push eax
call fcn.1000e99e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1002b3d4], eax
call esi
push eax
call fcn.1000e99e
mov dword [0x1002b3d8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10014223
test eax, eax
pop ecx
pop ecx
je 0x10016746
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000d2e2
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10016778
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1000e99e
cmp eax, ebx
pop ecx
mov dword [0x1002b3e0], eax
je 0x10016778
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000e99e
pop ecx
mov dword [0x1002b3dc], eax
mov eax, dword [0x1002b3dc]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x100167fd
cmp dword [0x1002b3e0], ecx
je 0x100167fd
push eax
call fcn.1000ea15
push dword [0x1002b3e0]
mov esi, eax
call fcn.1000ea15
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x100167fd
cmp edi, ebx
je 0x100167fd
call esi
cmp eax, ebx
je 0x100167ca
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100167ca
test byte [ebp - 0x18], 1
jne 0x100167fd
lea eax, [ebp - 0x10]
push eax
call fcn.1001425a
test eax, eax
pop ecx
je 0x100167e5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1000d2e2
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x100167f4
or dword [ebp + 0x10], 0x200000
jmp 0x10016838
or dword [ebp + 0x10], 0x40000
jmp 0x10016838
mov eax, dword [0x1002b3d4]
cmp eax, dword [ebp - 8]
je 0x10016838
push eax
call fcn.1000ea15
cmp eax, ebx
pop ecx
je 0x10016838
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10016838
mov eax, dword [0x1002b3d8]
cmp eax, dword [ebp - 8]
je 0x10016838
push eax
call fcn.1000ea15
cmp eax, ebx
pop ecx
je 0x10016838
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002b3d0]
call fcn.1000ea15
cmp eax, ebx
pop ecx
je 0x10016858
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001685a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xde5ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0xa7000c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0xde5ae7
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0xde5aee
mov al, 1
jmp 0xde5be9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], 0xffffffff
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x2c]
call dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0xffffffff
mov ecx, dword [ebp - 0x4c]
cmp ecx, dword [ebp - 0x50]
jne 0xde5b25
mov dword [ebp - 0x38], 1
jmp 0xde5b2c
mov dword [ebp - 0x38], 0
movzx edx, byte [ebp - 0x38]
test edx, edx
je 0xde5b3b
xor al, al
jmp 0xde5be9
mov dword [ebp - 0x5c], 0x20
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x54], ecx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov ecx, dword [ebp - 0x3c]
call dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0xde5b86
cmp dword [ebp - 0x30], 1
je 0xde5b8d
cmp dword [ebp - 0x30], 3
je 0xde5bdc
jmp 0xde5be7
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x58]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0xde5bbc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.00fb62bd
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0xde5bbc
xor al, al
jmp 0xde5be9
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0xde5bd0
mov dword [ebp - 0x40], 1
jmp 0xde5bd7
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
jmp 0xde5be9
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0xde5be9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00fa6b7b
mov esp, ebp
pop ebp
ret
Function at 0xedfd70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0
push 0
push 0x14
call fcn.00edc4d0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xedfd9c
mov eax, 7
jmp 0xedfe4c
movzx ecx, byte [0xa70b24]
test ecx, ecx
je 0xedfdb8
push 0xc8
call fcn.00ee0bf0
add esp, 4
test eax, eax
je 0xedfdcd
xor edx, edx
mov eax, dword [ebp - 4]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
