joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51c82c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
xor eax, eax
push ebp
push 0x51c925
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x51c900
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x24]
call fcn.004047cc
mov dl, 0x2f
mov eax, dword [ebp - 8]
call fcn.004d319c
mov ebx, eax
test ebx, ebx
jle 0x51c88d
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.004049f4
mov ecx, eax
sub ecx, ebx
inc ecx
lea edx, [ebx + 1]
mov eax, dword [ebp - 8]
call fcn.00404c54
lea edx, [ebp - 0x10]
mov eax, dword [0x5247fc]
mov eax, dword [eax]
call fcn.0046cfac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409b04
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.00404a40
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004cf680
test al, al
je 0x51c8f6
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, 0x51c93c
call fcn.004d330c
push 1
push 0x51c94c
push 0x51c94c
mov eax, dword [ebp - 4]
call fcn.00404bf4
push eax
push 0x51c950
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51c90a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51c92c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404758
ret
Function at 0x10001520
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x100c520c]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x180
push 8
push 0
push eax
mov dword [esp + 0x20], eax
call ebx
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10001568
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10067217
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
lea esi, [edi + 0x70]
mov dword [edi], 0
mov byte [edi + 4], 8
mov byte [esi + 0x34], 0x21
mov byte [edi + 5], 1
mov byte [esi + 0x36], 0
mov dword [edi + 0xc], esi
mov dword [edi + 0x1c], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x24], 1
mov dword [edi + 0x34], 0
mov word [edi + 0x28], 0x100
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x38], 0
mov byte [edi + 6], 0
mov dword [edi + 0x44], 0
mov dword [esi + 4], eax
lea eax, [esp + 0x10]
push 0
mov dword [esi], ebx
mov dword [esi + 0x9c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x100b4928
mov dword [esp + 0x24], fcn.10001520
call fcn.100727c3
mov edx, eax
add esp, 4
xor edx, 0x10
mov ebx, 0x10
movzx ecx, byte [esp + ebx + 0x13]
mov eax, edx
shl eax, 5
dec ebx
add ecx, eax
mov eax, edx
shr eax, 2
add ecx, eax
xor edx, ecx
cmp ebx, 1
jae 0x10001613
mov dword [esi + 0x30], edx
lea eax, [esi + 0x68]
mov dword [esi + 0x78], eax
mov edx, 0x10001260
mov dword [esi + 0x7c], eax
mov ecx, edi
mov byte [esi + 0x37], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 0x7ff7a500
mov dword [esi + 0x80], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0xa0], 0
mov byte [esi + 0x35], 5
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 8], 0x180
mov dword [esi + 0xc], 0
mov dword [esi + 0x8c], 0xc8
mov dword [esi + 0x90], 0xc8
mov dword [esi + 0x94], 0xc8
push 0
mov dword [esi + 0xec], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
call fcn.10009250
add esp, 4
test eax, eax
je 0x10001777
mov ecx, edi
call fcn.100013e0
xor edi, edi
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10067217
mov esp, ebp
pop ebp
ret
Function at 0x10006830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, esi
mov eax, esi
xor eax, dword [ebp + 8]
shr edi, 5
inc edi
cmp esi, edi
