joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439bb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
push eax
push 0
push 0x439a00
call fcn.00421f0c
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x43ae60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c86d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x44b19c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 3
push 0x8c
call fcn.00421bf8
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x43aeaf
mov ecx, dword [ebp - 0x1c]
call fcn.0041b610
mov dword [ebp - 0x20], eax
jmp 0x43aeb6
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
lea edx, [ebp + 0x24]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x1c
call fcn.00403140
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00403140
lea ecx, [ebp + 0x40]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x38
call fcn.00403140
lea edx, [ebp + 0x5c]
push edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x70
call fcn.00403140
call fcn.00439330
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x54
call fcn.00403140
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0x43aa60
call fcn.00421f0c
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.00401fe0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x24]
call fcn.00401fe0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x40]
call fcn.00401fe0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x5c]
call fcn.00401fe0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10001b00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
mov bl, byte [eax + 2]
mov byte [ebp - 1], bl
movzx eax, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x10003d54
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xb4
mov eax, 0x10021f1d
call fcn.100092e5
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
push eax
movzx eax, cx
push eax
push dword [0x10033c44]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push dword [0x10033c44]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push dword [0x10033c44]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0xb0
mov esi, eax
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.1000b5f0
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp + 0x20]
cmovae ecx, dword [ebp + 0x20]
push ecx
lea ecx, [ebp - 0xc0]
call fcn.1000639b
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xc0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xc0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xc4], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x70], 0
je 0x10003e22
push 0
push edi
push esi
lea ecx, [ebp - 0xc0]
call fcn.10006521
lea ecx, [ebp - 0xc0]
call fcn.10006328
lea ecx, [ebp - 0xc0]
call fcn.10003e43
lea ecx, [ebp + 8]
call fcn.10006d41
lea ecx, [ebp + 0x20]
call fcn.10006d41
call fcn.100092a3
ret

Function at 0x10003ea7
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10032068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 2
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x10003f15
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
push 0x1002e2b0
push 1
push esi
push 0x1002e388
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10003f0f
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
push edx
push 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
cmp word [ebp - 8], si
je 0x10003f06
mov eax, dword [ebp - 0xc]
push esi
push 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10008b95
leave
ret
Function at 0x10003f84
Capabilities:
Enumerate processes

Disassembly:
push 0x23c
mov eax, 0x10021f6e
call fcn.100092e5
mov edi, ecx
mov dword [ebp - 0x240], edi
xor eax, eax
mov dword [ebp - 4], eax
push eax
mov dword [ebp - 0x248], edi
push 2
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10004011
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x10003ff8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x234], eax
je 0x10003ffe
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10003fdc
jmp 0x1000400a
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x240], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov dword [edi + 0x14], 7
xor eax, eax
mov dword [edi], ecx
mov dword [edi + 0x10], ecx
mov word [edi], ax
push ecx
mov dword [ebp - 4], ecx
push 2
mov dword [ebp - 0x244], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x100040a0
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x10004077
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x234], eax
je 0x1000407d
lea eax, [ebp - 0x23c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1000405b
jmp 0x10004099
lea eax, [ebp - 0x218]
push eax
call fcn.1000e66d
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.10006c73
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.100092a3
ret

