joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e7fd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017d8c8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101d7c7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x100e81a4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100e8025
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x100e81a4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100e8043
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x100e81a4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100e8061
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x100e81a4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100e807f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x100e81a4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100e81a4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x100e80a4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x100e80d7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x100e80ef
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x100e812d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.100231f0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.10112ee0
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x101a1cdc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100e8fb0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100e815b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x100e8194
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x100e8194
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10010870
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.100109e0
lea ecx, [ebp - 0x28]
call fcn.100109e0
lea ecx, [ebp - 0x34]
call fcn.10057b60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100acb08
mov esp, ebp
pop ebp
ret 4
Function at 0x100e8b10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017da67
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x101d7c7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x100e8b5a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100e8b66
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.10012940
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x100e8bd3
push 0x48
call fcn.100ad0a9
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x100e8bc7
push 0x48
push 0
push ebx
call fcn.10112750
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.100e7630
jmp 0x100e8bc9
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100e8c00
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.10012940
push 3
push 0x101a1cdc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.100233c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100e8c4f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x100e8c9e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x100e8c9e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.10012940
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.100109e0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x100e8cd4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100e8cca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100e8d11
push edx
push ecx
call fcn.100acb1e
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x100e8cf3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100acb08
mov esp, ebp
pop ebp
ret 0x14
call fcn.1012fb57
int3
Function at 0x100e93d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017db98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x101d7c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100ad0a9
mov edi, eax
add esp, 4
test edi, edi
je 0x100e9473
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1008b10d
add esp, 4
mov dword [edi + 4], eax
jmp 0x100e9475
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.10020940
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x100e94d5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x100e94d5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x100e94f9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100e951b
cmp byte [ebp + 0xc], 0
je 0x100e9508
push esi
call fcn.1008c202
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x100e9527
mov esi, str.ios_base::badbit_set
jmp 0x100e9537
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.10023b80
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.10021280
push 0x101bb3d0
lea eax, [ebp - 0x30]
push eax
call fcn.101129e7
int3
Function at 0x100eb800
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101d7c7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x21c], ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x218], esi
test ebx, ebx
je 0x100eb9d0
cmp dword [ebx], 2
jne 0x100eb9d0
cmp dword [esi + 0x14], 8
jb 0x100eb846
mov esi, dword [esi]
mov dword [ebp - 0x218], esi
cmp dword [ebx + 0x10], 0
je 0x100eb860
xor esi, esi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100acb08
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100eb84c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100eb87b
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
test eax, eax
jne 0x100eb84c
mov ecx, dword [ebx + 0x20]
mov eax, 0x532ae21d
push edi
mov edi, dword [ebx + 0x1c]
mov esi, 1
sub ecx, edi
mov dword [ebp - 0x210], 0
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x100eb9bd
mov dword [ebp - 0x214], 0
nop dword [eax]
nop dword [eax + eax]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10112750
mov eax, dword [ebp - 0x214]
add esp, 0xc
add eax, 4
add eax, edi
push eax
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100eb900
sub eax, edx
xor ecx, ecx
sar eax, 1
je 0x100eb93e
lea ebx, [ecx + 0x5c]
nop word [eax + eax]
cmp word [ebp + ecx*2 - 0x20c], 0x2f
jne 0x100eb933
mov word [ebp + ecx*2 - 0x20c], bx
inc ecx
cmp ecx, eax
jb 0x100eb920
mov ebx, dword [ebp - 0x21c]
mov eax, dword [ebx + 0x1c]
mov edi, dword [ebp - 0x214]
mov eax, dword [eax + edi]
test byte [eax + 0x26], 0x10
je 0x100eb961
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
jmp 0x100eb986
test esi, esi
je 0x100eb984
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
push dword [ebp - 0x210]
call fcn.100ebbe0
test eax, eax
je 0x100eb984
mov esi, 1
jmp 0x100eb986
xor esi, esi
mov ecx, dword [ebx + 0x20]
add edi, 0x314
inc dword [ebp - 0x210]
mov eax, 0x532ae21d
mov dword [ebp - 0x214], edi
mov edi, dword [ebx + 0x1c]
sub ecx, edi
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp dword [ebp - 0x210], ecx
jb 0x100eb8c0
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100acb08
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.100acb08
mov esp, ebp
pop ebp
ret
Function at 0x100ec330
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017dd4f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101d7c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x58
call fcn.100ad0a9
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x100ec387
push 0x58
push 0
push esi
call fcn.10112750
add esp, 0xc
mov ecx, esi
call fcn.100e9fb0
mov esi, eax
jmp 0x100ec389
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 8
jb 0x100ec39b
mov edi, dword [edi]
test edi, edi
je 0x100ec438
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100ec438
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x100ec438
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x100ec438
push 0
push 0
push 0
push 2
push 0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 4], 0
mov dword [esi + 8], eax
je 0x100ec438
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x100ec438
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.100eb1e0
test eax, eax
je 0x100ec438
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100ec44e
mov ecx, esi
call fcn.100ea130
push 0x58
push esi
call fcn.100acb1e
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100edbd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x100edccf
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100edccf
or eax, 0xffffffff
cmp esi, 8
jb 0x100edca7
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101a3750]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101a3750]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101a3750]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101a3750]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101a3750]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101a3750]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101a3750]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101a3750]
sub edi, 1
jne 0x100edc00
pop edi
test esi, esi
je 0x100edcca
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101a3750]
sub esi, 1
jne 0x100edcb0
not eax
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100f444b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x101561e5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10155dea