jmp 0xedfe1d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x951130
push 0
push 0
call fcn.00fbbdba
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0xedfe1d
xor eax, eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0xedfe42
call dword [0xa450c0]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
push edx
call dword [ebp + 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0xeed9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x88], 0
je 0xeeda40
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x88], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0xeedad3
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x8c]
add ecx, 0x28
xor edx, edx
push edx
push ecx
call fcn.00edc9f0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp - 4], 0
jne 0xeedaa1
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
sub ecx, 1
xor esi, esi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x98]
cdq
push edx
push eax
push esi
push ecx
call fcn.00fcf660
push edx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
call fcn.00edb670
add esp, 0x10
mov eax, 7
jmp 0xeedaf6
mov edx, 0x28
shl edx, 0
add edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov ecx, 0x20
mov edx, dword [ebp - 4]
mov word [edx + 0x1c], cx
mov eax, 1
mov ecx, dword [ebp - 4]
mov word [ecx + 0x1e], ax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x78], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xf9ea40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x10325476
pop ebp
ret
Function at 0xfa3aa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [ebx + 0xc]
shl eax, 2
mov ecx, dword [ebx + 8]
lea edx, [ecx + eax*4]
push edx
mov eax, dword [ebx + 8]
push eax
call fcn.00fa3c10
add esp, 8
mov dword [ebp - 4], 4
mov ecx, dword [ebx + 0xc]
lea edx, [ecx*4 - 4]
mov dword [ebp - 8], edx
jmp 0xfa3afa
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jae 0xfa3b48
mov eax, dword [ebp - 4]
mov ecx, dword [ebx + 8]
aesimc xmm0, xmmword [ecx + eax*4]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x40], xmm0
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 8]
aesimc xmm0, xmmword [eax + edx*4]
movaps xmmword [ebp - 0x30], xmm0
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 8]
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [edx + ecx*4], xmm0
mov eax, dword [ebp - 8]
mov ecx, dword [ebx + 8]
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [ecx + eax*4], xmm0
jmp 0xfa3ae8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 8]
aesimc xmm0, xmmword [eax + edx*4]
movaps xmmword [ebp - 0x50], xmm0
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 8]
movups xmm0, xmmword [ebp - 0x50]
movups xmmword [edx + ecx*4], xmm0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0xfc42b6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00fc412c
Function at 0x100e830
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x100e93c
test eax, eax
je 0x100e93c
push esi
push edi
mov ecx, 0x10
mov esi, 0xa9aff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x100e923
lea edi, [eax + 4]
jmp 0x100e887
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x100e89c
mov dword [ebp - 4], 2
jmp 0x100e8bd
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x100e8b3
mov dword [ebp - 4], 1
jmp 0x100e8bd
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x100e933
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x100e8f6
mov byte [ecx], 0x3d
jmp 0x100e902
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x100e90d
mov byte [ecx], 0x3d
jmp 0x100e913
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x100e884
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10ba43e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
bswap eax
not al
push edi
jmp 0x1284675
dec ecx
stc
rol ecx, 1
jmp 0x1271b3b
xor ecx, ebx
rol ecx, 1
jmp 0x11028cc