Function at 0x100040a8
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10032068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x228
xor esi, esi
lea eax, [ebp - 0x22c]
push esi
push eax
mov ebx, ecx
call fcn.1000b5f0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1000411d
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.1000d302
pop ecx
pop ecx
test eax, eax
je 0x10004123
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100040fc
jmp 0x10004129
mov esi, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008b95
leave
ret
Function at 0x1000413a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10032068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10004166
xor al, al
jmp 0x100041b9
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x10004187
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10004162
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
push esi
push esi
push 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1000417c
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10008b95
leave
ret
Function at 0x10004512
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x10032068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
pop ecx
mov esi, str.360Tray.exe
lea edi, [ebp - 0x1d0]
rep movsd dword es:[edi], dword [esi]
push 0x1aa
xor esi, esi
lea eax, [ebp - 0x1b8]
push esi
push eax
call fcn.1000b5f0
add esp, 0xc
lea ecx, [ebp - 0x1d0]
call fcn.100040a8
test eax, eax
je 0x1000472b
push eax
push esi
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x1f8]
push eax
push 0xf01ff
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x1e4]
mov edi, str.SeDebugPrivilege
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x1e4]
mov ecx, dword [ebp - 0x1e0]
push esi
push esi
push 0x10
mov dword [ebp - 0x1f0], eax
lea eax, [ebp - 0x1f4]
push eax
push esi
push dword [ebp - 0x1f8]
mov dword [ebp - 0x1f4], 1
mov dword [ebp - 0x1ec], ecx
mov dword [ebp - 0x1e8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1000472b
push ecx
mov ecx, dword [ebp - 0x1f8]
mov edx, edi
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeChangeNotifyPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeTcbPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeImpersonatePrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeLoadDriverPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeRestorePrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeBackupPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeSecurityPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeSystemEnvironmentPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeIncreaseQuotaPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeTakeOwnershipPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeIncreaseBasePriorityPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeShutdownPrivilege
call fcn.100041c6
mov ecx, dword [ebp - 0x1f8]
mov edx, str.SeAssignPrimaryTokenPrivilege
call fcn.100041c6
xor eax, eax
mov dword [ebp - 0x1fc], 0x20
lea edi, [ebp - 0x1dc]
stosd dword es:[edi], eax
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1dc]
push eax
mov word [ebp - 0x1dc], 0x101
mov byte [ebp - 0x1d5], 0x10
mov dword [ebp - 0x1d4], esi
mov dword [ebp - 0x200], eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea eax, [ebp - 0x200]
push eax
push 0x19
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
push dword [ebp - 0x1f8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008b95
leave
ret
Function at 0x10005b49
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10005b70
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000613a
jmp 0x10005c25
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10005b92
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10005b94
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10005c19
jg 0x10005ba9
test esi, esi
je 0x10005c19
test ecx, ecx
jl 0x10005bfc
jg 0x10005bb3
test eax, eax
je 0x10005bfc
cmp edi, ecx
jg 0x10005bc7
jl 0x10005bbd
cmp esi, eax
jae 0x10005bc7
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.1000a090
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
mov eax, dword [ebp + 8]
add eax, ecx
test edi, edi
jl 0x10005c19
jg 0x10005bff
test esi, esi
je 0x10005c19
jmp 0x10005bff
mov eax, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x10005c19
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.1000e1c3
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10005c2e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jg 0x10005c58
jl 0x10005c4f
test edi, edi
jne 0x10005c58
xor eax, eax
xor edx, edx
jmp 0x10005d0a
cmp dword [ecx + 0x38], 0
je 0x10005c6b
push esi
push edi
push edx
call fcn.10006201
jmp 0x10005d0a
mov eax, dword [ecx + 0x1c]
push ebx
mov ebx, edi
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10005cab
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x10005cab
cmp dword [eax], edi
mov esi, edi
cmovb esi, dword [eax]
push esi
push dword [ebp - 0xc]
push edx
call fcn.1000a090
mov ecx, dword [ebp - 8]
sub ebx, esi
add dword [ebp - 4], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x4c], 0
mov edx, ebx
je 0x10005d00
call fcn.10006a9e
mov edx, ebx
jmp 0x10005cde
push dword [ecx + 0x4c]
push eax
push 1
push dword [ebp - 4]
call fcn.1000eb66
add dword [ebp - 4], eax
sub ebx, eax
add esp, 0x10
mov edx, ebx
cmp eax, 0xfff
jne 0x10005d10
mov ecx, dword [ebp - 8]
mov eax, 0xfff
cmp ebx, eax
ja 0x10005cbc
test edx, edx
je 0x10005d00
push dword [ecx + 0x4c]
push ebx
push 1
push dword [ebp - 4]
call fcn.1000eb66
mov edx, ebx
add esp, 0x10
sub edx, eax
sub edi, edx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
leave
ret 0xc
sub edi, ebx
jmp 0x10005d02
Function at 0x10005f76
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10032068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10005f9c
xor eax, eax
jmp 0x10006063
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10005fc5
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x10005fc5
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x10006063
cmp dword [esi + 0x4c], 0
je 0x10006061
mov ecx, esi
call fcn.10006a9e
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10005ff2
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1000d0b6
cmp eax, edi
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x10006061
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x10006030
sub eax, 1
je 0x10006030
dec eax
sub eax, 1
jne 0x10006061
push dword [esi + 0x4c]
movsx ecx, byte [ebp - 0x25]
push ecx
jmp 0x10005fe4
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x10006053
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.1000e1c3
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x10006061
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
mov eax, ebx
jne 0x10006063
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008b95
leave
ret 4

