joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407f60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
fld dword [0x450400]
sub esp, 0x10
fadd dword [0x449d74]
fld dword [0x449d70]
fcompp
fnstsw ax
test ah, 5
jp 0x407fa5
fld qword [0x450030]
fsub qword [0x449d68]
fsub qword [0x449d60]
fstp qword [ebp - 8]
fld dword [0x4501a0]
fadd qword [ebp - 8]
fstp dword [0x4501a0]
mov eax, dword [0x450190]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp qword [ebp - 8]
fld qword [0x450318]
fadd qword [ebp - 8]
fadd qword [0x449d58]
fcomp qword [0x449d50]
fnstsw ax
test ah, 1
jne 0x408015
fld dword [0x449d48]
fld dword [0x4501dc]
fadd dword [0x449d44]
fcompp
fnstsw ax
test ah, 5
jp 0x408015
inc dword [0x450248]
mov ecx, dword [0x450248]
mov edx, 0xf24a89bd
sub edx, ecx
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fstp qword [ebp - 8]
fld dword [0x450214]
fadd qword [ebp - 8]
fstp dword [0x450214]
cmp dword [0x4527b4], 0
jne 0x408028
call fcn.00419bd0
mov dword [0x4527b4], eax
fld dword [0x450314]
push ebx
fsub dword [0x449d40]
push esi
push edi
push 3
fstp dword [0x450314]
push 0xd45
call fcn.0041a660
fld dword [0x450018]
fld1
mov edi, eax
fsubp st(1)
fstp dword [0x450018]
fld dword [0x449d3c]
fsub dword [0x450018]
mov ax, word [0x4502ec]
movsx ecx, ax
mov dword [ebp - 4], ecx
fstp qword [ebp - 0x10]
fild dword [ebp - 4]
fmul qword [ebp - 0x10]
call fcn.0041eb1c
mov ebx, dword [ebp + 8]
push edi
push ebx
mov word [0x4502ec], ax
call fcn.0041f685
push edi
push 3
mov esi, eax
call fcn.004094f0
add esp, 0x18
test esi, esi
jne 0x408111
push 0x3e8
call dword [0x451aa0]
push 3
push 0xd45
call fcn.0041a660
mov edi, eax
push edi
push ebx
call fcn.0041f685
push edi
push 3
mov esi, eax
call fcn.004094f0
mov edx, dword [0x450110]
add edx, 0x7beb2313
add esp, 0x18
cmp edx, 0xc421c829
je 0x40810d
fld dword [0x4502c0]
fstp qword [ebp - 0x10]
fld qword [0x450050]
fsubr qword [ebp - 0x10]
fstp dword [0x4502c0]
fld qword [0x450050]
fadd qword [0x4495c8]
fstp qword [0x450050]
test esi, esi
je 0x408173
fld dword [0x4503f0]
fld1
fsubp st(1)
fstp dword [0x4503f0]
fld dword [0x4503f0]
mov ax, word [0x4501c4]
movsx ecx, ax
fstp qword [ebp - 0x10]
sub ecx, 0x24b8209d
mov dword [ebp - 4], ecx
fild dword [ebp - 4]
fcomp qword [ebp - 0x10]
fnstsw ax
test ah, 5
jp 0x40815b
fld dword [0x450360]
fsub dword [0x449d38]
fstp dword [0x450360]
push esi
push 1
push 4
push 0x4527b4
call fcn.0041ff67
push esi
call fcn.0041fd9c
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x45024c]
imul eax, eax, 0xf7b3a4
mov dword [0x45024c], eax
inc word [0x450424]
mov cx, word [0x450424]
movsx edx, cx
sub edx, 0x641d0318
mov dword [ebp - 4], edx
push esi
fild dword [ebp - 4]
fstp qword [ebp - 8]
fld dword [0x450410]
mov ax, word [0x4500fc]
fsubr qword [ebp - 8]
movsx ecx, ax
mov dword [ebp - 4], ecx
fstp qword [ebp - 0x10]
fild dword [ebp - 4]
fmul qword [ebp - 0x10]
call fcn.0041eb1c
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov word [0x4500fc], ax
fld dword [0x450410]
fld1
mov eax, dword [ebp + 0x10]
fsubp st(1)
lea esi, [ecx + edx*4]
fstp dword [0x450410]
cmp ecx, esi
je 0x40c3a3
xor dword [ecx], eax
ror eax, 1
mov dword [ebp + 8], eax
mov edx, eax
mov al, byte [ebp + 8]
shr edx, 8
add dl, al
add al, dl
add ecx, 4
mov byte [ebp + 9], dl
mov byte [ebp + 8], al
mov eax, dword [ebp + 8]
cmp ecx, esi
jne 0x40c380
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414160
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
add dword [0x450094], 0xa132a837
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov ax, word [0x45037c]
movsx edx, ax
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fstp qword [ebp - 8]
fld qword [0x450008]
fmul qword [ebp - 8]
fstp qword [0x450008]
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [0x450290]
mov ecx, dword [0x4500cc]
add eax, 0xd1b6cf6a
imul ecx, eax
mov dword [0x4500cc], ecx
dec dword [0x450290]
mov esp, ebp
pop ebp
ret
Function at 0x420c40
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x450620]
jne 0x420c4a
repz ret
jmp fcn.00431e9a

Function at 0x433787
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x450620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00423873
and dword [ebp - 0x14], 0
cmp dword [0x4534a4], 0
mov dword [ebp - 0x18], eax
jne 0x43383a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4338e2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4338e2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4534a4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4534a8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4534ac], eax
call edi
push eax
call esi
mov dword [0x4534b4], eax
test eax, eax
je 0x43383a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4534b0], eax
mov eax, dword [0x4534b0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x433893
cmp dword [0x4534b4], ecx
je 0x433893
push eax
call esi
push dword [0x4534b4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x433893
test ebx, ebx
je 0x433893
call edi
test eax, eax
je 0x43388a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x43388a
test byte [ebp - 8], 1
jne 0x433893
or dword [ebp + 0x10], 0x200000
jmp 0x4338c6
mov eax, dword [0x4534a8]
cmp eax, dword [ebp - 0x18]
je 0x4338c6
push eax
call esi
test eax, eax
je 0x4338c6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4338c6
mov eax, dword [0x4534ac]
cmp eax, dword [ebp - 0x18]
je 0x4338c6
push eax
call esi
test eax, eax
je 0x4338c6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4534a4]
call esi
test eax, eax
je 0x4338e2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4338e4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420c40
leave
ret
Function at 0x426024
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42602a
ret

Function at 0x432370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x432521
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404ad4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x432538
call fcn.00404730
mov eax, ebx
call fcn.00423f74
mov edi, eax
dec edi
test edi, edi
jl 0x432428
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00423f48
mov edx, dword [0x4472b0]
call fcn.00403750
test al, al
je 0x432424
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00423f48
lea edx, [ebp - 0x14]
call fcn.004548c0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404ad4
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004047a4
inc esi
dec edi
jne 0x4323d6
mov al, byte [0x43253c]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x432548
mov eax, dword [ebp - 0xc]
call fcn.0040ea7c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.004044ac
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.004548c0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x432538
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.004548c0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x432538
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x432538
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x432554
call fcn.0040a2a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432528
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404438
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404438
lea eax, [ebp - 0x14]
call fcn.00404414
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404438
ret
Function at 0x486908
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x486936
mov eax, ebx
call fcn.004873bc
cmp dword [ebx + 0x40], 0
je 0x48692f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4869a7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x486999
cmp dword [ebx + 8], 0
je 0x486958
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x48696a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x486999
cmp dword [ebx + 8], 0
je 0x48694b
cmp eax, 3
je 0x48697d
dec eax
jne 0x48694b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x48694b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x48694b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4869c5
cmp dword [ebx + 0x14], 0xcc
je 0x4869c5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004869d0
pop ebx
ret
Function at 0x4ecb30
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx]
add eax, 0x110
mov edx, 0x4ecb94
call fcn.00404468
mov eax, dword [ebx]
mov edx, 0x4ecba8
call fcn.004e8a88
mov eax, dword [ebx]
add eax, 0x114
mov edx, 0x4ecbb4
call fcn.00404468
mov eax, dword [ebx]
add eax, 0x118
mov edx, 0x4ecc08
call fcn.00404468
mov eax, dword [ebx]
mov dword [eax + 0x3d4], 3
mov eax, dword [ebx]
mov byte [eax + 0x29b], 1
pop ebx
ret

Function at 0x4ed1dc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048d4
xor eax, eax
push ebp
push 0x4ed384
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 4]
call fcn.004ed444
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
call fcn.004044ac
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
je 0x4ed354
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 4]
call fcn.0040493c
push eax
call fcn.00406ca4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4ed354
xor edx, edx
push ebp
push 0x4ed34d
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00406cac
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4ed336
xor edx, edx
push ebp
push 0x4ed32f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x14]
push eax
call fcn.00406f04
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x18]
push 2
push ebx
call fcn.00406ed4
test eax, eax
jne 0x4ed30f
mov eax, ebx
cmp word [eax], 0x5a4d
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4ed30f
add ebx, dword [eax + 0x3c]
push 4
push ebx
call fcn.00406ed4
test eax, eax
jne 0x4ed30f
cmp dword [ebx], 0x4550
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x4ed30f
lea eax, [ebp - 0x110]
test eax, eax
je 0x4ed30f
lea eax, [ebp - 0x110]
mov ecx, 0xf8
mov edx, ebx
call fcn.00407850
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed336
mov eax, dword [ebp - 0x18]
push eax
call fcn.00406fa4
mov eax, dword [ebp - 0x14]
push eax
call fcn.00406c6c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed354
mov eax, dword [ebp - 0x10]
push eax
call fcn.00406c6c
ret
cmp word [ebp - 0xf8], 0x20b
mov eax, dword [ebp - 8]
sete byte [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ed38b
lea eax, [ebp - 0x114]
call fcn.00404414
lea eax, [ebp - 4]
call fcn.00404414
ret
Function at 0x5134f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004048d4
mov eax, dword [ebp - 8]
call fcn.004048d4
xor eax, eax
push ebp
push 0x5136ad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 4]
call fcn.00404468
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 8]
call fcn.00404468
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x24], eax
mov eax, dword [ebx + 0x28]
call fcn.0041dbd8
lea eax, [ebx + 0x2c]
call fcn.004ecb30
mov esi, dword [ebx + 0x2c]
mov dword [esi + 0x3d4], 0xa
mov dword [esi + 0x344], ebx
mov dword [esi + 0x340], 0x5137b4
cmp byte [ebx + 0x30], 0
je 0x5135d3
lea eax, [esi + 0x90]
mov edx, dword [ebx + 0x38]
call fcn.00404468
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 0x34]
call fcn.00409100
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x2c]
add eax, 0x94
call fcn.00404468
mov eax, dword [ebx + 0x2c]
add eax, 0xa8
mov edx, dword [ebx + 0x3c]
call fcn.00404468
mov eax, dword [ebx + 0x2c]
add eax, 0xac
mov edx, dword [ebx + 0x40]
call fcn.00404468
jmp 0x513605
lea eax, [esi + 0x90]
call fcn.00404414
mov eax, dword [ebx + 0x2c]
add eax, 0x94
call fcn.00404414
mov eax, dword [ebx + 0x2c]
add eax, 0xa8
call fcn.00404414
mov eax, dword [ebx + 0x2c]
add eax, 0xac
call fcn.00404414
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004eca80
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x2c]
add eax, 0xec
call fcn.00404468
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0xec]
mov edx, dword [ebp - 4]
call fcn.00408d98
test al, al
jne 0x513644
mov eax, dword [ebx + 8]
xor ecx, ecx
mov edx, 0x5136c8
call fcn.004a258c
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x2c]
mov dword [eax + 0x1a0], edx
mov dword [eax + 0x344], ebx
mov dword [eax + 0x340], 0x5137b4
xor eax, eax
push ebp
push 0x513688
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00406e4c
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x2c]
call fcn.004e8a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x513692
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5136b4
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404438
ret
Function at 0x51f754
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x425d94]
call fcn.0042bec0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51f927
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x54]
cmp dword [eax + 8], 0
jle 0x51f906
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0042d3c4
mov eax, dword [ebp - 8]
call fcn.0042c488
mov eax, dword [eax + 0x14]
mov edx, esi
call fcn.0042750c
cmp byte [ebp + 8], 0
je 0x51f7ee
xor edx, edx
mov eax, ebx
call fcn.0051e77c
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.0051e77c
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
mov eax, ebx
call fcn.0051e6ac
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x51f82a
xor edx, edx
mov eax, ebx
call fcn.0051e77c
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, ebx
call fcn.0051e6ac
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.0051e77c
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004194c8
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
call fcn.0042c488
pop edx
call fcn.00427b70
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.0051e6ac
dec eax
test eax, eax
jl 0x51f8de
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0051e650
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, esi
mov eax, ebx
call fcn.0051e7a8
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x20]
imul esi
xor edx, edx
mov dl, byte [ebp + 8]
imul edx
push eax
mov edx, esi
mov eax, ebx
call fcn.0051e7a8
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
imul esi
mov dl, byte [ebp + 8]
xor dl, 1
and edx, 0x7f
imul edx
xor ecx, ecx
pop edx
call fcn.004194a0
mov eax, dword [ebp - 8]
call fcn.0042c488
mov edx, eax
lea ecx, [ebp - 0x20]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
inc esi
dec dword [ebp - 0x10]
jne 0x51f874
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0051e650
cmp byte [ebp + 0xc], 0
je 0x51f906
movzx eax, word [ebx + 0x58]
mov edx, 0x10
call fcn.0042e574
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0051de2c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51f92e
mov eax, dword [ebp - 8]
call fcn.004035c4
ret
Function at 0x10001650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov ecx, 0x100d104c
call fcn.10003520
mov dword [ebp - 4], 0
mov esi, esp
push 0x40
push 0x3000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100034e0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
add esp, 4
cmp ebp, esp
call fcn.100034e0
mov esp, ebp
pop ebp
ret
Function at 0x10001cd0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe24
push esi
push edi
lea edi, [ebp - 0xe24]
mov ecx, 0x389
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x100d104c
call fcn.10003520
push 0x14
call fcn.10003560
add esp, 4
mov dword [ebp - 0xe20], eax
cmp dword [ebp - 0xe20], 0
je 0x10001d34
xor eax, eax
mov ecx, dword [ebp - 0xe20]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0xe20]
mov dword [ebp - 0xe24], edx
jmp 0x10001d3e
mov dword [ebp - 0xe24], 0
mov eax, dword [ebp - 0xe24]
mov dword [ebp - 4], eax
mov esi, esp
push str.msys_2.0.dll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp esi, esp
call fcn.100034e0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10001d78
mov ecx, dword [ebp - 8]
push ecx
call fcn.100016a0
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
jmp 0x10001d8b
push 0xe05
call fcn.10001650
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x10001d9b
xor eax, eax
jmp 0x10001e3e
push 0xe05
push 0
lea eax, [ebp - 0xe14]
push eax
call fcn.10005a40
add esp, 0xc
mov dword [ebp - 0xe1c], 0
jmp 0x10001dcc
mov ecx, dword [ebp - 0xe1c]
add ecx, 1
mov dword [ebp - 0xe1c], ecx
cmp dword [ebp - 0xe1c], 0xe05
jae 0x10001df8
mov edx, 0xe04
sub edx, dword [ebp - 0xe1c]
mov eax, dword [ebp - 0xe1c]
mov cl, byte [edx + section..MDT]
mov byte [ebp + eax - 0xe14], cl
jmp 0x10001dbd
push 0xe05
lea edx, [ebp - 0xe14]
push edx
push section..MDT
call fcn.10005ba0
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0x100d2000
mov ecx, dword [ebp - 4]
mov dword [ecx], 0xe05
mov esi, esp
mov edx, dword [ebp - 4]
push edx
push 0x10001b20
call dword [sym.imp.USER32.dll_EnumWindows]
cmp esi, esp
call fcn.100034e0
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x10001e64]
call fcn.10003470
pop eax
pop edx
pop edi
pop esi
add esp, 0xe24
cmp ebp, esp
call fcn.100034e0
mov esp, ebp
pop ebp
ret
Function at 0x10002160
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x894
push esi
push edi
lea edi, [ebp - 0x894]
mov ecx, 0x225
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x100d104c
call fcn.10003520
mov byte [ebp - 1], 0
push 0x208
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.10005a40
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.10005a40
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x630]
push edx
call fcn.10005a40
add esp, 0xc
lea eax, [ebp - 0x88c]
mov dword [ebp - 0x894], eax
mov esi, esp
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.100034e0
test eax, eax
je 0x1000237a
mov esi, esp
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp esi, esp
call fcn.100034e0
test eax, eax
je 0x1000237a
mov esi, esp
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.100034e0
mov esi, esp
push str..
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp esi, esp
call fcn.100034e0
mov esi, esp
mov eax, dword [ebp - 0x894]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp esi, esp
call fcn.100034e0
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0xffffffff
je 0x1000237a
mov esi, esp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100034e0
mov esi, esp
push 0x100332f4
mov edx, dword [ebp - 0x894]
add edx, 0x2c
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp esi, esp
call fcn.100034e0
test eax, eax
je 0x10002355
mov esi, esp
push 0x100332f8
mov eax, dword [ebp - 0x894]
add eax, 0x2c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp esi, esp
call fcn.100034e0
test eax, eax
je 0x10002355
mov ecx, dword [ebp - 0x894]
mov edx, dword [ecx]
and edx, 0x10
jne 0x10002351
mov esi, esp
push str..dmp
mov eax, dword [ebp - 0x894]
add eax, 0x2c
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp esi, esp
call fcn.100034e0
test eax, eax
je 0x10002351
mov ecx, dword [ebp - 0x894]
add ecx, 0x2c
mov esi, esp
push ecx
lea edx, [ebp - 0x420]
push edx
push str._s_s
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp esi, esp
call fcn.100034e0
mov esi, esp
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100034e0
mov byte [ebp - 1], 1
mov esi, esp
mov edx, dword [ebp - 0x894]
push edx
mov eax, dword [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp esi, esp
call fcn.100034e0
test eax, eax
jne 0x10002284
mov al, byte [ebp - 1]
push edx
mov ecx, ebp
push eax
lea edx, [0x100023a4]
call fcn.10003470
pop eax
pop edx
pop edi
pop esi
add esp, 0x894
cmp ebp, esp
call fcn.100034e0
mov esp, ebp
pop ebp
ret