Function at 0x101561f0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10155f6b

Function at 0x1015d179
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1015c951

Function at 0x1015d184
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1015cb8c

Function at 0x101666fa
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10166481
Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001d102
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001d102
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x4465e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
call fcn.004452a0
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x446610
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x47cab7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047c69e

Function at 0x47cac2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047c828

Function at 0x486a6c
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00486940

Function at 0x48937a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00488d3c

Function at 0x10001930
Capabilities:
Query or enumerate registry value

Disassembly:
cmp dword [0x10007334], 0
jne 0x10001948
mov dword [0x10007334], 1
jmp fcn.10004e04
ret

Function at 0x10001949
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call fcn.10001958

Function at 0x100055c0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x100055d6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x100055f1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x40d29e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407ccb
mov dword [ebp - 0x14], eax
cmp dword [0x446ad8], esi
jne 0x40d391
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d31e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d471
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d471
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d471
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x446ad8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x446adc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x446ae0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x446ae8], eax
test eax, eax
je 0x40d38e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x446ae4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d3b6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d3a9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d3cb
push 4
pop eax
jmp 0x40d473
cmp dword [ebp - 0x14], esi
je 0x40d3cb
push dword [0x446ad8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d3b0
mov eax, dword [0x446ae4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d429
cmp dword [0x446ae8], edi
je 0x40d429
push eax
call ebx
push dword [0x446ae8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d429
test eax, eax
je 0x40d429
call ecx
test eax, eax
je 0x40d41e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d41e
test byte [ebp - 8], 1
jne 0x40d429
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d459
mov eax, dword [0x446adc]
cmp eax, edi
je 0x40d456
push eax
call ebx
test eax, eax
je 0x40d456
call eax
mov esi, eax
test esi, esi
je 0x40d456
mov eax, dword [0x446ae0]
cmp eax, edi
je 0x40d456
push eax
call ebx
test eax, eax
je 0x40d456
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x446ad8]
call ebx
test eax, eax
je 0x40d471
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d473
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004043de
mov esp, ebp
pop ebp
ret
Function at 0x4827f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov edx, 0x811c9dc5
lea esi, [eax + eax]
test esi, esi
je 0x482822
push edi
mov edi, dword [ebp + 8]
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x482810
pop edi
mov eax, edx
pop esi
pop ebp
ret
Function at 0x487060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x71cb20
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x83e264]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0051dec4
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0051a5de
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49b700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x71f910
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x83e264]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 8], xmm0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov edx, 0x49c8f0
mov byte [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0049d1e0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
push 0
push dword [ebp - 0x10]
push 0x49d210
push 0
push 0
call fcn.00532bb0
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x49b7ab
cmp dword [esi + 0xc], 0
jne 0x49b7b9
mov eax, dword [ebp - 0x18]
mov dword [esi + 0xc], eax
mov eax, esi
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x18], 0
call fcn.0051b121
call fcn.00532a18
int3