Function at 0x10006ac1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10032068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x10006b18
cmp byte [esi + 0x3d], bl
je 0x10006b18
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10006b51
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x10006b29
sub eax, 1
je 0x10006b2c
dec eax
sub eax, 1
jne 0x10006b51
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008b95
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10006b49
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1000e1c3
add esp, 0x10
cmp edi, eax
jne 0x10006b51
cmp byte [esi + 0x3d], bl
sete al
jmp 0x10006b1a
xor al, al
jmp 0x10006b1a

Function at 0x10015f4b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10015dc1

Function at 0x1001c3d2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001c04f
Function at 0x540000
Capabilities:
Encode data using xor

Disassembly:
push eax
push ecx
push edx
push ebx
push ebp
push esi
push edi
call 0x54000c
pop ebx
sub ebx, 0x8d00c
push 0
pop ecx
push ebx
sub dword [ebx + 0x2dc], 0x5c7d551b
xor dword [ebx + 0x16c], 0x1f6e71d3
xor dword [ebx + 0x78], 0x48c038a0
add dword [ebx + 0x13c], 0x1dba3383
not dword [ebx + 0x1c4]
add dword [ebx + 0x8c], 0xf113dc0
xor dword [ebx + 0x2b4], 0x57292426
add dword [ebx + 0x90], 0x72815eba
add dword [ebx + 0xdc], 0x3f676a03
sub dword [ebx + 0xac], 0x2cf74d38
add dword [ebx + 0xe0], 0x6b69131d
add dword [ebx + 0x29c], 0x2c485d6c
xor dword [ebx + 0xf4], 0x608f0170
sub dword [ebx + 0xbc], 0x210a4531
xor dword [ebx + 0x30c], 0x594b469c
not dword [ebx + 0xa8]
add dword [ebx + 0x228], 0x44c32042
not dword [ebx + 0x28]
not dword [ebx + 0x168]
add dword [ebx + 0x44], 0x4a34433d
not dword [ebx + 0x290]
sub dword [ebx + 0x150], 0x23f9257e
xor dword [ebx + 0x25c], 0x75b06c62
sub dword [ebx + 0x200], 0x315606bb
add dword [ebx + 0x1dc], 0x544d5946
xor dword [ebx + 0x54], 0x48fb5edc
sub dword [ebx + 0x3c8], 0x4b566e4a
xor dword [ebx + 0x284], 0x59a63ad8
not dword [ebx + 0x3d4]
not dword [ebx + 0x12c]
not dword [ebx + 0x138]
add dword [ebx + 0x70], 0x61052e5c
add dword [ebx + 0x308], 0x6d9a177e
not dword [ebx + 0xb4]
not dword [ebx + 0x318]
not dword [ebx + 0x1b8]
add dword [ebx + 0xe8], 0x39d6514c
xor dword [ebx + 0xc0], 0x593a3e75
sub dword [ebx + 0x14], 0x34c7254a
xor dword [ebx + 0x144], 0x4b767c0f
xor dword [ebx + 0x2bc], 0xfe146f3
not dword [ebx + 0x1b4]
not dword [ebx + 0x18]
not dword [ebx + 0xec]
sub dword [ebx + 0x354], 0x511101c
xor dword [ebx + 0x1f4], 0x7c8b0113
add dword [ebx + 0x2e0], 0x4e59037f
xor dword [ebx + 0x204], 0xa74530b
not dword [ebx + 0x3f0]
not dword [ebx + 0x36c]
sub dword [ebx + 0xf0], 0x2e2716d5
add dword [ebx + 0x3a0], 0x7dcd5ad3
sub dword [ebx + 0x124], 0x45c12a3f
not dword [ebx + 0x3f8]
not dword [ebx + 0x7c]
add dword [ebx + 0x3bc], 0x4b5662fc
not dword [ebx + 0x38c]
add dword [ebx + 0x3b4], 0x4716e9b
sub dword [ebx + 0x268], 0x7b5e5ed3
xor dword [ebx + 0x64], 0x79ae5b82
xor dword [ebx + 0x68], 0x21a5808
xor dword [ebx + 0x1ac], 0x1b11c25
not dword [ebx + 0xe4]
