joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bfd64
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405168
xor eax, eax
push ebp
push 0x5bfe74
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x5bfe48
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5bfe37
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
lea ecx, [ebp - 0x26]
lea edx, [ebp - 0x2a]
lea eax, [ebp - 0x2c]
call fcn.0040ce88
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x1e]
push eax
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x22]
lea eax, [ebp - 0x24]
call fcn.0040cbac
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
test eax, eax
je 0x5bfe21
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x5bfe21
mov edx, 0x12
mov eax, dword [ebp - 4]
call fcn.0040b218
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFileTime
test eax, eax
je 0x5bfe21
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5bfe3e
mov eax, dword [ebp - 0xc]
call fcn.0040b330
ret

Function at 0x5c008c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405168
xor eax, eax
push ebp
push 0x5c018f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov eax, dword [0x698260]
cmp dword [eax], 0
je 0x5c00ce
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x698260]
mov eax, dword [eax]
call eax
xor eax, eax
push ebp
push 0x5c010a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005bffe4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0
mov eax, dword [ebp - 4]
call fcn.00405178
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 8]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c012e
cmp byte [0x6e4f90], 0
je 0x5c0150
mov eax, dword [0x697b2c]
cmp dword [eax], 0
je 0x5c0179
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x697b2c]
mov eax, dword [eax]
call eax
jmp 0x5c0179
mov eax, dword [ebp - 4]
call fcn.0040b5ac
test al, al
jne 0x5c0162
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov eax, dword [0x697b2c]
cmp dword [eax], 0
je 0x5c0179
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x697b2c]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c0196
lea eax, [ebp - 4]
call fcn.00404cac
ret
Function at 0x5c0acc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
xor eax, eax
push ebp
push 0x5c0b9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov bl, 0x43
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.00404e8c
lea eax, [ebp - 0x2c]
mov edx, 0x5c0bb8
call fcn.00404f88
mov eax, dword [ebp - 0x2c]
call fcn.00405178
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x5c0b6e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
mov edx, ebx
call fcn.00404e8c
lea eax, [ebp - 0x30]
mov edx, 0x5c0bb8
call fcn.00404f88
mov eax, dword [ebp - 0x30]
call fcn.00405178
push eax
mov eax, dword [0x697ef8]
mov eax, dword [eax]
call eax
test eax, eax
je 0x5c0b6e
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
adc edx, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
inc ebx
cmp bl, 0x5b
jne 0x5c0af9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c0ba2
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00404cd0
ret
Function at 0x5c0f58
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405168
xor eax, eax
push ebp
push 0x5c1101
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x41c400]
call fcn.00403e50
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5c10b5
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov eax, 2
call fcn.00433d94
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5c10ab
mov eax, dword [ebp - 0xc]
push eax
push 0x5c0f28
call sub.user32.dll_EnumWindows
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, ebx
call fcn.00433db4
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x5c109d
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.00404f14
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.0040a7cc
mov eax, dword [ebp - 0x138]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 4]
call fcn.0040a7cc
mov edx, dword [ebp - 0x140]
pop eax
call fcn.004050c4
jne 0x5c108a
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [ebp - 0x12c]
je 0x5c108a
mov eax, dword [ebp - 0x12c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
jbe 0x5c108a
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0xc]
call fcn.0041f0a0
test eax, eax
jl 0x5c107c
inc dword [ebp - 8]
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle_1
lea edx, [ebp - 0x134]
mov eax, ebx
call fcn.00433dd4
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5c0ffa
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c10cb
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 0xc]
