joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410e30
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov esi, ecx
push 0x20
pop ecx
mov dword [esi], eax
cmp eax, ecx
jbe 0x410e45
mov dword [esi], ecx
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [esi], ebx
jne 0x410e50
mov dword [esi], edi
cmp dword [esi], ecx
jbe 0x410e56
mov dword [esi], ecx
push ebx
push ecx
push ebx
push ebx
mov byte [esi + 0x190], bl
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push ebx
push edi
push edi
push ebx
mov dword [esi + 0x194], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x198], eax
lea eax, [esi + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [esi + 0x194], ebx
je 0x410e99
cmp dword [esi + 0x198], ebx
jne 0x410eb4
push str._nThread_pool_initialization_failed.
mov edi, 0x42e76c
push edi
call fcn.004063d8
pop ecx
pop ecx
push 2
mov ecx, edi
call fcn.00406494
mov dword [esp + 0x14], ebx
cmp dword [esi], ebx
jbe 0x410f29
push ebp
lea ebp, [esi + 4]
lea eax, [esp + 0x10]
push eax
push ebx
push esi
push 0x410de7
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, ebx
jne 0x410f05
push str.CreateThread_failed
push 0x42e76c
call fcn.004063d8
pop ecx
pop ecx
mov ecx, 0x42e76c
call fcn.00401000
push 2
mov ecx, 0x42e76c
call fcn.00406494
mov dword [ebp], edi
mov eax, dword [0x44a744]
cmp eax, ebx
je 0x410f19
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add ebp, 4
cmp eax, dword [esi]
jb 0x410ec0
pop ebp
pop edi
mov dword [esi + 0x188], ebx
mov dword [esi + 0x18c], ebx
mov dword [esi + 0x84], ebx
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x417146
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x425e16
call fcn.00419bc8
push ecx
push ebx
push esi
mov esi, ecx
push 1
lea ecx, [esi + 4]
mov dword [ebp - 0x10], esi
call fcn.004096b6
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
lea ecx, [esi + 0x4b38]
call fcn.00411bfc
lea ecx, [esi + 0x98d0]
call fcn.004125c2
lea ecx, [esi + 0xe678]
mov byte [ebp - 4], 5
call fcn.0040a864
push 1
lea ecx, [esi + 0xe6b0]
mov byte [ebp - 4], 6
call fcn.004096b6
lea eax, [esi + 0xe6c0]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe6d0]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe6e0]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0xa
mov dword [esi], eax
mov dword [esi + 0x4b34], ebx
mov byte [esi + 0x4c38], bl
mov byte [esi + 0x4c48], bl
mov byte [esi + 0x4c49], bl
mov byte [esi + 0x4c4a], bl
mov dword [esi + 0x1c], 1
call fcn.00410f44
push ebx
mov ecx, esi
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0xe6f4], ebx
mov dword [esi + 0xe6f8], ebx
call fcn.00415296
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x418c56
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
test eax, eax
jl 0x418c88
cmp dword [ebp - 4], edi
jne 0x418cc9
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x2710
ja 0x418cc9
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x418c75
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x418c75
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
mov esi, eax
cmp esi, edi
jl 0x418d1f
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x4270e8
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x418d16
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, edi
jl 0x418d0d
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
cmp esi, edi
pop edi
pop esi
setge al
pop ebx
leave
ret 8
Function at 0x4194dd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0x18]
sub esp, 0x10
push ebx
push esi
push edi
push 0
push dword [ebp + 0xc]
mov esi, ecx
mov byte [esi + 0x21], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
mov ecx, esi
call fcn.00419476
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x419544
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push esi
push dword [esi]
sub edi, eax
push 0
push dword [ebp + 0xc]
lea ecx, [eax + 1]
dec edi
mov dword [ebp + 0x18], ecx
dec edi
call ebx
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
push edi
push dword [ebp - 0xc]
xor edi, edi
push dword [ebp + 0x18]
push 0x40000000
push edi
push str.RarHtmlClassName
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
cmp dword [esi + 0xc], edi
jne 0x4195c6
cmp dword [ebp + 0xc], edi
je 0x4195e9
cmp dword [esi + 0x14], edi
jne 0x4195e9
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x4195e9
push eax
mov ecx, esi
call fcn.00419151
mov esi, eax
cmp esi, edi
je 0x4195e9
push 5
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.00419be7
pop ecx
jmp 0x4195e9
cmp eax, edi
je 0x4195dc
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esi + 0x1c], 0x64
jbe 0x4195e9
mov ecx, esi
call fcn.00418e5b
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x4195f0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x4270d8
push 1
xor ebx, ebx
push ebx
push 0x427188
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x4196c1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x427178
push eax
call dword [ecx]
test eax, eax
jl 0x4196b8
cmp byte [ebp + 8], bl
je 0x419643
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x419660
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x419672
push 0x426554
jmp 0x419675
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x41968a
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x41969b
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x4196af
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x4196db
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x41de8b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b2a0]
jne 0x41de95
repz ret
jmp fcn.00422a9b
Function at 0x424345
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041df0c
and dword [ebp - 4], 0
cmp dword [0x44b378], 0
mov ebx, eax
jne 0x4243f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4244a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4244a7
push eax
call fcn.0041de9a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44b378], eax
call esi
push eax
call fcn.0041de9a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44b37c], eax
call esi
push eax
call fcn.0041de9a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44b380], eax
call esi
push eax
call fcn.0041de9a
pop ecx
mov dword [0x44b388], eax
test eax, eax
je 0x4243f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041de9a
pop ecx
mov dword [0x44b384], eax
mov eax, dword [0x44b384]
cmp eax, ebx
je 0x42444e
cmp dword [0x44b388], ebx
je 0x42444e
push eax
call fcn.0041df15
push dword [0x44b388]
mov esi, eax
call fcn.0041df15
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42444e
test edi, edi
je 0x42444e
call esi
test eax, eax
je 0x424445
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424445
test byte [ebp - 0xc], 1
jne 0x42444e
or dword [ebp + 0x10], 0x200000
jmp 0x424487
mov eax, dword [0x44b37c]
cmp eax, ebx
je 0x424487
push eax
call fcn.0041df15
pop ecx
test eax, eax
je 0x424487
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x424487
mov eax, dword [0x44b380]
cmp eax, ebx
je 0x424487
push eax
call fcn.0041df15
pop ecx
test eax, eax
je 0x424487
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44b378]
call fcn.0041df15
pop ecx
test eax, eax
je 0x4244a7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4244a9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e20
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x405203
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4080a8]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
push 0x406598
mov dword [esi], eax
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
push eax
lea ecx, [esi + 4]
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x406596
lea ecx, [esi + 8]
mov dword [esp + 0x18], 0
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x406597
lea ecx, [esi + 0xc]
mov byte [esp + 0x18], 1
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x40659d
lea ecx, [esi + 0x10]
mov byte [esp + 0x18], 2
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x40659e
lea ecx, [esi + 0x14]
mov byte [esp + 0x18], 3
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x40659f
lea ecx, [esi + 0x18]
mov byte [esp + 0x18], 4
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x4065a0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 5
call dword [sym.imp.mfc90.dll_Ordinal_310]
push 0x4065a1
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 6
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x403f70
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
mov edi, dword [sym.imp.MSVCR90.dll_getenv]
mov esi, ecx
push str.SDD_HOME
lea ebp, [esi + 0xc]
call edi
add esp, 4
push eax
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [ebp]
cmp dword [eax - 0xc], 0
jne 0x403fa1
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
push ebx
push str.SDD_PLATFORM
lea ebx, [esi + 0x10]
call edi
add esp, 4
push eax
mov ecx, ebx
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [ebx]
cmp dword [ecx - 0xc], 0
jne 0x403fca
pop ebx
pop edi
pop esi
mov eax, 0xfffffffe
pop ebp
ret
push str.win32
mov ecx, ebx
call dword [sym.imp.mfc90.dll_Ordinal_1603]
test eax, eax
jne 0x403fe7
push 0x5c
push 0x2f
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_5923]
test byte [esi], 1
je 0x404014
push str.SDD_HSSD
lea ebx, [esi + 0x14]
call edi
add esp, 4
push eax
mov ecx, ebx
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edx, dword [ebx]
cmp dword [edx - 0xc], 0
jne 0x404014
pop ebx
pop edi
pop esi
mov eax, 0xfffffffd
pop ebp
ret
test byte [esi], 2
je 0x404041
push str.SDD_PCBIND
lea ebx, [esi + 0x18]
call edi
add esp, 4
push eax
mov ecx, ebx
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jne 0x404041
pop ebx
pop edi
pop esi
mov eax, 0xfffffffc
pop ebp
ret
test byte [esi], 4
je 0x40406e
push str.SDD_WG
lea ebx, [esi + 0x1c]
call edi
add esp, 4
push eax
mov ecx, ebx
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov ecx, dword [ebx]
cmp dword [ecx - 0xc], 0
jne 0x40406e
pop ebx
pop edi
pop esi
mov eax, 0xfffffffb
pop ebp
ret
test byte [esi], 8
je 0x40409b
push str.SDD_XE
add esi, 0x20
call edi
add esp, 4
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edx, dword [esi]
cmp dword [edx - 0xc], 0
jne 0x40409b
pop ebx
pop edi
pop esi
mov eax, 0xfffffffa
pop ebp
ret
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret

Function at 0x40477c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4080a8]
jne 0x404786
repz ret
jmp fcn.00404c23
Function at 0x100010e0
Capabilities:
Write file on windows

Disassembly:
mov ecx, 0x10015170
jmp fcn.10002c30

Function at 0x10001100
Capabilities:
Terminate process

Disassembly:
mov ecx, 0x10015140
jmp fcn.100011d0

Function at 0x10001350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x100140c0]
xor eax, esp
mov dword [esp + 0x20], eax
mov ecx, dword [ecx + 0x2c]
xor al, al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 6], al
mov al, 0x20
mov dl, 0x34
mov byte [esp + 0xd], al
mov byte [esp + 0x11], dl
mov byte [esp + 0x13], dl
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], al
mov byte [esp + 0x1d], al
mov dl, 0xa
lea eax, [esp]
push eax
mov byte [esp + 0x18], dl
mov byte [esp + 0x22], dl
push 0x1b
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x13], 0x1b
mov byte [esp + 0x14], 1
mov byte [esp + 0x15], 0x40
mov byte [esp + 0x16], 0x45
mov byte [esp + 0x17], 0x4a
mov byte [esp + 0x18], 0x4c
mov byte [esp + 0x1a], 0x31
mov byte [esp + 0x1b], 0x32
mov byte [esp + 0x1c], 0x38
mov byte [esp + 0x1e], 0x2e
mov byte [esp + 0x21], 0x40
mov byte [esp + 0x22], 0x45
mov byte [esp + 0x23], 0x4a
mov byte [esp + 0x24], 0x4c
call fcn.10002c30
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1000452a
add esp, 0x24
ret

Function at 0x100015d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x2c]
push 0
push 2
call fcn.10003660
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov edi, eax
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esi + 0x2c]
push edx
mov dword [esp + 0x14], edi
call fcn.10002c30
cmp eax, 1
jne 0x1000166b
test edi, edi
push ebx
push ebp
mov dword [esp + 0x20], 0
jle 0x10001664
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
nop
mov ecx, dword [esi + 0x2c]
push ebx
push ebp
push edi
call fcn.10003910
cmp eax, 1
jne 0x10001669
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 6]
movzx edx, byte [edi + 6]
sub edx, ecx
cmp edx, 0x80
je 0x10001673
push edi
mov ecx, esi
call fcn.100012a0
cmp eax, 1
jne 0x10001669
mov eax, dword [esp + 0x20]
add eax, 1
cmp eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
jl 0x10001620
mov eax, 0x2000020a
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret 0x14
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 8
ret 0x14
Function at 0x10001690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x100140c0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov al, 0x34
mov esi, ecx
mov byte [esp + 0x11], al
mov byte [esp + 0x13], al
mov al, 0xa
mov cl, 0x4c
mov byte [esp + 0x14], al
mov byte [esp + 0x19], al
mov byte [esp + 0x1e], al
mov dl, 0x4a
mov byte [esp + 0xc], cl
mov byte [esp + 0x18], cl
mov byte [esp + 0x1d], cl
mov ecx, dword [esi + 0x10]
lea eax, [esi + 0x14]
push eax
push ecx
mov byte [esp + 0x13], dl
mov byte [esp + 0x1f], dl
mov byte [esp + 0x24], dl
mov edx, dword [esi + 0xc]
push edx
push 0x1b
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 0x1b
mov byte [esp + 0x1c], 1
mov byte [esp + 0x1d], 0x40
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x21], 0x20
mov byte [esp + 0x22], 0x31
mov byte [esp + 0x23], 0x32
mov byte [esp + 0x24], 0x38
mov byte [esp + 0x26], 0x2e
mov byte [esp + 0x29], 0x40
mov byte [esp + 0x2a], 0x45
mov byte [esp + 0x2e], 0x40
mov byte [esp + 0x2f], 0x45
call fcn.100015d0
cmp eax, 1
jne 0x10001784
mov ecx, dword [esi + 0xc]
movzx eax, byte [ecx + 7]
sub eax, 0
je 0x1000177f
sub eax, 1
je 0x1000176a
mov eax, 0x2000020c
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1000452a
add esp, 0x20
ret
mov eax, 0x2000020b
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1000452a
add esp, 0x20
ret
mov eax, 1
mov ecx, dword [esp + 0x20]
pop esi
xor ecx, esp
call fcn.1000452a
add esp, 0x20
ret
Function at 0x10002c30
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 0x24]
cmp eax, 0xffffffff
jne 0x10002c40
mov eax, 0x20000103
ret 0xc
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push 0
push esi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10002c68
pop edi
mov eax, 0x20000104
pop esi
ret 0xc
mov eax, edi
sub eax, dword [esi]
pop edi
neg eax
sbb eax, eax
and eax, 0x20000104
add eax, 1
pop esi
ret 0xc
Function at 0x10003710
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push 0x400
mov dword [esi], vtable.CPortController.0
call fcn.1000443b
add esp, 4
test eax, eax
mov dword [esi + 0x18], eax
jne 0x10003733
push eax
call fcn.10004360
mov ecx, 1
mov eax, 0x7d0
push 3
mov dword [esi + 8], ecx
mov dword [esi + 0x10], ecx
push 3
mov ecx, esi
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 4], 0xa
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
call fcn.10003660
mov eax, esi
pop esi
ret

Function at 0x10003c60
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x100140c0]
xor eax, esp
mov dword [esp + 0x94], eax
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.100044b0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esp + 0x10]
sub ecx, 0
mov eax, 0xa
je 0x10003da9
sub ecx, 1
je 0x10003d35
sub ecx, 1
jne 0x10003dae
mov ecx, dword [esp + 4]
cmp ecx, 4
ja 0x10003d08
mov ecx, dword [esp + 8]
cmp ecx, 0x33
jne 0x10003ce8
lea eax, [ecx - 0x2c]
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.1000452a
add esp, 0x98
ret
test ecx, ecx
jne 0x10003dae
lea eax, [ecx + 8]
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.1000452a
add esp, 0x98
ret
cmp ecx, 5
jne 0x10003dae
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x10003dae
lea eax, [ecx + 9]
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.1000452a
add esp, 0x98
ret
cmp dword [esp + 4], 4
jne 0x10003dae
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x10003d66
xor eax, eax
cmp byte [esp + 0x15], 0x43
sete al
add eax, 2
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.1000452a
add esp, 0x98
ret
cmp ecx, eax
jne 0x10003d8c
xor eax, eax
cmp byte [esp + 0x15], 0x41
sete al
add eax, 4
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.1000452a
add esp, 0x98
ret
cmp ecx, 0x5a
jne 0x10003dae
lea eax, [ecx - 0x54]
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.1000452a
add esp, 0x98
ret
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.1000452a
add esp, 0x98
ret

Function at 0x1000452a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100140c0]
jne 0x10004534
repz ret
jmp fcn.10006b35
Function at 0x10005bd8
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x100140e0]
je 0x10005bf3
inc edi
cmp edi, 0x17
jb 0x10005be4
cmp edi, 0x17
jae 0x10005d73
push ebp
push 3
call fcn.1000b9d9
cmp eax, 1
pop ecx
je 0x10005d3f
push 3
call fcn.1000b9d9
test eax, eax
pop ecx
jne 0x10005c27
cmp dword [0x10015208], 1
je 0x10005d3f
cmp ebx, 0xfc
je 0x10005d72
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10015228
push ebp
call fcn.1000b693
add esp, 0xc
test eax, eax
je 0x10005c5d
push esi
push esi
push esi
push esi
push esi
call fcn.10005f62
add esp, 0x14
push 0x104
mov esi, 0x10015241
push esi
push 0
mov byte [0x10015345], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10005ca1
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000b693
add esp, 0xc
test eax, eax
je 0x10005ca1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10005f62
add esp, 0x14
push esi
call fcn.10006db0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10005ce6
push esi
call fcn.10006db0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1001553c
push 0x10010954
sub ecx, eax
push ecx
push eax
call fcn.1000b926
add esp, 0x14
test eax, eax
je 0x10005ce6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10005f62
add esp, 0x14
jmp 0x10005ce8
xor esi, esi
push 0x10010950
push ebx
push ebp
call fcn.1000b8b5
add esp, 0xc
test eax, eax
je 0x10005d08
push esi
push esi
push esi
push esi
push esi
call fcn.10005f62
add esp, 0x14
push dword [edi*8 + 0x100140e4]
push ebx
push ebp
call fcn.1000b8b5
add esp, 0xc
test eax, eax
je 0x10005d2a
push esi
push esi
push esi
push esi
push esi
call fcn.10005f62
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1000b6f8
add esp, 0xc
jmp 0x10005d72
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10005d72
cmp ebp, 0xffffffff
je 0x10005d72
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x100140e4]
push dword [esi]
call fcn.10006db0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x10008890
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x100088cb
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x100088b2
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x100088c3
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x100088cd
inc edi
add eax, 0x28
cmp edi, esi
jb 0x100088a8
xor eax, eax
pop edi
pop esi
ret