joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100103c0
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], 0x53
mov dword [ebp - 0x38], 0x56
mov dword [ebp - 0x34], 0x57
mov dword [ebp - 0x30], 0x55
mov dword [ebp - 0x2c], 0x81
mov dword [ebp - 0x28], 0xc4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xff
mov dword [ebp - 0x1c], 0xff
mov dword [ebp - 0x18], 0xff
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
jmp 0x1001042f
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0x40
cmp dword [ebp - 0x44], ecx
jge 0x10010460
push 0xa
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x44]
push eax
call fcn.1000ff00
add esp, 0xc
test eax, eax
je 0x1001045e
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
jmp 0x10010460
jmp 0x10010426
cmp dword [ebp - 0x48], 0
jne 0x10010482
push 0
push 0x1004b8f8
push str.0x90050001
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 0x14], 0x60
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], 0x51
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0xe8
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0xe9
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x40], eax
push 0xf
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x40]
push eax
call fcn.10043eb0
add esp, 0xc
push 0xa
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call fcn.1000e150
add esp, 0xc
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
add eax, 9
mov ecx, 0x1000efa0
sub ecx, eax
mov edx, dword [ebp - 0x40]
mov dword [edx + 5], ecx
mov eax, dword [ebp - 0x40]
add eax, 0xf
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
mov edx, dword [ebp - 0x40]
mov dword [edx + 0xb], ecx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x10010530
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x64], 0xe8
mov dword [ebp - 0x60], pe_nt_image_headers32
mov dword [ebp - 0x5c], pe_nt_image_headers32
mov dword [ebp - 0x58], pe_nt_image_headers32
mov dword [ebp - 0x54], pe_nt_image_headers32
mov dword [ebp - 0x50], 0x84
mov dword [ebp - 0x4c], 0xc0
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x44], 0x85
mov dword [ebp - 0x40], pe_nt_image_headers32
mov dword [ebp - 0x3c], pe_nt_image_headers32
mov dword [ebp - 0x38], pe_nt_image_headers32
mov dword [ebp - 0x34], pe_nt_image_headers32
mov dword [ebp - 0x30], 0x8b
mov dword [ebp - 0x2c], 0x45
mov dword [ebp - 0x28], 0xfc
mov dword [ebp - 0x24], 0x8b
mov dword [ebp - 0x20], 0x74
mov dword [ebp - 0x1c], 0x98
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
jmp 0x100105e5
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0x40
cmp dword [ebp - 0x70], ecx
jge 0x10010616
push 0x14
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x70]
push eax
call fcn.1000ff00
add esp, 0xc
test eax, eax
je 0x10010614
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x70]
mov dword [ebp - 0x6c], ecx
jmp 0x10010616
jmp 0x100105dc
cmp dword [ebp - 0x6c], 0
jne 0x10010624
or eax, 0xffffffff
jmp 0x1001070a
mov dword [ebp - 0x74], 0
mov edx, dword [ebp - 0x6c]
cmp dword [edx], 0x83ec8b55
je 0x1001065d
cmp dword [ebp - 0x74], 0x200
jbe 0x10010649
mov eax, 0xfffffffe
jmp 0x1001070a
mov eax, dword [ebp - 0x74]
add eax, 1
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x6c]
sub ecx, 1
mov dword [ebp - 0x6c], ecx
jmp 0x1001062b
mov edx, 1
test edx, edx
je 0x10010708
mov byte [ebp - 0x14], 0x60
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], 0x51
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0xe8
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0xc3
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x68], eax
push 0xf
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x68]
push ecx
call fcn.10043eb0
add esp, 0xc
push 6
mov edx, dword [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x6c]
push eax
call fcn.1000e150
add esp, 0xc
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x68]
add ecx, 9
mov edx, 0x1000fe00
sub edx, ecx
mov eax, dword [ebp - 0x68]
mov dword [eax + 5], edx
mov ecx, dword [ebp - 0x68]
add ecx, 0xf
mov edx, dword [ebp - 0x78]
sub edx, ecx
mov eax, dword [ebp - 0x68]
mov dword [eax + 0xb], edx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x10011050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x100110a0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100110a0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push eax
push str.Critical_Error:_Addr__x_Code__x
push 0x100b1f90