call fcn.00403e80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c1108
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00404cd0
lea eax, [ebp - 4]
call fcn.00404cac
ret

Function at 0x5c17b0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c1864
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404cac
xor eax, eax
push ebp
push 0x5c1838
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x400
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405304
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx]
call fcn.00405178
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, dword [ebx]
call fcn.00405178
call fcn.0040ba14
mov edx, eax
mov eax, ebx
call fcn.00405304
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.005c16b8
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00404d00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c184e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c186b
lea eax, [ebp - 8]
call fcn.00404cac
ret
Function at 0x5c1874
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c1918
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404cac
xor eax, eax
push ebp
push 0x5c18ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfd
lea eax, [ebp - 4]
mov edx, 0xfe
call fcn.00405304
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405178
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00405304
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.005c16b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c1902
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c191f
lea eax, [ebp - 4]
call fcn.00404cac
ret
Function at 0x5c2ac8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 4], 1
xor eax, eax
push ebp
push 0x5c2b21
push dword fs:[eax]
mov dword fs:[eax], esp
test edx, edx
je 0x5c2b17
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], ecx
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push 0x5c2a40
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c2b3e
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x5c31ac
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5c3220
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004053ec
mov dword [ebp - 8], 0xfd
lea eax, [ebp - 4]
mov edx, 0xfe
call fcn.004058f0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040557c
push eax
call sub.advapi32.dll_GetUserNameW
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004058f0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c3227
lea eax, [ebp - 4]
call fcn.004053ec
ret

Function at 0x5c3dc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405168
xor eax, eax
push ebp
push 0x5c3e33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f80
mov ebx, eax
mov eax, edi
mov edx, ebx
call fcn.00405304
mov esi, ebx
test esi, esi
jle 0x5c3e1d
mov ebx, 1
mov eax, edi
call fcn.004051d0
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 1]
xor dl, 0xfa
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x5c3e04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c3e3a
lea eax, [ebp - 4]
call fcn.00404cac
ret
Function at 0x10014d30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008843d
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
test esi, esi
je 0x10014e92
cmp byte [esi], 0
je 0x10014e92
push 7
push str.file:__
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x10014e92
mov dword [ebp - 0x24], vtable.pfc::string8_t_class_pfc::alloc_standard_.0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x20]
push 0x15
mov dword [ebp - 0x18], eax
call fcn.100205d0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0x15
mov dword [eax], 0x5c3f5c5c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], 4
mov byte [eax + 4], 0
push 0xffffffffffffffff
lea eax, [esi + 7]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x24]
call fcn.10020690
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x20]
ja 0x10014de9
mov eax, 0x10091798
push eax
lea ecx, [ebp - 0x14]
call fcn.1001fc10
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
test esi, esi
jne 0x10014e01
mov eax, 0x1009179c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10014e5b
and bl, 1
mov byte [ebp - 4], 3
test esi, esi
je 0x10014e2b
push 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0
call fcn.10020650
mov dword [ebp - 4], 4
cmp dword [ebp - 0x1c], 0
jbe 0x10014e49
push 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
call fcn.100205d0
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 5
test esi, esi
je 0x10014e74
push 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0
call fcn.10020650
mov dword [ebp - 4], 6
cmp dword [ebp - 0x1c], 0
jbe 0x10014e92
push 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