jb 0x1000686b
nop dword [eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x10006850
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10008040
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
movzx eax, byte [esi + 4]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x1000805d.11
movzx eax, byte [eax + 0x100081ec]
jmp dword [eax*4 + 0x100081c4]
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0xc]
shl eax, 2
push 0
push eax
call fcn.1000a130
mov eax, dword [esi + 0x38]
mov ecx, edi
mov edx, dword [esi + 0x10]
shl eax, 2
push 0
push eax
call fcn.1000a130
mov eax, dword [esi + 0x2c]
mov ecx, edi
mov edx, dword [esi + 8]
shl eax, 3
push 0
push eax
call fcn.1000a130
mov eax, dword [esi + 0x34]
mov ecx, edi
mov edx, dword [esi + 0x14]
shl eax, 2
push 0
push eax
call fcn.1000a130
mov eax, dword [esi + 0x3c]
mov ecx, edi
mov edx, dword [esi + 0x18]
push 0
lea eax, [eax + eax*2]
shl eax, 2
push eax
call fcn.1000a130
mov eax, dword [esi + 0x28]
mov ecx, edi
mov edx, dword [esi + 0x1c]
shl eax, 3
push 0
push eax
call fcn.1000a130
push 0
push 0x50
mov edx, esi
mov ecx, edi
call fcn.1000a130
add esp, 0x38
pop edi
pop esi
ret
movzx eax, byte [esi + 6]
push 0
lea eax, [eax*4 + 0x10]
push eax
call fcn.1000a130
add esp, 8
pop edi
pop esi
ret
movzx eax, byte [esi + 6]
push 0
lea eax, [eax*8 + 0x10]
push eax
call fcn.1000a130
add esp, 8
pop edi
pop esi
ret
pop edi
pop esi
jmp 0x1000c870
mov edx, dword [esi + 0x10]
cmp edx, 0x100b4808
je 0x1000814b
mov cl, byte [esi + 7]
mov eax, 1
shl eax, cl
mov ecx, edi
push 0
lea eax, [eax + eax*2]
shl eax, 3
push eax
call fcn.1000a130
add esp, 8
mov eax, dword [esi + 0x1c]
mov ecx, edi
mov edx, dword [esi + 0xc]
shl eax, 3
push 0
push eax
call fcn.1000a130
push 0
push 0x20
mov edx, esi
mov ecx, edi
call fcn.1000a130
add esp, 0x10
pop edi
pop esi
ret
mov edx, dword [esi + 0x1c]
mov ecx, esi
call fcn.1000c8a0
mov ecx, esi
call fcn.10001210
push 0
push 0x70
mov edx, esi
mov ecx, edi
call fcn.1000a130
add esp, 8
pop edi
pop esi
ret
mov eax, dword [esi + 0x10]
add eax, 0x18
push 0
push eax
call fcn.1000a130
add esp, 8
pop edi
pop esi
ret
mov eax, dword [edi + 0xc]
dec dword [eax + 0x1c]
mov eax, dword [esi + 0xc]
add eax, 0x11
push 0
push eax
call fcn.1000a130
add esp, 8
pop edi
pop esi
ret
push edi
mov edi, ecx
lea ecx, [edx + 0x10]
cmp dword [edx + 8], ecx
je 0x1000c88d
mov eax, dword [ecx]
push esi
mov esi, dword [edx + 0x14]
mov dword [esi + 0x10], eax
mov ecx, dword [ecx]
mov eax, dword [edx + 0x14]
pop esi
mov dword [ecx + 0x14], eax
push 0
push 0x18
mov ecx, edi
call fcn.1000a130
add esp, 8
pop edi
ret
Function at 0x10009980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, dword [ebx + 0x10]
lea eax, [ebx + 0x48]
cmp esi, eax
je 0x10009b4b
nop dword [eax]
mov al, byte [esi + 0x12]
test al, 1
jne 0x100099fc
mov ecx, esi
test al, 0x10
je 0x100099bb
and al, 0xef
mov byte [esi + 0x12], al
mov eax, dword [esi + 0x20]
mov ecx, dword [ebx + 0x10]
mov dword [ebx + 0x44], eax
cmp word [esi + 0x10], 0xffff
jne 0x100099cd
mov eax, dword [ebx + 8]
cmp dword [ecx + 4], eax
jae 0x100099cd
mov dword [ecx + 4], eax
mov al, byte [esi + 0x12]
test al, 0x20
jne 0x100099d8
mov byte [esi + 0x25], 1
and al, 0xcf
or al, 8
mov byte [esi + 0x12], al
mov eax, dword [esi + 0x1c]
push ebx
call eax
mov edx, dword [ebx + 8]
add esp, 4
shl eax, 3
mov ecx, ebx
sub edx, eax
call fcn.10009850
jmp 0x10009b3d
mov eax, dword [esi + 0x1c]
mov edi, dword [esi + 0x18]
mov dword [esp + 0x10], edi
mov ecx, dword [eax - 4]
mov edx, ecx
and edx, 0x3f
mov dword [esp + 0x14], ecx
lea eax, [edx - 6]
cmp eax, 0x1c
ja case.0x10009a25.8
movzx eax, byte [eax + 0x10009b6c]
jmp dword [eax*4 + 0x10009b54]
add dword [ebx + 8], 0xfffffff8
mov edx, dword [ebx + 8]
shr ecx, 6
movzx ecx, cl
mov eax, dword [edx]
mov dword [edi + ecx*8], eax
mov eax, dword [edx + 4]
mov dword [edi + ecx*8 + 4], eax
jmp case.0x10009a25.8
mov eax, dword [ebx + 8]
mov edi, dword [eax - 4]
cmp edi, 0x7ff7a500
je 0x10009a6d
cmp edi, 0x7ff7a501
jne 0x10009a66
cmp dword [eax - 8], 0
je 0x10009a6d
mov edi, 1
jmp 0x10009a6f
xor edi, edi
add eax, 0xfffffff8
mov dword [ebx + 8], eax
cmp edx, 0x1a
jne 0x10009aa2
mov eax, ecx
mov ecx, dword [esp + 0x10]
shr eax, 0x17
push 0xe
lea edx, [ecx + eax*8]
mov ecx, ebx
call fcn.1000bf00
mov ecx, dword [esp + 0x18]
add esp, 4
cmp dword [eax + 4], 0x7ff7a500
jne 0x10009aa2
xor edi, 1
shr ecx, 6
movzx eax, cl
cmp edi, eax
je case.0x10009a25.8
add dword [esi + 0x1c], 4
jmp case.0x10009a25.8
mov edx, dword [ebx + 8]
mov eax, ecx
shr eax, 0x17
sub edx, 8
mov dword [esp + 0x10], edx
lea eax, [eax*8 + 8]
sub dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub eax, edi
sar eax, 3
mov dword [esp + 0x10], eax
mov eax, dword [edx]
mov edi, dword [esp + 0x10]
mov dword [edx - 0x10], eax
mov eax, dword [edx + 4]
mov dword [edx - 0xc], eax
cmp edi, 1
jle 0x10009b07
lea eax, [edx - 8]
mov ecx, ebx
mov edx, edi
mov dword [ebx + 8], eax
call fcn.1000d3f0
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x18]
shr ecx, 6
movzx edi, cl
mov ecx, dword [ebx + 8]
mov eax, dword [ecx - 8]
mov dword [edx + edi*8], eax
mov eax, dword [ecx - 4]
mov dword [edx + edi*8 + 4], eax
jmp case.0x10009a25.34
and ecx, 0x7fc000
cmp ecx, 0x4000
jb case.0x10009a25.8
mov eax, dword [esi + 4]
mov dword [ebx + 8], eax
mov ecx, ebx
call fcn.1000db90
mov esi, dword [ebx + 0x10]
lea eax, [ebx + 0x48]
cmp esi, eax
jne 0x100099a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009a2c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, dword [ebx + 0x10]
lea eax, [ebx + 0x48]
cmp esi, eax
je 0x10009b4b
nop dword [eax]
mov al, byte [esi + 0x12]
test al, 1
jne 0x100099fc
mov ecx, esi
test al, 0x10
je 0x100099bb
and al, 0xef
mov byte [esi + 0x12], al
mov eax, dword [esi + 0x20]
mov ecx, dword [ebx + 0x10]
mov dword [ebx + 0x44], eax
cmp word [esi + 0x10], 0xffff
jne 0x100099cd
mov eax, dword [ebx + 8]
cmp dword [ecx + 4], eax
jae 0x100099cd
mov dword [ecx + 4], eax
mov al, byte [esi + 0x12]
test al, 0x20
jne 0x100099d8
mov byte [esi + 0x25], 1
and al, 0xcf
or al, 8
mov byte [esi + 0x12], al
mov eax, dword [esi + 0x1c]
push ebx
call eax
mov edx, dword [ebx + 8]
add esp, 4
shl eax, 3
mov ecx, ebx
sub edx, eax
call fcn.10009850
jmp 0x10009b3d
mov eax, dword [esi + 0x1c]
mov edi, dword [esi + 0x18]
mov dword [esp + 0x10], edi
mov ecx, dword [eax - 4]
mov edx, ecx
and edx, 0x3f
mov dword [esp + 0x14], ecx
lea eax, [edx - 6]
cmp eax, 0x1c
ja case.0x10009a25.8
movzx eax, byte [eax + 0x10009b6c]
jmp dword [eax*4 + 0x10009b54]
add dword [ebx + 8], 0xfffffff8
mov edx, dword [ebx + 8]
shr ecx, 6
movzx ecx, cl
mov eax, dword [edx]
mov dword [edi + ecx*8], eax
mov eax, dword [edx + 4]
mov dword [edi + ecx*8 + 4], eax
