joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002424
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, 0x10278290
test eax, eax
je 0x10002465
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.10003642
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10002476
push ebx
call fcn.1000363c
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000005
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000248d
mov eax, 0x10278241
push eax
push 1
mov ebx, 0x194
call fcn.10003990
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.10003970
add esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push 0x40
push dword [ebp - 0x14]
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10002509
push 0x18f
push 0x401002e
push 6
call fcn.1000364e
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10002520
mov eax, 0
jmp 0x10002586
lea eax, [ebp - 4]
push eax
call fcn.100023e5
mov dword [ebp - 0x14], eax
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.1000240a
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.1000259e
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0x8000
push 0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1000257e
push 0x2e1
push 0x401002e
push 6
call fcn.1000364e
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x10002586
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10002597
push ebx
call fcn.1000363c
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10003ff0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000400e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x10004003
pop esi
ret
Function at 0x104cd058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104cd1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104cd07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104cd06a
add dl, dl
jne 0x104cd089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104cd0dc
xor eax, eax
add dl, dl
jne 0x104cd096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104cd17d
add dl, dl
jne 0x104cd0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104cd0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104cd0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104cd0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104cd0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104cd075
mov eax, 1
add dl, dl
jne 0x104cd0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104cd0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104cd0e1
sub eax, ebx
mov ebx, 1
jne 0x104cd128
mov ecx, 1
add dl, dl
jne 0x104cd10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104cd119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104cd105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104cd075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104cd13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104cd14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104cd136
cmp eax, 0x7d00
jae 0x104cd16d
cmp eax, 0x500
jb 0x104cd168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104cd075
cmp eax, 0x7f
ja 0x104cd170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104cd075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104cd19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104cd075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x447d30
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x54672c
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x447dbd
push edi
push 0
push 1
push 0x547d60
call esi
cmp eax, 1
jne 0x447d7a
mov edi, dword [sym.imp.kernel32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x547d60
call esi
cmp eax, 1
je 0x447d66
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x54672c
call esi
mov edi, dword [sym.imp.kernel32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x447da7
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x447da7
push esi
push 0x54672c
call edi
push 0
push 0x547d60
call edi
cmp esi, 0xffffffff
pop edi
jne 0x447dbd
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x54672c]
test eax, eax
jl 0x447de2
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x447de2
add dword [eax + 0x124], 1
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x128
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x447db6
push 0x128
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x124], 1
mov dword [ebx], 1
mov eax, dword [0x54672c]
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x44ebd0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54672c]
test eax, eax
jge 0x44ebdd
xor eax, eax
jmp 0x44ebe4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor ecx, ecx
lea edx, [eax + 0x1c]
lea esp, [esp]
cmp dword [ecx*4 + 0x430708], edi
jne 0x44ebfe
cmp dword [edx], 0
jne 0x44ec15
add ecx, 1
add edx, 8
cmp ecx, 0x1a
jb 0x44ebf0
mov ecx, dword [eax + 0x18]
push 0x10
push edi
call fcn.004e59e0
ret
mov edx, dword [eax + ecx*8 + 0x1c]
test edx, edx
je 0x44ec37
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x1c], esi
test esi, esi
pop esi
jne 0x44ec31
mov dword [eax + ecx*8 + 0x20], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0x1a
jb 0x44ec48
mov ecx, dword [eax + 0x18]
push 0x10
push edi
call fcn.004e59e0
ret
mov eax, edx
ret

Function at 0x461b40
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x461b94
mov eax, dword [0x54672c]
test eax, eax
push ebx
push edi
jge 0x461b53
xor ebx, ebx
jmp 0x461b5c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x430708]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x20]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x461b8c
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x1c], esi
pop edi
mov dword [ecx], esi
pop ebx
ret
Function at 0x4aede0
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x4aee29
mov eax, dword [0x54672c]
test eax, eax
push edi
jge 0x4aedf2
xor edi, edi
jmp 0x4aedfb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
push 0xf0
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 8]
add esp, 0xc
test eax, eax
je 0x4aee22
mov dword [eax], esi
mov dword [edi + 8], esi
pop edi
ret
mov dword [edi + 4], esi
mov dword [edi + 8], esi
pop edi
ret

Function at 0x4b9470
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x2998]
push esi
push edi
push eax
mov dword [ebx], 0x4397e0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov ecx, dword [ebx + 0x29a4]
add esp, 4
test ecx, ecx
je 0x4b949e
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov esi, dword [ebx + 0x29a0]
test esi, esi
je 0x4b94b6
call fcn.00514e00
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebx + 0x29a0], 0
lea esi, [ebx + 0x2a5c]
mov edi, 0x1000
jmp 0x4b94d0
mov ecx, dword [esi]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov dword [esi], 0
add esp, 4
add esi, 4
sub edi, 1
jne 0x4b94d0
lea esi, [ebx + 0x2a5c]
mov edi, 0xe
mov eax, dword [esi - 0xc]
sub esi, 0xc
test eax, eax
je 0x4b9513
mov edi, edi
mov edx, dword [eax]
push eax
mov dword [esi], edx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi]
add esp, 4
test eax, eax
jne 0x4b9500
mov eax, dword [esi + 4]
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
sub edi, 1
mov dword [esi + 4], 0
jns 0x4b94f4
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.004bb440

Function at 0x4c04e0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x54672c]
test eax, eax
jge 0x4c04ed
xor eax, eax
jmp 0x4c04f4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp dword [eax + 0x10], 0
je 0x4c0519
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x4c0504
xor eax, eax
ret
mov edx, dword [ecx]
test edx, edx
mov dword [eax + 0x10], edx
jne 0x4c0510
mov dword [eax + 0x14], edx
mov dword [ecx], 0xfefefefe
mov eax, ecx
ret
mov ecx, dword [eax + 0xc]
push 0x10
push 0x40
call fcn.004e59e0
ret

Function at 0x4c0530
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x4c0576
mov eax, dword [0x54672c]
test eax, eax
jl 0x4c0576
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x4c0575
push 0x40
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x4c056f
mov dword [eax], esi
mov dword [edi + 0x14], esi
pop edi
ret
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], esi
pop edi
ret
Function at 0x4e59e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4e59ef
pop dword [ebp - 0x20]
mov eax, 0x62ed43b0
sub eax, 0x629ee9c1
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x5c57b
push 0
mov eax, 0xf177724e
sub eax, 0xf13761d2
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xb5eeeb0b
add ecx, 0x4a115ea3
xor esi, esi
add esi, eax
mov edx, 0x551000
add edx, dword [ebp - 0x20]
mov edi, 0xa474cf8
mov dword [ebp - 0x10], 0xc198c65e
mov ebx, dword [edx]
xor ebx, edi
add dword [ebp - 0x18], ecx
mov dword [esi], ebx
xor dword [ebp - 0x14], 0x720c154b
add esi, 4
add edx, 0x86de96ff
sub edx, 0x86de96fb
loop 0x4e5a44
add eax, 0x132ed842
add eax, 0xecd24149
xor ebx, ebx
add ebx, eax
add eax, 0x6df548d
sub eax, 0x6df5488
mov ecx, 0xfb9ae407
add ecx, 0x4a51bf9
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4fd080
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 0xaa8c]
push eax
mov dword [esi], 0x440060
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esi + 0xaaa4]
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 0xab18]
add esp, 8
test eax, eax
je 0x4fd0c2
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esi + 0xab18], 0
mov ecx, esi
pop esi
jmp fcn.004b9470
Function at 0x40a020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x4c6480]
mov dword [esp + 4], ecx
dec esp
and al, 4
invalid
push esi

Function at 0x40a022
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x4c6480]
mov dword [esp + 4], ecx
dec esp
and al, 4
invalid
push esi

Function at 0x40a024
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x4c6480]
mov dword [esp + 4], ecx
dec esp
and al, 4
invalid
push esi

Function at 0x40a026
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x4c6480]
mov dword [esp + 4], ecx
dec esp
and al, 4
invalid
push esi

Function at 0x40a03f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [edi], ecx
test byte [edi], dl
adc eax, 0x7d8b0000
adc byte [ebx], dh
shr byte [edx + 8], 0x66
push 8
mov word [esp + 0x5c], 1
mov dword [esp + 0x24], edi

Function at 0x40a082
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
or byte [ebx + 0x2444c70e], cl
push eax
add dword [eax], eax
add byte [eax], al

Function at 0x40a088
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x54], edx
mov edx, dword [ebp + 8]
or byte [ebx + 0x2444c70e], cl
push eax
add dword [eax], eax
add byte [eax], al

Function at 0x40a098
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ebx + 0x48b0442], cl
mov byte [edi], cl
mov edi, 0x44890a40
invalid
mov dword [esp + 0x5c], eax

Function at 0x40a116
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub dword [eax], eax
add byte [ebp - 0x6977f040], al
ror byte [edi], 0x88
xchg esi, eax
imul eax, dword [ebx], 0

Function at 0x40a138
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jg 0x40a1ae
aas
add dword [edi], ecx
test dword [ecx - 0x74ffffeb], edx
mov eax, dword [esp + 0x28]

Function at 0x414b04
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp eax, dword [ebp - 0x14]
je 0x414e46
mov dword [ebp - 0x14], 0x8b

Function at 0x414b06
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp eax, dword [ebp - 0x14]
je 0x414e46
mov dword [ebp - 0x14], 0x8b

Function at 0x415e94
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415ebc
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
and dword [ebx], eax
rol dword [esi + 0x3b], 0xf2
jl 0x415eae
pop edi
pop esi
pop ebp
ret 4
Function at 0x468ad6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c6518], 0
push esi
push edi
mov esi, 0x4c6530
jne 0x468af5
push 0
call fcn.0042551e
pop ecx
mov ecx, eax
call fcn.00468a99
mov dword [0x4c3190], 0x270
mov edi, 0xe3
mov dword [0x4c6ef0], esi
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x468b0a
mov edi, 0x18c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x468b3f
mov ecx, dword [0x4c6530]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
pop edi
sbb edx, edx
xor eax, ecx
and eax, 0x7ffffffe
and edx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, edx
mov dword [esi], eax
pop esi
ret