inc ecx
clc
xor ebx, ecx
add edi, ecx
jmp 0x1277010
push edi
ret
push edx
cwd
rdtsc
cdq
push ebx
push ecx
movzx edi, cx
cwde
push ebp
push esi
cmovbe bp, si
movzx ecx, bx
pushfd
rdtsc
inc dl
mov eax, 0x440000
or si, dx
clc
ror esi, 0xf0
push eax
mov ebp, dword [esp + 0x28]
shl bx, cl
bt ebx, ebp
movzx esi, di
lea ebp, [ebp + 0x10105d51]
xor ebp, 0x7242c73
xchg di, di
movzx edx, si
dec ebp
add di, 0x4fef
not ebp
lea ebp, [ebp + eax]
mov esi, esp
rcl dl, 0xaf
sub esp, 0xc0
or edx, edi
mov ebx, ebp
bsr di, sp
mov edx, 0x440000
sub edi, 0x3d241ca7
or di, bp
ror di, 0x15
sub ebx, edx
shr cx, cl
lea edi, [0xcf5af1]
mov ecx, dword [ebp]
lea ebp, [ebp + 4]
jmp 0x1133ab8
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x417f85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x417f94
pop dword [ebp - 0x18]
mov eax, 0xaa6a9e4
add eax, 0xf59ad5b0
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xf0d05087
add dword [ebp - 0x28], 0x5d81f4c4
mov dword [ebp - 0x24], 0x88e5cc01
sub dword [ebp - 0x24], 0x56b27fbc
mov dword [ebp - 0x20], 0x47d27c10
add dword [ebp - 0x20], 0x479c81e
mov dword [ebp - 0x1c], 0xcacacc20
sub dword [ebp - 0x1c], 0xcacacc20
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x40b47a5e
add dword [ebp - 0x28], 0x33bdeef8
mov dword [ebp - 0x24], 0xd4215140
add dword [ebp - 0x24], 0x6d4b1035
mov dword [ebp - 0x20], 0xbc43171c
sub dword [ebp - 0x20], 0x58d3aab0
mov dword [ebp - 0x1c], 0xe442bc44
sub dword [ebp - 0x1c], 0xe442bc44
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xd8eb844e
sub eax, 0xd8a9532a
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3c2a2
push 0
call eax
mov ecx, 0xcc7d7507
add ecx, 0x3382cc68
mov edx, eax
mov ebx, 0x704f8c9
sub ebx, 0x6c1b4c9
add ebx, dword [ebp - 0x18]
mov esi, 0xb4fa7705
add esi, 0x6f373f8e
add dword [ebp - 0x10], edi
mov edi, dword [ebx]
mov dword [ebp - 4], 0xff537ca4
add edi, esi
sub dword [ebp - 8], 0x8aab5217
mov dword [edx], edi
xor dword [ebp - 0x14], 0x7aaa758b
add edx, 0xb786e1a3
add edx, 0x48791e61
add ebx, 0xd1d23c43
add ebx, 0x2e2dc3c1
loop 0x4180b1
add eax, 0xf88f
mov ebx, eax
add eax, 0x2f596100
add eax, 0xd0a69f05
mov ecx, 0xfa8d9022
add ecx, 0x5b26fde
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x403e59
pop dword [ebp - 0x28]
mov eax, 0x4595ad79
add eax, 0xbaaa90e0
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xab066aef
add dword [ebp - 0x38], 0xa34bda5c
mov dword [ebp - 0x34], 0x59de4c73
add dword [ebp - 0x34], 0xd854ffd2
mov dword [ebp - 0x30], 0xe8ea71c6
sub dword [ebp - 0x30], 0x9c9e2d98
mov dword [ebp - 0x2c], 0x52fb81d3
add dword [ebp - 0x2c], 0xad047e2d
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x6f90aa4a
sub dword [ebp - 0x38], 0xfb1e40f4
mov dword [ebp - 0x34], 0x4aaecb10
add dword [ebp - 0x34], 0xf6bd9665
mov dword [ebp - 0x30], 0xbf362303
add dword [ebp - 0x30], 0xa4394969
mov dword [ebp - 0x2c], 0x3ae0f804
add dword [ebp - 0x2c], 0xc51f07fc
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xaec9fe37
add eax, 0x51767271
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3a5f1
push 0
call eax
mov ecx, 0xe19f9c5f
add ecx, 0x1e60ba20
xor esi, esi
add esi, eax
mov edx, 0xddc054c5
sub edx, 0xdd7f54c5
add edx, dword [ebp - 0x28]
mov edi, 0x44834bf3
sub edi, 0xdbaaeeba
add dword [ebp - 0x18], eax
mov ebx, dword [edx]
sub dword [ebp - 4], edi
xor ebx, edi
add dword [ebp - 0x24], 0x1e80e3e7
mov dword [esi], ebx
xor dword [ebp - 0x10], 0x6449af1c
add esi, 0x7fe9c5e0
sub esi, 0x7fe9c5dc
add edx, 0xe21ed632
add edx, 0x1de129d2
loop 0x403f78
add eax, 0x578ae560
add eax, 0xa876676f
xor ebx, ebx
add ebx, eax
add eax, 0x166efa4f
sub eax, 0x166efa4a
mov ecx, 0x163cf4df
sub ecx, 0x15fcf4df
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x405450
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f820