jmp case.0x10009a25.8
mov eax, dword [ebx + 8]
mov edi, dword [eax - 4]
cmp edi, 0x7ff7a500
je 0x10009a6d
cmp edi, 0x7ff7a501
jne 0x10009a66
cmp dword [eax - 8], 0
je 0x10009a6d
mov edi, 1
jmp 0x10009a6f
xor edi, edi
add eax, 0xfffffff8
mov dword [ebx + 8], eax
cmp edx, 0x1a
jne 0x10009aa2
mov eax, ecx
mov ecx, dword [esp + 0x10]
shr eax, 0x17
push 0xe
lea edx, [ecx + eax*8]
mov ecx, ebx
call fcn.1000bf00
mov ecx, dword [esp + 0x18]
add esp, 4
cmp dword [eax + 4], 0x7ff7a500
jne 0x10009aa2
xor edi, 1
shr ecx, 6
movzx eax, cl
cmp edi, eax
je case.0x10009a25.8
add dword [esi + 0x1c], 4
jmp case.0x10009a25.8
mov edx, dword [ebx + 8]
mov eax, ecx
shr eax, 0x17
sub edx, 8
mov dword [esp + 0x10], edx
lea eax, [eax*8 + 8]
sub dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub eax, edi
sar eax, 3
mov dword [esp + 0x10], eax
mov eax, dword [edx]
mov edi, dword [esp + 0x10]
mov dword [edx - 0x10], eax
mov eax, dword [edx + 4]
mov dword [edx - 0xc], eax
cmp edi, 1
jle 0x10009b07
lea eax, [edx - 8]
mov ecx, ebx
mov edx, edi
mov dword [ebx + 8], eax
call fcn.1000d3f0
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x18]
shr ecx, 6
movzx edi, cl
mov ecx, dword [ebx + 8]
mov eax, dword [ecx - 8]
mov dword [edx + edi*8], eax
mov eax, dword [ecx - 4]
mov dword [edx + edi*8 + 4], eax
jmp case.0x10009a25.34
and ecx, 0x7fc000
cmp ecx, 0x4000
jb case.0x10009a25.8
mov eax, dword [esi + 4]
mov dword [ebx + 8], eax
mov ecx, ebx
call fcn.1000db90
mov esi, dword [ebx + 0x10]
lea eax, [ebx + 0x48]
cmp esi, eax
jne 0x100099a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, edx
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [edi], ecx
movzx eax, byte [ecx]
test byte [eax + 0x100b5021], 8
je 0x1000c161
movzx eax, byte [ecx + 1]
inc ecx
test byte [eax + 0x100b5021], 8
jne 0x1000c153
mov al, byte [ecx]
cmp al, 0x2d
jne 0x1000c171
inc ecx
mov dword [ebp - 0x14], 1
jmp 0x1000c179
cmp al, 0x2b
jne 0x1000c176
inc ecx
mov dword [ebp - 0x14], esi
cmp byte [ecx], 0x30
jne 0x1000c26d
mov al, byte [ecx + 1]
cmp al, 0x78
je 0x1000c191
cmp al, 0x58
jne 0x1000c26d
add ecx, 2
lea edx, [ebp - 0x10]
mov dword [ebp - 8], ecx
xorps xmm1, xmm1
lea ecx, [ebp - 8]
call fcn.1000c0c0
mov edx, dword [ebp - 8]
cmp byte [edx], 0x2e
jne 0x1000c1c2
inc edx
movaps xmm1, xmm0
mov dword [ebp - 8], edx
lea edx, [ebp - 0xc]
call fcn.1000c0c0
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
cmp dword [ebp - 0x10], 0
jne 0x1000c1d0
test esi, esi
je 0x1000c26d
neg esi
mov dword [edi], edx
mov al, byte [edx]
shl esi, 2
cmp al, 0x70
je 0x1000c1e1
cmp al, 0x50
jne 0x1000c23c
mov al, byte [edx + 1]
inc edx
xor ecx, ecx
cmp al, 0x2d
jne 0x1000c1f5
inc edx
mov dword [ebp - 0x10], 1
jmp 0x1000c1fd
cmp al, 0x2b
jne 0x1000c1fa
inc edx
mov dword [ebp - 0x10], ecx
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x100b5021], 2
je 0x1000c23e
nop
movsx eax, byte [ebp - 1]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x100b5021], 2
jne 0x1000c210
mov eax, ecx
neg eax
cmp dword [ebp - 0x10], 0
cmove eax, ecx
add esi, eax
mov dword [edi], edx
cmp dword [ebp - 0x14], 0
je 0x1000c24b
xorps xmm0, xmmword [0x100b7000]
push esi
sub esp, 8
movsd qword [esp], xmm0
call fcn.1007606c
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
xorps xmm0, xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001daa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
mov ebx, ecx
mov dword [esp + 0x1c], edx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 1
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 8]
sub ecx, dword [eax]
sub ecx, 8
sar ecx, 3
sub ecx, edi
je 0x1001dccc
mov edx, dword [ebx + 0x10]
dec ecx
mov dword [esp + 0x2c], ecx
test edi, edi
jle 0x1001db2f
mov eax, dword [edx]
lea ecx, [eax + edi*8]
cmp ecx, dword [ebx + 8]
jb 0x1001db6e
lea eax, [esp + 0x28]
push eax
push edi
push ebx
call fcn.10002080
add esp, 0xc
test eax, eax
je 0x1001dcd8
test esi, esi
je 0x1001dc6d
push dword [esp + 0x24]
mov esi, dword [esp + 0x2c]
push esi
push 1
push eax
call fcn.100711f0
add esp, 0x10
cmp eax, esi
jne 0x1001dc6d
mov esi, 1
jmp 0x1001dc6f
cmp edi, 0xfff0b9d8
jle 0x1001db3f
mov eax, dword [ebx + 8]
lea ecx, [eax + edi*8]
jmp 0x1001db6e
jne 0x1001db49
mov ecx, dword [ebx + 0xc]
add ecx, 0x28
jmp 0x1001db6e
mov eax, dword [edx]
mov ecx, 0xfff0b9d8
sub ecx, edi
cmp dword [eax + 4], 0x7ff7a516
je 0x1001daea
mov edx, dword [eax]
movzx eax, byte [edx + 6]
cmp ecx, eax
jg 0x1001daea
add edx, 8
lea ecx, [edx + ecx*8]
mov edx, dword [ebx + 0x10]
cmp ecx, 0x100b4928
je 0x1001daea
mov ecx, dword [ecx + 4]
mov eax, ecx
and eax, 0x7fffff00
cmp eax, 0x7ff7a500
mov eax, 3
cmovne ecx, eax
and ecx, 0xf
cmp cl, al
jne 0x1001daea
test esi, esi
je 0x1001dc6d
test edi, edi
jle 0x1001dbba
mov eax, dword [edx]
mov ecx, 0x100b4928
lea eax, [eax + edi*8]
cmp eax, dword [ebx + 8]
cmovb ecx, eax
jmp 0x1001dbfb
cmp edi, 0xfff0b9d8
jle 0x1001dbca
mov eax, dword [ebx + 8]
lea ecx, [eax + edi*8]
jmp 0x1001dbfb
jne 0x1001dbd4
mov ecx, dword [ebx + 0xc]
add ecx, 0x28
jmp 0x1001dbfb
mov edx, dword [edx]
mov ecx, 0xfff0b9d8
sub ecx, edi
cmp dword [edx + 4], 0x7ff7a516
je 0x1001dbf6
mov edx, dword [edx]
movzx eax, byte [edx + 6]
cmp ecx, eax
jg 0x1001dbf6
inc ecx
lea ecx, [edx + ecx*8]
jmp 0x1001dbfb
mov ecx, 0x100b4928
mov edx, dword [ecx + 4]
mov eax, edx
and eax, 0x7fffff00
cmp eax, 0x7ff7a500
jne 0x1001dc48
or edx, 0x70
cmp edx, 0x7ff7a574
jne 0x1001dcc7
mov edx, dword [ecx]
lea eax, [esp + 0x30]
push eax
lea ecx, [edx + 0x10]
mov edx, dword [edx + 0xc]
call fcn.1000c280
add esp, 4
test eax, eax
je 0x1001dcc7
movsd xmm0, qword [esp + 0x30]
lea ecx, [esp + 0x38]
movsd qword [esp + 0x38], xmm0
movsd xmm0, qword [ecx]
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x30]
call fcn.100037e0
add esp, 0x10
test eax, eax
jg 0x1001db25
xor esi, esi
mov ecx, dword [esp + 0x2c]
inc edi
test ecx, ecx
jne 0x1001dad0
test esi, esi
jne 0x1001dccc
call fcn.10071623
mov esi, dword [eax]
mov eax, dword [ebx + 8]
push esi
mov dword [eax + 4], 0x7ff7a500
add dword [ebx + 8], 8
call fcn.10072b23
add esp, 4
push eax
push ebx
call fcn.100022e0
mov ecx, dword [ebx + 8]
add esp, 8
movd xmm0, esi
mov eax, 3
cvtdq2pd xmm0, xmm0
movsd qword [ecx], xmm0
add dword [ebx + 8], 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
jmp 0x1001dc4c
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 4
mov edx, edi
mov ecx, ebx
call fcn.10004060
int3
Function at 0x10028fa0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100c520c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 0
push 0
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret

Function at 0x10029b40
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10096f1c
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x100c520c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x228], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x220]
push 0x208
push 0
push eax
call fcn.10069900
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
add esp, 0xc
mov dword [ebp - 0x22c], eax
mov ecx, eax
mov dword [ebp - 0x14], 0
call fcn.1002a410
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 0x10
push dword [ebp + 0x1c]
cmovae eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.1006ed90
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0x100297a0
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [ebp - 0x221]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10028340
mov byte [ebp - 4], 5
mov dword [ebp - 0x228], 1
mov byte [ebp - 4], 1
lea eax, [ebp - 0x18]
mov dword [ebp - 0x22c], eax
mov byte [ebp - 4], 9
mov ecx, eax
call fcn.1002a7d0
mov byte [ebp - 4], 1
push 0x14
push dword [ebp - 0x18]
call fcn.100671fb
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.10028c90
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret
Function at 0x10031630
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100c520c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1009ff64
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x100c6478], eax
test eax, eax
jne 0x100316b4
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push 0x1009ff70
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x310]
push 0x10
push str.AheadLib
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10031843
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1009fd9c
push eax
call esi
push 0x1009fdb0
push dword [0x100c6478]
mov dword [0x100c6420], eax
call esi
push 0x1009fdcc
push dword [0x100c6478]
mov dword [0x100c6424], eax
call esi
push 0x1009fde4
push dword [0x100c6478]
mov dword [0x100c6428], eax
call esi
push 0x1009fdfc
push dword [0x100c6478]
mov dword [0x100c642c], eax
call esi
push 0x1009fe0c
push dword [0x100c6478]
mov dword [0x100c6430], eax
call esi
push 0x1009fe20
push dword [0x100c6478]
mov dword [0x100c6434], eax
call esi
push 0x1009fe2c
push dword [0x100c6478]
mov dword [0x100c6438], eax
call esi
push 0x1009fe40
push dword [0x100c6478]
mov dword [0x100c643c], eax
call esi
push 0x1009fe58
push dword [0x100c6478]
mov dword [0x100c6440], eax
call esi
push 0x1009fe6c
push dword [0x100c6478]
mov dword [0x100c6444], eax
call esi
push 0x1009fe84
push dword [0x100c6478]
mov dword [0x100c6448], eax
call esi
push 0x1009fe9c
push dword [0x100c6478]
mov dword [0x100c644c], eax
call esi
push 0x1009feb4
push dword [0x100c6478]
mov dword [0x100c6450], eax
call esi
push 0x1009fecc
push dword [0x100c6478]
mov dword [0x100c6454], eax
call esi
push 0x1009fedc
push dword [0x100c6478]
mov dword [0x100c6458], eax
call esi
push 0x1009fef0
push dword [0x100c6478]
mov dword [0x100c645c], eax
call esi
push 0x1009ff04
push dword [0x100c6478]
mov dword [0x100c6460], eax
call esi
push 0x1009ff14
push dword [0x100c6478]
mov dword [0x100c6464], eax
call esi
push 0x1009ff28
push dword [0x100c6478]
mov dword [0x100c6468], eax
call esi
push 0x1009ff3c
push dword [0x100c6478]
mov dword [0x100c646c], eax
call esi
push 0x1009ff50
push dword [0x100c6478]
mov dword [0x100c6470], eax
call esi
mov dword [0x100c6474], eax
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [0x100c6478], eax
setne al
xor ecx, ebp
call fcn.10067217
mov esp, ebp
pop ebp
ret