Function at 0x469364
Capabilities:
Encode data using xor

Disassembly:
in al, dx
fadd qword [eax]
add byte [eax], al
lea ecx, [ebp - 0xdc]
push esi
push edi
call fcn.004691b6
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call fcn.004691fc
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x4693a4
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.00469334
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x46938e
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401000
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
or edi, 0xffffffff
xor ebx, ebx
mov dword [ebp - 4], edi
cmp dword [0x412e60], ebx
jne 0x40104d
xor ecx, ecx
xor eax, eax
push 8
pop edx
test al, 1
je 0x40102c
shr eax, 1
xor eax, 0xedb88320
jmp 0x40102e
shr eax, 1
dec edx
jne 0x40101f
mov dword [ecx*4 + 0x417ae0], eax
inc ecx
mov eax, ecx
cmp ecx, 0x100
jl 0x40101c
mov dword [0x412e60], 1
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, 0x411e60
push ebx
lea eax, [ebp - 8]
push eax
push 0x1000
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4010bc
mov edx, dword [ebp - 8]
lea ecx, [edx + 0x411e60]
mov eax, esi
cmp ecx, esi
jbe 0x4010a9
movzx ebx, byte [eax]
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp - 4]
shr ebx, 8
xor ebx, dword [edi*4 + 0x417ae0]
inc eax
mov edi, ebx
mov dword [ebp - 4], edi
cmp eax, ecx
jb 0x401085
xor ebx, ebx
cmp edx, ebx
jne 0x40105e
mov eax, dword [ebp + 0xc]
not edi
mov dword [eax], edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x4010b7

Function at 0x4010c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.004018e4
pop ecx
xor edi, edi
push edi
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, 0x40de60
push edi
lea eax, [ebp - 0x60]
push eax
push 0x4000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401142
push dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.0040190f
add esp, 0xc
cmp dword [ebp - 0x60], edi
jne 0x4010f7
push dword [ebp - 0x64]
lea eax, [ebp - 0x5c]
push eax
call fcn.004019d0
pop ecx
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402599
leave
ret
xor eax, eax
jmp 0x401133

Function at 0x4018e4
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x402599
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4025a3
repz ret
jmp fcn.0040285a

Function at 0x408c5b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403ffc
and dword [ebp - 0x14], 0
cmp dword [0x4179b4], 0
mov dword [ebp - 0x18], eax
jne 0x408d0e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408db6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408db6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4179b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4179b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4179bc], eax
call edi
push eax
call esi
mov dword [0x4179c4], eax
test eax, eax
je 0x408d0e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4179c0], eax
mov eax, dword [0x4179c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408d67
cmp dword [0x4179c4], ecx
je 0x408d67
push eax
call esi
push dword [0x4179c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408d67
test ebx, ebx
je 0x408d67
call edi
test eax, eax
je 0x408d5e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408d5e
test byte [ebp - 8], 1
jne 0x408d67
or dword [ebp + 0x10], 0x200000
jmp 0x408d9a
mov eax, dword [0x4179b8]
cmp eax, dword [ebp - 0x18]
je 0x408d9a
push eax
call esi
test eax, eax
je 0x408d9a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408d9a
mov eax, dword [0x4179bc]
cmp eax, dword [ebp - 0x18]
je 0x408d9a
push eax
call esi
test eax, eax
je 0x408d9a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4179b4]
call esi
test eax, eax
je 0x408db6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408db8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402599
leave
ret
Function at 0x900e460
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90cf2a5
call fcn.09006dd9
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900e4bc
xor al, al
jmp 0x900e50c
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900e8b2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900f2c5
test al, al
je 0x900e4ff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0909b48d
mov ecx, edi
call fcn.09011cd1
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0909b48d
mov al, bl
call fcn.09006f96
ret

Function at 0x9011cd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x9011cd9
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9011ce8
xor al, al
ret
shr eax, 4
and al, 1
ret

Function at 0x901e790
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov byte [ecx + 0x58], 0
ret
Function at 0x90582d8
Capabilities:
Get memory capacity

Disassembly:
push 0x28
mov eax, 0x90d2348
call fcn.0900620a
mov esi, ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x20
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x24]
xor edx, edx
sub eax, dword [ebp - 0x20]
sub eax, dword [esi + 8]
sbb edx, dword [esi + 0xc]
js 0x9058343
jg 0x905830d
test eax, eax
jb 0x9058343
mov ecx, dword [esi + 4]
imul edi, ecx, 3
test edx, edx
jg 0x9058343
jl 0x905831d
cmp eax, edi
ja 0x9058343
cmp eax, ecx
jbe 0x9058337
and dword [ebp - 4], 0
sub eax, ecx
mov ecx, dword [esi]
push eax
call fcn.0909b48d
jmp 0x9058343
jae 0x9058343
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.0909b48d
call fcn.09006fcf
ret