call fcn.1001d650
add esp, 0x10
push 0
push 0x1004b9cc
push 0x100b1f90
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
push 0x1004b9d4
push str.Critical_Error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10014400
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10014421
mov eax, 0xfffffff7
jmp 0x1001454d
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov eax, 1
test eax, eax
je 0x10014484
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0xf8]
mov dword [ebp - 0x20], ecx
mov edx, 0x28
imul eax, edx, 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x14], edx
mov eax, 0x28
imul ecx, eax, 0
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + ecx + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], 0
jne 0x10014494
mov eax, 0xfffffff6
jmp 0x1001454d
cmp dword [ebp - 0x18], 0
jne 0x100144a4
mov eax, 0xfffffff5
jmp 0x1001454d
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xde
mov dword [ebp - 0xc], 0
jmp 0x100144c4
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x10]
sub edx, 0x20
cmp dword [ebp - 0xc], edx
jge 0x100144fb
mov eax, dword [ebp - 0x10]
push eax
push 0x10058068
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0xc]
push ecx
call fcn.100143b0
add esp, 0xc
test eax, eax
je 0x100144f9
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jmp 0x100144fb
jmp 0x100144bb
cmp dword [ebp - 4], 0
je 0x10014540
lea eax, [ebp - 0x24]
push eax
push 0x40
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
push eax
push 0x10058148
mov ecx, dword [ebp - 4]
push ecx
call fcn.10043eb0
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x1001454a
xor eax, eax
jmp 0x1001454d
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x10015880
Capabilities:
Connect pipe
Create pipe
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], ecx
push 0
push 0x1f4
push 0x80
push 0x80
push 0xff
push 0
push 0x40001
push str..pipe_softdenchi_login
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffffffff
je 0x10015929
push 0
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1001590f
mov dword [ebp - 0x114], 0
push 0
lea ecx, [ebp - 0x114]
push ecx
push pe_nt_image_headers32
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.1001c684
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x10015a40
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push str.MaiSfDummyEp_called_r_n
call fcn.1001c721
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x50]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 1
jmp 0x10015a8b
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x14]
sub eax, 0xa
cmp dword [ebp - 8], eax
jge 0x10015aff
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx]
and edx, 0xff
cmp edx, 0xe8
jne 0x10015afd
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
movsx ecx, byte [eax + 5]
and ecx, 0xff
cmp ecx, 0xe9
jne 0x10015afd
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
movsx eax, byte [edx - 1]
and eax, 0xff
cmp eax, 0xc3
jne 0x10015afd
mov ecx, dword [ebp - 8]
push ecx
push str.oep_t1:__x_r_n
call fcn.1001c721
add esp, 8
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
call dword [ebp - 0x20]
jmp 0x10015c08
jmp 0x10015a82
mov dword [ebp - 0xc], 1
jmp 0x10015b11
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0xa
cmp dword [ebp - 0xc], ecx
jge 0x10015b85
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
movsx eax, byte [edx]
and eax, 0xff
cmp eax, 0xe8
jne 0x10015b83
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
movsx edx, byte [ecx + 5]
and edx, 0xff
cmp edx, 0xe9
jne 0x10015b83
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movsx ecx, byte [eax - 1]
and ecx, 0xff
cmp ecx, 0xcc
jne 0x10015b83
mov edx, dword [ebp - 0xc]
push edx
push str.oep_t2:__x_r_n
call fcn.1001c721
add esp, 8
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
call dword [ebp - 0x24]
jmp 0x10015c08
jmp 0x10015b08
mov dword [ebp - 0x10], 1
jmp 0x10015b97
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0xa
cmp dword [ebp - 0x10], edx
jge 0x10015c08
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
and ecx, 0xff
cmp ecx, 0xe8
jne 0x10015c06
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
movsx eax, byte [edx + 5]
and eax, 0xff
cmp eax, 0xe9
jne 0x10015c06
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
movsx edx, byte [ecx + 0xa]
and edx, 0xff
cmp edx, 0xcc
jne 0x10015c06
mov eax, dword [ebp - 0x10]
push eax
push str.oep_t3:__x_r_n
call fcn.1001c721
add esp, 8