call fcn.100205d0
mov ecx, dword [ebp - 0xc]
xor al, al
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002d3c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
mov ebp, edx
mov esi, dword [edi + 0x88]
test esi, esi
je 0x1002d3f0
mov eax, dword [esp + 0x14]
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [edi + 0x88], eax
mov eax, dword [esi + 8]
and dword [esi + 0x10], 0
and dword [eax], 0
and dword [eax + 4], 0
jmp 0x1002d452
movzx eax, word [edi + 0x8c]
cdq
add eax, 0x28
adc edx, 0
push edx
push eax
call fcn.10023f26
pop ecx
pop ecx
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [ecx], esi
test esi, esi
jne 0x1002d43b
mov eax, dword [edi + 0x98]
lea ecx, [ebp - 1]
push esi
cdq
push ecx
push edx
push eax
call fcn.10086bc0
mov ecx, dword [edi + 0x3c]
push edx
mov edx, dword [esp + 0x14]
push eax
call fcn.100238b5
pop ecx
pop ecx
push 7
pop eax
jmp 0x1002d461
lea eax, [esi + 0x28]
mov dword [esi + 0x14], edi
mov dword [esi + 8], eax
push 0x20
pop eax
mov word [esi + 0x1c], ax
xor eax, eax
inc eax
mov word [esi + 0x1e], ax
mov eax, dword [esp + 0x10]
mov dword [esi + 4], eax
mov dword [esi + 0x18], ebp
inc dword [edi + 0x78]
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x10045f2d
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ebp, edx
mov dword [esp + 0x20], ebp
lea esi, [edi + 8]
cmp dword [edi + 0xc], ebx
jne 0x10045f74
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x1c]
call fcn.1003d4ec
mov ecx, eax
mov dword [edi + 0xc], ecx
test ecx, ecx
jne 0x10045f61
push 7
pop eax
jmp 0x10046057
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
mov ax, word [eax + 6]
mov word [ecx + 8], ax
mov eax, dword [edi + 0xc]
mov byte [eax + 0xb], bl
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
mov al, byte [eax + 0x3c]
cmp al, 1
jne 0x10045f8b
mov eax, 0x10045a07
jmp 0x10045f99
cmp al, 2
mov eax, 0x10045943
je 0x10045f99
mov eax, 0x10045903
push ebx
push 0x100
mov dword [edi + 0x20], eax
call fcn.10023f26
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10045f59
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x10046023
mov edx, dword [ebp + 4]
lea eax, [ecx + 4]
test edx, edx
je 0x10045fd3
cmp ecx, edx
jne 0x10045fcd
mov ebp, ebx
mov dword [esp + 0x14], ebx
jmp 0x10045fd9
mov ebp, dword [eax]
add ebp, edx
jmp 0x10045fd5
mov ebp, dword [eax]
mov dword [esp + 0x14], ebp
mov dword [eax], ebx
mov eax, ebx
mov edx, dword [esi]
test edx, edx
je 0x10046016
mov dword [esp + 0x1c], esi
mov ebp, eax
push edx
mov edx, ecx
mov ecx, edi
call fcn.10045eca
pop ecx
mov ecx, eax
inc ebp
mov eax, dword [esp + 0x1c]
mov dword [eax], ebx
lea eax, [esi + ebp*4]
mov edx, dword [eax]
mov dword [esp + 0x1c], eax
test edx, edx
jne 0x10045fe9
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi + eax*4], ecx
test ebp, ebp
mov ecx, ebp
mov ebp, dword [esp + 0x20]
jne 0x10045fb7
mov ebp, ebx
mov eax, dword [esi + ebp*4]
test eax, eax
je 0x1004603d
test ebx, ebx
je 0x1004603b
push eax
mov edx, ebx
mov ecx, edi
call fcn.10045eca
pop ecx
mov ebx, eax
inc ebp
cmp ebp, 0x40
jl 0x10046025
mov eax, dword [esp + 0x20]
push esi
mov dword [eax], ebx
call fcn.10023d7f
mov eax, dword [edi + 0xc]
pop ecx
movzx eax, byte [eax + 0xb]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x1004e437
Capabilities:
Reference sql statements

Disassembly:
push ebx
push esi
push edi
push dword [esp + 0x10]
mov esi, edx
mov ebx, str.sqlite_master
push esi
push ebx
push esi
mov edi, ecx
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push edi
call fcn.10051a0b
add esp, 0x18
cmp dword [esp + 0x10], 0
jne 0x1004e46f
push esi
push ebx
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push edi
call fcn.10051a0b
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x10085130
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008996d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x1008517a
mov eax, dword [ecx]
lea edx, [ebp - 0x38]
push edx
call dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 8]
call fcn.10085220
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100851a6
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, edi
mov ebx, eax
call fcn.100850c0
push 0
push 4
push edi
push 0x10085120
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x10085216
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp + 0x2c]
mov dword [edi + 4], esi
test ecx, ecx
je 0x10085203
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x28
call fcn.100850b0
int3

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x6c1415ae
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x2d992bb1
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4012e7
sub esp, 0x64
xor ebx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
call fcn.004a6ba0
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
add eax, 0x886e0900
adc edx, 0xfffffff1
mov esi, 0x3b9aca00
xor ebx, ebx
mov ebp, edx
or ebp, ebx
jne 0x4012d2
mul esi
mov esi, eax
mov ebp, edx
mov dword [esp + 0x48], edi
mov eax, edi
cdq
mov ebx, eax
mov ecx, edx
mov eax, esi
mov edx, ebp
add eax, ebx
adc edx, ecx
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0045e980
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov byte [esp + 0x60], al
lea eax, [esp + 0x50]
xor ebp, ebp
mov dword [eax], ebp
mov dword [eax + 4], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ebp
xchg ebp, ebx
mov byte [eax + 0x10], bl
xchg ebp, ebx
mov dword [esp + 0x2c], edx
mov dword [eax], edx
mov dword [esp + 0x30], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x28], eax
xor edi, edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov esi, edi
mov dword [esp + 0x3c], edi
xor eax, eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x68]
cmp eax, ebp
jge 0x40125f
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045ee80
mov esi, dword [esp + 0x3c]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0x70]
cmp ebx, ebp
jae 0x4012cb
mov ebp, dword [esp + 0x6c]
add ebp, ebx
movzx ebx, byte [ebp]
mov byte [esp + 0x23], bl
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ebx, eax
inc ebx
cmp ebx, esi
ja 0x40128f
mov edi, ebx
mov dword [esp + 0x38], ebx
mov ebx, ecx
add ebx, eax
movzx ebp, byte [esp + 0x23]
xchg ebp, eax
mov byte [ebx], al
xchg ebp, eax
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
mov ebp, dword [esp + 0x68]
cmp eax, ebp
jl 0x4011f6
mov dword [esp], 0
mov ebx, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call fcn.0043f220
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x78], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x7c], ebx
add esp, 0x64
ret
mov dword [esp], 0x5bd220
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
call fcn.0043b580
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, eax
inc edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], ecx
jmp 0x401241
call fcn.00427990
ud2
imul edx, esi
mov ebp, eax
imul ebp, ebx
add ebp, edx
mov edx, esi
mul edx
add edx, ebp
jmp 0x40116e
call fcn.0044ff60
jmp fcn.00401110
Function at 0x4091c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40934b
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
je 0x40933e
mov ebp, dword [eax]
cmp ebp, 0
je 0x40933e
movzx ebp, byte [eax + 4]
mov ebx, ebp
and ebx, 4
cmp bl, 0
je 0x409219
mov ebx, 0x5f6d83
mov dword [esp], ebx
mov dword [esp + 4], 0x21
call fcn.00429650
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 5]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jne 0x40929c
mov ecx, dword [eax + 0xc]
xor eax, eax
cmp eax, 8
jae 0x40924a
mov esi, eax
shl esi, 2
add esi, 8
mov ebx, ecx
add ebx, esi
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x18]
cmp ebx, ebp
je 0x409270
inc eax
cmp eax, 8
jb 0x40922e
mov eax, dword [esp + 0x10]
movzx ebp, word [eax + 0x34]
mov eax, ebp
sub eax, 4
mov ebx, ecx
add ebx, eax
mov ecx, dword [ebx]
xor ebp, ebp
cmp ecx, ebp
jne 0x409227
mov ebx, 0x6d0660
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
mov ebx, ecx
add ebx, eax
movzx ebp, byte [ebx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
je 0x409244
mov ebx, dword [esp + 0x10]
movzx ebp, byte [ebx + 0x32]
mov ebx, ebp
imul ebx, eax
add ebx, 0x28
mov eax, ebx
mov ebx, ecx
add ebx, eax
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
lea ebx, [esp + 0x18]
xor ebx, 0
mov dword [esp], ebx
mov ebp, dword [eax + 8]
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov ebp, dword [ebx + 0x20]
mov esi, dword [ebp + 0x10]
mov edx, dword [esi]
mov ebx, dword [edx]
call ebx
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 8]
movzx ecx, byte [edi + 5]
mov ebx, 1
cmp cl, 0x20
jae 0x40933a
shl ebx, cl
dec ebx
mov edx, ebx
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
imul eax, ebp
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [edi + 0x10]
xor ebp, ebp
cmp eax, ebp
je 0x409227
shr edx, 1
and edx, esi
mov ebx, dword [esp + 0x10]
movzx ebp, word [ebx + 0x34]
mov ebx, ebp
mov ebp, edx
imul ebp, ebx
mov edx, eax
add edx, ebp
movzx ebp, byte [edx]
xchg ebp, eax
cmp al, 0
xchg ebp, eax
jbe 0x409336
xchg ebp, eax
cmp al, 4
xchg ebp, eax
jae 0x409336
mov eax, 1
cmp al, 0
jne 0x409227
mov ecx, edx
jmp 0x409227
xor eax, eax
jmp 0x409326
xor ebx, ebx
jmp 0x4092d3
mov ebx, 0x6d0660
mov dword [esp + 0x1c], ebx
add esp, 0xc
ret
call fcn.0044ff60
jmp fcn.004091c0