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x453d50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x11c
xor edi, edi
lea eax, [ebp - 0x12c]
push edi
mov ebx, 1
push eax
mov dword [ebp - 4], ebx
call fcn.00428e00
add esp, 0xc
lea ecx, [ebp - 0x12c]
push ecx
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x38
lea edx, [ebp - 0x164]
push edi
push edx
call fcn.00428e00
add esp, 0xc
cmp dword [ebp - 0x128], 6
mov dword [ebp - 0x168], 0x3c
mov dword [ebp - 0x160], edi
jb 0x4054ed
mov dword [ebp - 0x15c], str.runas
cmp dword [ebp + 0x14], edi
jne 0x4054f7
mov dword [ebp - 0x15c], str.open
mov edx, dword [ebp + 8]
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x164], 0x440
mov ecx, dword [edx - 8]
mov eax, ebx
sub eax, dword [edx - 4]
or ecx, eax
jge 0x405523
push 0
lea ecx, [ebp + 8]
call fcn.00401ec0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x158], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx - 8]
mov eax, ebx
sub eax, dword [edx - 4]
or ecx, eax
jge 0x405545
push 0
lea ecx, [ebp + 0xc]
call fcn.00401ec0
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x168]
push eax
mov dword [ebp - 0x154], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4055bc
cmp dword [ebp - 0x148], 0x20
jle 0x4055bc
cmp dword [ebp + 0x10], edi
jne 0x40556e
mov edi, ebx
jmp 0x4055be
cmp dword [ebp - 0x130], edi
je 0x4055be
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [esi], 0x103
mov ecx, dword [ebp - 0x130]
push 0x1f4
push ecx
call edi
mov edx, dword [ebp - 0x130]
push esi
push edx
call ebx
cmp dword [esi], 0x103
je 0x405588
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x4055be
xor edi, edi
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4055e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405607
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00425035
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405a60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f7e8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x453d50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x405aee
mov ecx, dword [ebp + 0xc]
cmp dword [ecx - 0xc], edi
je 0x405aee
mov eax, 1
sub eax, dword [ecx - 4]
mov ecx, dword [ecx - 8]
or ecx, eax
jge 0x405aae
push edi
lea ecx, [ebp + 0xc]
call fcn.00401ec0
mov eax, dword [ebp + 0xc]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
cmp esi, edi
je 0x405aee
cmp ebx, edi
je 0x405ac7
push ebx
jmp 0x405ac9
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, edi
je 0x405ae4
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405aee
mov ecx, dword [ebp + 8]
mov edi, 1
mov dword [ecx], esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405b14
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x405f10
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 0x448264
push 0x4582a0
mov esi, eax
call fcn.004024c0
xor edi, edi
add esp, 8
cmp dword [esi + 0x68], edi
je 0x405f39
call fcn.00406000
push str._______________BeginCheckThread________________r_n
push 0x4582a0
call fcn.004024c0
add esp, 8
push edi
push 4
push edi
push edi
push esi
push 0x406060
mov dword [ebp - 4], edi
mov dword [esi + 0x68], 1
call fcn.0041edee
mov dword [esi + 0x54], eax
mov dword [eax + 0x28], edi
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov edx, dword [esi + 0x54]
push 0x4ff
push 0xa
push 0
add edx, 0x2c
push edx
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 0x102
jne 0x405fb1
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x405ff4
add dword [ebp - 4], 0xa
jmp 0x405f84
cmp eax, 1
jne 0x405fef
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
call edi
test eax, eax
je 0x405fe9
lea edx, [ebp - 0x20]
push edx
call ebx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
call edi
test eax, eax
jne 0x405fc7
add dword [ebp - 4], 0xa
jmp 0x405f84
call fcn.00406000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4