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
call dword [ebp - 0x28]
jmp 0x10015c08
jmp 0x10015b8e
mov esp, ebp
pop ebp
ret
Function at 0x10017370
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x10015c30
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
call fcn.10044060
add esp, 8
mov dword [0x1010a2dc], eax
mov dword [0x1010a2d8], 1
push str.protect.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10], eax
mov dword [0x1010a2d8], 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10015e80
add esp, 4
call fcn.10016780
mov edx, 1
test edx, edx
je 0x10017449
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x28]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0xc]
push edx
push 0x40
push 5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov byte [eax + edx], 0xe9
mov ecx, dword [ebp - 4]
add ecx, 5
mov edx, sym.Mai_KF.dll_MaiSfDummyEp
sub edx, ecx
mov eax, dword [ebp - 4]
mov dword [eax + 1], edx
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100183d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1010e2f0], 0
je 0x10018497
mov byte [ebp - 0x18], 0x9c
mov byte [ebp - 0x17], 0x60
mov byte [ebp - 0x16], 0x50
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0x13], 0x52
mov byte [ebp - 0x12], 0xe8
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x9d
mov byte [ebp - 0xb], 0xe9
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1c], eax
push 0x12
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10043eb0
add esp, 0xc
mov edx, dword [ebp - 0x1c]
add edx, 0xb
mov eax, 0x10017ca0
sub eax, edx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 7], eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [0x1010e2f0]
push eax
call fcn.10044060
add esp, 8
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x12
mov edx, dword [ebp - 0x20]
sub edx, ecx
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xe], edx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x10044060
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp byte [edi], 0xeb
jne 0x1004409b
mov edi, edi
movsx eax, byte [edi + 1]
add edi, 2
push str.jmp_short_rehook_r_n
add edi, eax
call fcn.1001c721
add esp, 4
cmp byte [edi], 0xeb
je 0x10044080
sub esi, edi
mov byte [ebp - 0xc], 0xe9
sub esi, 5
push str.kernel32.dll
mov dword [ebp - 0xb], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x100440cc
push 0x100550ec
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
mov ecx, edi
sub ecx, ebx
sub ecx, 5
push 1
mov dword [ebp - 0x20], ecx
call fcn.1001c60e
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
xor esi, esi
mov cl, byte [edi + esi]
lea edx, [edi + esi]
mov al, byte [edi + esi + 1]
cmp cl, 0x6a
jne 0x10044128
add esi, 2
jmp 0x100441b5
cmp cl, 0xfc
je 0x100441b4
cmp cl, 0x68
jne 0x1004413b
add esi, 5
jmp 0x100441b5
cmp cl, 0xc2
jne 0x10044145
add esi, 3
jmp 0x100441b5
cmp cl, 0x90
je 0x100441b4
cmp cl, 0x40
je 0x100441b4
cmp cl, 0xc3
je 0x100441b4
cmp cl, 0xff
jne 0x10044162
cmp al, 0x15
jne 0x1004417a
add esi, 6
jmp 0x100441b5
cmp cl, 0x64
jne 0x10044170
cmp al, 0xa1
jne 0x1004417a
add esi, 6
jmp 0x100441b5
cmp cl, 0xe8
je 0x100441a7
cmp cl, 0xe9
je 0x100441a7
mov eax, dword [0x1010f11c]
test eax, eax
je 0x1004418b
push edx
call eax
mov dword [ebp - 0x10], eax
jmp 0x1004419b
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
push edx
call fcn.10044490
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10044234
add esi, eax
jmp 0x100441b5
mov eax, edi
sub eax, ebx
add dword [edi + esi + 1], eax
add esi, 5
jmp 0x100441b5
inc esi
cmp esi, 5
jb 0x10044111
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100441ce
push eax
call fcn.1001c684
add esp, 4
push esi
push edi
push ebx
call fcn.10043eb0
push 4
lea eax, [ebp - 0x20]
mov byte [esi + ebx], 0xe9
push eax
lea eax, [ebx + 1]
add eax, esi
push eax
call fcn.10043eb0
push 5
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.10043eb0
add esi, 0xfffffffb
lea eax, [edi + 5]
push esi
push 0x90
push eax
call fcn.10043f30
add esp, 0x30
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x14]
push 0x10
push edi
cmp edi, dword [ebp - 0x18]
je 0x10044250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
push 0
push str.Error
push str.Critical_Error:_Disassembler_got_size_zero____
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call ebx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x10044a60
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 8
mov edi, ecx
call fcn.1001c60e
push 8
mov esi, eax
push 0
push esi
call fcn.10043f30
add esp, 0x10
mov dword [esi], edi
mov dword [esi + 4], 1
push dword [edi + 0x18]
push dword [edi + 0x14]
push esi
push dword [edi + 0xc]
push dword [edi + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x1c], eax
pop edi
pop esi
test eax, eax
je 0x10044aa5
xor eax, eax
ret
push 0
push str.Error
push str.CreateThread_Error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
ret

Function at 0x10044e70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x10044ee0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10044efc
or eax, 0xffffffff
pop esi
pop ebp
ret 4
cmp dword [esi + 8], 0xffffffff
jne 0x10044ef4
push edi
mov edi, dword [ebp + 8]
push 0xb
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x10044f54
mov eax, dword [esi + 4]
test eax, eax
je 0x10044f26
push eax
lea ecx, [esi + 0xc]
call fcn.10047a00
push edi
call fcn.10043a90
add esp, 4
lea ecx, [esi + 0xc]
lea eax, [eax*2 + 2]
push eax
call fcn.10047960
push edi
push eax
mov dword [esi + 4], eax
call fcn.10043a30
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 4

Function at 0x10044fc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ecx + 8]
cmp edx, 0xffffffff
jne 0x10044fd4
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10045130
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ecx + 8]
cmp edx, 0xffffffff
jne 0x10045144
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10045910
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, ecx
push edi
mov dword [ebp - 0x14], eax
lea ebx, [esi + 9]
mov dword [ebp - 0x2c], ebx
mov edi, ebx
test bl, 0x3f
je 0x10045937
and edi, 0xffffffc0
add edi, 0x40
mov dword [ebp - 0x2c], edi
add eax, 0x200
push edi
mov ecx, eax
mov dword [ebp - 0x38], eax
call fcn.10047960
push esi
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
push eax
call fcn.10043eb0
mov eax, dword [ebp + 0xc]
mov ecx, edi
sub ecx, ebx
mov ebx, eax
push ecx
push 0
mov byte [eax + esi], 0x80
lea eax, [esi + 1]
add eax, ebx
push eax
call fcn.10043f30
lea eax, [esi*8]
mov dword [ebp - 0xc], 0
cdq
add esp, 0x18
mov dword [ebx + edi - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + edi - 4], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
test edi, edi
jle 0x10045ae5
mov eax, dword [ebp - 0x14]
mov ecx, 0x67452301
add eax, 0x100
mov dword [ebp - 0x1c], ecx
mov edx, 0xefcdab89
mov dword [ebp - 0x30], eax
mov edi, 0x98badcfe
mov dword [ebp - 0x20], edx
mov ebx, 0x10325476
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], ebx
lea ebx, [ebx]
mov esi, edx
mov dword [ebp - 0x18], ecx
mov edx, edi
mov dword [ebp - 4], 5
xor edi, edi
mov dword [ebp + 8], 1
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x10045a03
mov edx, dword [ebp - 0x24]
cmp edi, 0x10
jge 0x10045a18
mov eax, esi
mov ecx, edx
not eax
and ecx, esi
and eax, ebx
or eax, ecx
mov ecx, edi
jmp 0x10045a4f
mov eax, ebx
cmp edi, 0x20
jge 0x10045a2e
not eax
mov ecx, ebx
and ecx, esi
and eax, edx
or eax, ecx
mov ecx, dword [ebp + 8]
jmp 0x10045a42
cmp edi, 0x30
jge 0x10045a3c
mov ecx, dword [ebp - 4]
xor eax, edx
xor eax, esi
jmp 0x10045a42
not eax
or eax, esi
xor eax, edx
and ecx, 0x8000000f
jns 0x10045a4f
dec ecx
or ecx, 0xfffffff0
inc ecx
mov dword [ebp - 0x34], ebx
mov ebx, edx
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], 7
add dword [ebp - 4], 3
mov dword [ebp - 0x24], esi
lea edx, [edx + ecx*4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [edx + ecx]
mov ecx, dword [ebp - 0x30]
add edx, dword [ecx + edi*4]
add edx, eax
mov eax, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov ecx, dword [eax + edi*4]
inc edi
mov eax, dword [ebp - 0x34]
rol edx, cl
mov ecx, dword [ebp + 8]
add esi, edx
add ecx, 5
mov dword [ebp - 0x18], eax
mov dword [ebp + 8], ecx
cmp ecx, 0x141
mov ecx, dword [ebp - 8]
jl 0x10045a00
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, eax
mov eax, dword [ebp + 0x10]
add edx, esi
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x10]
add edi, dword [ebp - 0x24]
add esi, ebx
mov dword [eax], ecx
mov ebx, esi
mov dword [eax + 4], edx
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
mov eax, dword [ebp - 0xc]
add eax, 0x40
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x2c]
jl 0x100459e0
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x38]
push ebx
call fcn.10047a00
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc