joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10033880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100338bc
mov eax, dword [0x1009fce4]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x100338a6
dec dword [eax + 0x36c]
push dword [0x1009fce0]
push ecx
call fcn.100178a0
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100338f6
mov eax, dword [0x1009fce4]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x100338e0
dec dword [eax + 0x36c]
push dword [0x1009fce0]
push ecx
call fcn.100178a0
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10033930
mov eax, dword [0x1009fce4]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1003391a
dec dword [eax + 0x36c]
push dword [0x1009fce0]
push ecx
call fcn.100178a0
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10033986
mov eax, dword [0x1009fce4]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x10033970
dec dword [eax + 0x36c]
push dword [0x1009fce0]
push ecx
call fcn.100178a0
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100339c0
mov eax, dword [0x1009fce4]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x100339aa
dec dword [eax + 0x36c]
push dword [0x1009fce0]
push ecx
call fcn.100178a0
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100339fa
mov eax, dword [0x1009fce4]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100339e4
dec dword [eax + 0x36c]
push dword [0x1009fce0]
push ecx
call fcn.100178a0
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10036bf0
Function at 0x100399a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082c33
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1009c018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
mov eax, 0xffff
mov word [ecx + 0x3e], ax
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x3a], 0xffffffff
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov word [ecx + 0x38], ax
mov byte [ecx + 0x40], al
mov dword [ecx + 0x44], 0x3f800000
mov dword [ecx + 0x4c], eax
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x50], eax
mov word [ecx + 0x54], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10050800
Capabilities:
Hash data with crc32

Disassembly:
test dword [ecx + 0xc], 0x100000
push ebx
push esi
push edi
mov ebx, edx
je 0x10050871
mov cl, byte [ebx]
lea esi, [ebx + 1]
or eax, 0xffffffff
test cl, cl
je 0x10050848
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x1005082f
cmp byte [esi], cl
jne 0x1005082f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10088bb8]
test cl, cl
jne 0x10050820
mov ecx, dword [0x1009fce4]
not eax
cmp dword [ecx + 0x1bd0], eax
jne 0x1005085e
mov dword [ecx + 0x1bd4], eax
cmp dword [ecx + 0x1c0c], eax
jne 0x100508d3
mov byte [ecx + 0x1c10], 1
pop edi
pop esi
pop ebx
ret
mov edi, dword [0x1009fce4]
xor edx, edx
mov eax, dword [edi + 0x1b98]
mov ecx, dword [eax + 0xc4]
mov eax, dword [eax + 0xcc]
push dword [eax + ecx*4 - 4]
mov ecx, ebx
call fcn.10018290
mov esi, eax
add esp, 4
cmp dword [edi + 0x1bd0], esi
jne 0x100508a9
mov dword [edi + 0x1bd4], esi
cmp dword [edi + 0x1c0c], esi
jne 0x100508b8
mov byte [edi + 0x1c10], 1
cmp dword [edi + 0x1bb8], esi
jne 0x100508d1
push ecx
push ebx
mov edx, 0xb
mov ecx, esi
call fcn.1002aa30
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x1005ec20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1009c018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100a01e5], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
je 0x1005ec8b
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x34], 0
jne 0x1005ec4f
cmp dword [eax + 0x30], 0
je 0x1005ec8b
lea eax, [ebp - 8]
mov byte [0x100a01e6], 1
push eax
push 0x40
push 1
push 0x410660
call esi
push 0
mov byte [0x410660], 0xc3
push dword [ebp - 8]
push 1
push 0x410660
call esi
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0xcc18c84]
mov dword [0x100a01e0], eax
cmp byte [ebp + 0x14], 0
jne 0x1005ed01
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, eax
sub edx, dword [0xcc18c84]
cmp byte [0x8f15f0], 1
jne 0x1005ecb9
mov ecx, dword [0x100a048c]
cmp byte [ecx + 0x44], 0
mov ecx, 1
jne 0x1005ecbe
mov ecx, 0x64
mov eax, dword [0x100a01e0]
add eax, ecx
cmp eax, edx
jae 0x1005ed01
lea eax, [ebp - 8]
mov dword [0x100a01e0], edx
push eax
push 0x40
push 1
push 0x410660
mov byte [0x100a01e6], 0
call esi
push 0
mov byte [0x410660], 0x83
push dword [ebp - 8]
push 1
push 0x410660
call esi
mov byte [0x100a01e5], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1007e605
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10066dd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x1009c018]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [0x100a0548]
push ebx
push esi
push edi
cmp byte [eax + 0x44], 0
je 0x10066f94
push 0x61
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x10066e42
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.v.size__:
call fcn.10007cb0
mov ecx, dword [0x1009c120]
mov esi, eax
sub ecx, dword [0x1009c11c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
mov dl, 0xa
mov ecx, eax
call fcn.10009040
mov ecx, dword [0x1009c120]
mov eax, 0x2aaaaaab
mov esi, dword [0x1009c11c]
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 3
jb 0x10066f94
xor ebx, ebx
add eax, 0xfffffffd
je 0x10066f94
xor edi, edi
nop word [eax + eax]
mov eax, dword [0x1009c02c]
movss xmm3, dword [edi + esi]
movss xmm2, dword [edi + esi + 4]
movss xmm1, dword [edi + esi + 8]
movups xmm0, xmmword [edi + esi + 0xc]
movss dword [esp + 0x20], xmm3
subss xmm3, dword [eax + 0x25674]
movss dword [esp + 0x24], xmm2
subss xmm2, dword [eax + 0x25678]
movss dword [esp + 0x28], xmm1
subss xmm1, dword [eax + 0x2567c]
mulss xmm3, xmm3
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm3, xmm2
movups xmmword [esp + 0x2c], xmm0
movss xmm0, dword [edi + esi + 0x1c]
movss dword [esp + 0x3c], xmm0
movss xmm0, dword [edi + esi + 0x20]
addss xmm3, xmm1
movss dword [esp + 0x40], xmm0
movaps xmm0, xmm3
call fcn.10005c10
mov eax, dword [0x100a0558]
comiss xmm0, dword [eax + 0xc]
ja 0x10066f6b
mov eax, dword [0x100a0550]
lea edx, [esp + 0x1c]
mov dword [esp + 0xc], 0x3f800000
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
movss xmm0, dword [eax + 0xc]
mov eax, 0x493530
movss dword [esp + 0x18], xmm0
call eax
mov eax, dword [0x100a054c]
lea edx, [esp + 0x20]
movzx eax, byte [eax + 0x44]
push eax
mov eax, dword [0x100a0554]
movzx eax, byte [eax + 0x44]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.10066ab0
mov esi, dword [0x1009c11c]
add esp, 0xc
mov ecx, dword [0x1009c120]
mov eax, 0x2aaaaaab
sub ecx, esi
add ebx, 3
imul ecx
add edi, 0x24
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, 0xfffffffd
add eax, edx
cmp ebx, eax
jb 0x10066e80
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1007e605
mov esp, ebp
pop ebp
ret
Function at 0x100670f0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], edx
movss dword [ebp - 0xc], xmm3
movss dword [ebp - 0x10], xmm2
movss dword [ebp - 0x14], xmm1
mov dword [ebp - 8], ecx
pushal
push dword [ebp - 4]
mov eax, dword [ebp - 8]
sub esp, 0x20
fld dword [ebp + 0x18]
fstp dword [esp + 0x1c]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fld dword [ebp + 0x10]
fstp dword [esp + 0x14]
fld dword [ebp + 0xc]
fstp dword [esp + 0x10]
fld dword [ebp + 8]
fstp dword [esp + 0xc]
fld dword [ebp - 0xc]
fstp dword [esp + 8]
fld dword [ebp - 0x10]
fstp dword [esp + 4]
fld dword [ebp - 0x14]
fstp dword [esp]
call dword [0x1009077c]
add esp, 0x24
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007a620
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1009c018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, cl
mov ecx, str.1_kej_bhop_nodelay
push esi
call fcn.1000b6e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1007a68f
cmp bl, 1
jne 0x1007a651
xor bh, bh
jmp 0x1007a656
mov eax, dword [eax]
mov bh, byte [eax + 0x44]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x407dae
call esi
test bh, bh
mov eax, 0x10093874
mov ecx, 0x1009386c
mov edx, 0x407dae
cmovne ecx, eax
push 0
mov eax, dword [ecx]
mov dword [edx], eax
mov ax, word [ecx + 4]
mov word [edx + 4], ax
push dword [ebp - 8]
push 6
push edx
call esi
mov ecx, str.1_kej_bhop
call fcn.1000b6e0
test eax, eax
je 0x1007a6e4
cmp bl, 1
jne 0x1007a6a6
xor bl, bl
jmp 0x1007a6ab
mov eax, dword [eax]
mov bl, byte [eax + 0x44]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x407ddc
call esi
test bl, bl
mov eax, 0x10093884
mov ecx, 0x1009387c
mov edx, 0x407ddc
cmovne ecx, eax
push 0
mov eax, dword [ecx]
mov dword [edx], eax
mov ax, word [ecx + 4]
mov word [edx + 4], ax
push dword [ebp - 8]
push 6
push edx
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1007e605
mov esp, ebp
pop ebp
ret
Function at 0x1007b170
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100846c9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1009c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bh, dl
mov bl, cl
cmp dword [0x1009fce4], 0
mov byte [ebp - 0x14], bl
jne 0x1007b1e5
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.R_RemoveInput_
call fcn.10007cb0
push dword [ebp - 0x14]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool_]
mov edx, str._:_called_without_imgui_context__n
mov ecx, eax
call fcn.10007cb0
push str.R_RemoveInput__:_called_without_imgui_context__n
push 7
call fcn.1000ae90
add esp, 8
jmp 0x1007b36f
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1009cb2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100a3b8c]
cmp eax, dword [ecx + 4]
jle 0x1007b22b
push 0x100a3b8c
call fcn.1007e746
add esp, 4
cmp dword [0x100a3b8c], 0xffffffff
jne 0x1007b22b
mov dword [ebp - 4], 0xffffffff
push 0x100a3b8c
call fcn.1007e6fc
add esp, 4
mov eax, dword [0x1009fce4]
test bl, bl
je 0x1007b2c0
mov byte [eax + 0xb0], 1
mov byte [eax + 0x350], 1
mov eax, dword [0x1009fcfc]
test eax, eax
je 0x1007b264
add eax, 0x79918
mov dword [ebp - 0x14], eax
push 0
call dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x1007b26d
mov eax, dword [0x1009c100]
mov byte [eax + 0xd], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x4631b0
call esi
push 0
mov byte [0x4631b0], 0xc3
push dword [ebp - 0x14]
push 1
push 0x4631b0
call esi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x467eb0
call esi
push 0
mov byte [0x467eb0], 0xc3
push dword [ebp - 0x14]
push 1
push 0x467eb0
call esi
jmp 0x1007b36f
mov byte [eax + 0xb0], 0
mov byte [eax + 0x350], 0
mov eax, dword [0x1009fcfc]
test eax, eax
je 0x1007b2ec
add eax, 0x79918
mov dword [ebp - 0x14], eax
push 1
call dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x18], eax
jmp 0x1007b2f5
mov eax, dword [0x1009c100]
mov byte [eax + 0xd], 1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x4631b0
call esi
push 0
mov byte [0x4631b0], 0x51
push dword [ebp - 0x14]
push 1
push 0x4631b0
call esi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x467eb0
call esi
push 0
mov byte [0x467eb0], 0x8b
push dword [ebp - 0x14]
push 1
push 0x467eb0
call esi
test bh, bh
je 0x1007b36f
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x1009c104
call fcn.10008010
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
call fcn.1000eaa0
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007e605
mov esp, ebp
pop ebp
ret
Function at 0x1007b700
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1007b8b0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1007b7cd
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1007b74a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1009c004]
ja 0x1007b74a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1007b71a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1007b770
jmp 0x1007b7cd
cmp dword [ebp - 0x14], 0x10000
jne 0x1007b7b3
cmp dword [ebp - 0x18], 0x10000
jb 0x1007b7b3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1007b7a6
mov eax, dword [ebp - 8]
jmp 0x1007b7cf
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1007b7c8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1007b8b0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1007b71a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1007b7e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1007b8e0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1007b8a5
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1007b825
mov eax, dword [ebp - 4]
cmp eax, dword [0x1009c004]
ja 0x1007b825
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1007b7f5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1007b84b
jmp 0x1007b8a5
cmp dword [ebp - 0x14], 0x10000
jne 0x1007b88e
cmp dword [ebp - 0x18], 0x10000
jb 0x1007b88e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1007b881
mov eax, dword [ebp - 8]
jmp 0x1007b8a7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1007b8a0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1007b8e0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1007b7f5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x402b00
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Resume thread
Terminate process
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb3c
mov eax, dword [0x430010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x808]
push 0x400
push eax
push 0
mov esi, dword [edi + 0x3c]
add esi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [esi], 0x4550
jne 0x402bf7
push 0x44
lea eax, [ebp - 0x850]
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x860], xmm0
call fcn.0040a520
add esp, 0xc
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x850]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402bf7
lea eax, [ebp - 0xb30]
mov dword [ebp - 0xb30], 0x10007
push eax
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x402bf7
push 0x40
push 0x3000
push dword [esi + 0x50]
push dword [esi + 0x34]
push dword [ebp - 0x860]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xb38], eax
test eax, eax
jne 0x402c0d
call fcn.00405860
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00403470
push eax
call fcn.00405b10
add esp, 4
push 0
push dword [ebp - 0x860]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408a84
mov esp, ebp
pop ebp
ret
push 0
push dword [esi + 0x54]
push edi
push eax
push dword [ebp - 0x860]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
mov dword [ebp - 0xb34], 0
cmp ax, word [esi + 6]
jae 0x402c7e
xor ebx, ebx
mov ecx, dword [edi + 0x3c]
add ecx, ebx
push 0
push dword [ecx + edi + 0x108]
mov eax, dword [ecx + edi + 0x10c]
add eax, edi
push eax
mov eax, dword [ecx + edi + 0x104]
add eax, dword [ebp - 0xb38]
push eax
push dword [ebp - 0x860]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0xb34]
add ebx, 0x28
movzx eax, word [esi + 6]
inc ecx
mov dword [ebp - 0xb34], ecx
cmp ecx, eax
jl 0x402c34
push 0
push 4
lea eax, [esi + 0x34]
push eax
mov eax, dword [ebp - 0xa8c]
add eax, 8
push eax
push dword [ebp - 0x860]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [esi + 0x28]
add eax, dword [ebp - 0xb38]
mov dword [ebp - 0xa80], eax
lea eax, [ebp - 0xb30]
push eax
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0x85c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408a84
mov esp, ebp
pop ebp
ret
Function at 0x406878
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00406854
pop esi
leave
ret 8

Function at 0x406a63
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
push 0x105
call fcn.004068c8
mov edi, eax
test edi, edi
jne 0x406a8a
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov eax, esi
jmp 0x406ad3
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebx, 0xffffffff
cmp eax, ebx
je 0x406ace
test al, 0x10
je 0x406ace
test eax, 0x400
je 0x406aca
push 0x2000000
push 0x80
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00406ad9
push dword [ebp - 4]
mov esi, eax
call fcn.00406904
test esi, esi
jne 0x406ace
xor edx, edx
jmp 0x406ad0
mov edx, ebx
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x407c04
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x407c25
jl 0x407c1c
test edi, edi
jne 0x407c25
xor eax, eax
xor edx, edx
jmp 0x407ce6
cmp dword [ebx + 0x38], 0
je 0x407c3a
push eax
push edi
push dword [ebp + 8]
call fcn.00407cec
jmp 0x407ce6
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x407c81
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x407c81
cmp eax, edi
jb 0x407c5b
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00409f80
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x407c87
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x407cdb
mov ecx, ebx
call fcn.004074a4
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x407cc6
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.004105a8
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x407cdb
jmp 0x407c99
test edx, edx
je 0x407cdb
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004105a8
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x409761
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4097a0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4097a0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4097a0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4097a0
cmp dword [ecx + 0x74], 0xe
jbe 0x4097a0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x417c49
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x429130
push 0x429128
push str.FlsAlloc
push 0x1f
call fcn.00417b11
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417c7d
push dword [ebp + 8]
mov ecx, esi
call dword [0x425178]
call esi
jmp 0x417c83
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x417cc7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x429140
push 0x429138
push str.FlsGetValue
push 0x21
call fcn.00417b11
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417cfe
push dword [ebp + 8]
mov ecx, esi
call dword [0x425178]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x417d06
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x429148
push 0x429140
push str.FlsSetValue
push 0x22
call fcn.00417b11
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417d40
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x425178]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]