xor dword [ebx + 0x238], 0x17d02532
not dword [ebx + 0x158]
not dword [ebx + 0x2d8]
xor dword [ebx + 0x384], 0x6b5c1d99
add dword [ebx + 0x4c], 0x7063f5f
add dword [ebx + 0x328], 0x35035334
xor dword [ebx + 0x114], 0x10564ac8
add dword [ebx + 0x1cc], 0x82f30d6
sub dword [ebx + 0x2a8], 0xa784eff
sub dword [ebx + 0x198], 0xe8654bf
add dword [ebx + 0x50], 0x63ca43fa
add dword [ebx + 0x194], 0x5a675ee3
sub dword [ebx + 0x3a4], 0x6a3c4d34
not dword [ebx + 0x60]
xor dword [ebx + 0x5c], 0xcb362ec
add dword [ebx + 0x3d8], 0x68ea7a5d
not dword [ebx + 0x244]
not dword [ebx + 0x378]
add dword [ebx + 0x154], 0x6cd729aa
add dword [ebx + 0x234], 0x6de47141
xor dword [ebx + 0xd0], 0x409c43f3
not dword [ebx + 0x2b8]
not dword [ebx + 0x14c]
not dword [ebx + 0x2d4]
xor dword [ebx + 0x270], 0x7f203390
xor dword [ebx + 0x210], 0x2ea761a0
sub dword [ebx + 0x2f4], 0x7aa66ab
xor dword [ebx + 0x98], 0x1baa4fc7
sub dword [ebx + 0x330], 0x3dad3c3a
xor dword [ebx + 0xc8], 0x3d13443
invalid
inc ebx
Function at 0x406410
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40644f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40644f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40644f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40644f
cmp dword [ecx + 0x74], 0xe
jbe 0x40644f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40bfa3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c040
push ebx
push esi
call fcn.0040bf6c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040bf00
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40bfed
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c03f
push edi
push eax
call fcn.0040cbc0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c00d
call fcn.0040aa61
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c03e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040bf00
add esp, 0x20
test eax, eax
jne 0x40c02c
push edi
call fcn.0040aa61
jmp 0x40c034
push ebx
call fcn.0040aa61
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d33d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x463808
push 0x463800
push str.FlsAlloc
push 0x1f
call fcn.0040d1fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d371
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
jmp 0x40d377
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d3bb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x463818
push 0x463810
push str.FlsGetValue
push 0x21
call fcn.0040d1fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d3f2
push dword [ebp + 8]
mov ecx, esi
call dword [0x416174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d3fa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x463820
push 0x463818
push str.FlsSetValue
push 0x22
call fcn.0040d1fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d434
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x412890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4128bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4128bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret