joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4be130
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00457fe0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00458060
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00458060
lea ecx, [esi + 0xc]
call fcn.004af516
lea ecx, [esi + 0x10]
call fcn.004af516
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0045a890
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0045a890
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0045a890
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004af58b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004af58b
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4590d8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4be358
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4590e8
call fcn.00459600
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4591cb
cmp byte [edi], 0
je 0x4591cb
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x45910d
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00457e00
test eax, eax
jne 0x45912d
push 0x73c564
lea ecx, [esi + 0x38]
call fcn.004af6c8
jmp 0x4591cb
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00457e50
test eax, eax
jne 0x45915c
mov ecx, esi
call fcn.00457f50
push edi
add esi, 0x38
push 0x73c540
push esi
call fcn.004ad38f
add esp, 0xc
jmp 0x4591cb
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00459e80
test eax, eax
je 0x4591c4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004592a0
test eax, eax
jne 0x4591e0
push edi
lea eax, [esi + 0x38]
push 0x73c51c
push eax
call fcn.004ad38f
add esp, 0xc
mov ecx, esi
call fcn.00459600
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x459288
mov ecx, dword [0x740d00]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.004ad38f
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00457f00
test eax, eax
jne 0x45924a
push 0x73c500
lea ecx, [esi + 0x38]
call fcn.004af6c8
jmp 0x45925a
push 0xfa
mov ecx, esi
call fcn.00459e80
test eax, eax
jne 0x459277
mov ecx, esi
call fcn.00459600
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004af58b
jmp 0x4591cb
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004af58b
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x45b3f0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x45b493
test eax, eax
jbe 0x45b493
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x45b493
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45b43e
xor esi, esi
jmp 0x45b444
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45b46f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0045d3d0
add esi, eax
push esi
mov ebx, esi
call fcn.0045d3d0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x45b450
pop ebp
test edi, edi
pop edi
jne 0x45b493
test ebx, ebx
je 0x45b493
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0049eb30
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x45b5d5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45b6ed
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45b6ed
mov eax, dword [esi + 0x3c]
push eax
call fcn.004b0f8f
mov esi, eax
test esi, esi
je 0x45b6ed
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45b6ed
mov ecx, esi
call fcn.0045b540
cmp edi, eax
jge 0x45b6ed
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x45b673
mov dword [esp + 0x34], 1
jmp 0x45b6ce
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45b6ed
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0045aae0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x45df90
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.0045dd90
pop edi
add esp, 0x104
ret 4
Function at 0x46a3e0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x46a413
push esi
call fcn.0046f0d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x46a40c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x46a499
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x46a482
mov eax, dword [esi + 8]
test eax, eax
je 0x46a437
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x46a47e
cmp eax, 2
je 0x46a482
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46a42a
cmp eax, 3
je 0x46a45d
cmp eax, 1
jne 0x46a42a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46a42a
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46a42a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0046a4d0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x46a4b9
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0046a4d0
add esp, 4
pop esi
ret

Function at 0x4b1932
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b196a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004af9e6
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004af9be
jmp 0x4b1976
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b3025
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b3067
call fcn.004b8ddd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b3067
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b305e
xor eax, eax
jmp 0x4b306f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b3075
pop edi
pop esi
pop ebx
ret 4
Function at 0x4b930d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b933b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b9359
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b9273
jmp 0x4b9359
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b9359
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b9273
test edi, edi
mov eax, edi
jne 0x4b9343
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403a25
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41d48c
call int.0041ca80
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x420268
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x42032c
push 4
mov ebx, 0x420278
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.00401c2e
mov dword [esi + 0x3c], 0x4203bc
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.00401c2e
mov dword [edi], 0x4203c4
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004021af
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.004030e5
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004021af
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.004030e5
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004021af
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.004030e5
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004021af
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.004030e5
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.004030e5
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41a162
Capabilities:
Encode data using xor

Disassembly:
invalid
stc
sub edi, edi
mov al, 0x4e
jnp 0x41a1a4
aam 0x1c
scasb al, byte es:[edi]
xor byte [ebx + 0x31], ch
sub eax, 0xfc5fdc34
out dx, al
and eax, 0x113827a6
rol byte [ecx], 0x9c
xor eax, 0x4812b8ff
jle 0x41a153
push ebx
jo 0x41a138
xor esp, ebx
dec ecx
arpl word [ebx + 0x2710fc99], ax
lahf
insb byte es:[edi], dx
mov ch, 0x67
sub byte [ebx], 0x45
sub ecx, esi
push ss
push cs
aas
out 0x28, eax
xor byte [ecx], ch
cmpsd dword [esi], dword es:[edi]
fdivr dword [ebx - 0x1813c30c]
lodsd eax, dword [esi]
in al, dx
out 0xad, eax
mov esp, 0x985f419f
cmp eax, 0xbfd58a62
cmpsd dword fs:[esi], dword es:[edi]
sub ah, dh
lodsb al, byte [esi]
adc al, 0x81
push es
fadd qword [edx]
test eax, 0xd73c92b6
jae 0x41a193
dec esi
pop edx
shl byte [ebp - 0x68ffae41], cl
pop ds
jne 0x41a23c
fdivr dword [ebx]
mov byte [esi - 0x4b], al
inc esi
loop 0x41a1de
ficomp word [ecx + 0x3868926c]
xor byte [ebp - 0x50e8682e], 0x98
xchg edi, eax
pop ss
scasd eax, dword es:[edi]
cwde
inc ebp
jle 0x41a1db
pop eax
test byte [eax + 9], ah
out 0xd1, al
inc ebx
mov ch, 0x45
mov ebp, dword [ecx]
cdq
adc byte [eax + 0x60fa82a4], 0x55
jmp edx
dec edx
pop ebp
jbe 0x41a29e
xor al, 0x68
mov cl, 0xce
mov ah, al
call 0x30e4cbdc
inc esi
pop eax
xchg edx, eax
call 0x7d3b4cef
and edx, edi
hlt
cmp eax, 0x6ae79173
std
jmp 0x1d08b806

Function at 0x41b7a7
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebx], ecx
in eax, 0x66
add eax, 0x7f781243
cdq
imul ebx, edi, 0x440919ed
insd dword es:[edi], dx
push esi
xchg edx, eax
inc ebp
xor edi, dword [edi + esi + 0x196ed4b7]
sbb ebx, dword [esi - 0x23]
cdq
sar byte [esi], cl
inc ecx
dec ebx
sbb byte [edx], bh
fidiv word [edx]
pushal
or ebp, dword [0xf94ab208]
js 0x41b7b8
and dword [edx + esi], 0x1f
jmp 0x41b838
and ebp, ecx
jae 0x41b873
cmpsd dword [esi], dword es:[edi]
in al, 0xe3
loopne 0x41b86b
jo 0x41b851
int3
pushfd
lcall 0xca8f, 0xfe5b
mov word [edi - 0x52], cs
ljmp 0x35d
mov bh, 0x9e
or byte [eax + 0x458750ec], bl
sub ecx, dword [ebx + 0x1c]
add byte [ecx + 0x63022d6a], al
mov al, 0xdd
aaa
mov ebp, ebp
fmul dword [edi + 0x3a]
and esi, dword [edi + edi*8 + 0x5948d013]
sbb byte [esi + ebp*4], cl
xor al, 0xe8
push eax
mov ebp, 0xd2b6ddc0
out 0xa, eax
loope 0x41b915
push es
lea edx, [ecx + ecx*8]
inc ebp
adc al, 0x61
jecxz 0x41b8a7
invalid
Function at 0x100021c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101a6ec0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0xc], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [eax + 0x11c]
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], ebx
cmp dword [eax + 0x474], 0
jne 0x100023d4
cmp dword [eax + 0x470], 0
lea edi, [eax + 0x220]
je 0x1000220e
mov dword [eax + 0x470], 0
jmp 0x10002223
push edi
push dword [eax + 0x478]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x100023d4
test edi, edi
je 0x100023d4
push 0x105
lea eax, [edi + 0x2c]
push eax
push 0x105
lea ebx, [esi + 0x14]
lea eax, [ebp - 8]
push ebx
push eax
call fcn.1011b229
add esp, 0x14
test eax, eax
je 0x1000227d
cmp word [edi + 0x234], 0
lea ecx, [edi + 0x234]
je 0x10002275
push 0x105
push ecx
push 0x105
lea eax, [ebp - 8]
push ebx
push eax
call fcn.1011b229
add esp, 0x14
test eax, eax
jne 0x10002398
mov eax, dword [ebp - 8]
dec eax
mov dword [esi + 0xc], eax
mov eax, dword [edi]
test al, 0x40
je 0x10002293
mov dword [esi + 0x10], 0x2000
jmp 0x100022b5
test eax, 0x400
je 0x100022a3
mov dword [esi + 0x10], 0xc000
jmp 0x100022b5
test al, 0x10
mov ecx, 0x4000
mov eax, 0x8000
cmovne eax, ecx
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x11c]
cmp dword [eax + 0x474], 0
jne 0x1000236a
cmp dword [eax + 0x470], 0
lea edi, [eax + 0x220]
je 0x100022e6
mov dword [eax + 0x470], 0
jmp 0x100022f7
push edi
push dword [eax + 0x478]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1000236a
test edi, edi
je 0x1000236a
lea edx, [edi + 0x2c]
mov ecx, 0x1505
lea ebx, [edx + 0x208]
cmp edx, ebx
je 0x10002327
nop dword [eax]
movzx edi, word [edx]
add edx, 2
test edi, edi
je 0x10002327
mov eax, ecx
shl ecx, 5
add ecx, edi
add ecx, eax
cmp edx, ebx
jne 0x10002310
mov eax, dword [ebp - 0xc]
and ecx, 0x7fffffff
mov dword [esi + 4], ecx
pop edi
mov eax, dword [eax + 0x11c]
mov dword [eax + 0x470], 1
mov eax, 0x11c
mov dword [esi], 0
mov word [esi + 8], ax
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010cf1c
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], bind
mov eax, 0x11c
mov dword [esi], 0
mov word [esi + 8], ax
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010cf1c
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [ebx], 0x3f
mov byte [esi + 0x15], 0
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0xffffffff
mov dword [esi], eax
mov word [esi + 8], ax
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010cf1c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
mov dword [ebx], 0
xor ecx, ebp
pop ebx
call fcn.1010cf1c
mov esp, ebp
pop ebp
ret
Function at 0x100023f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x101a3118
push 0x1010e6a0
mov eax, dword fs:[0]
push eax
sub esp, 0x2dc
mov eax, dword [0x101a6ec0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 4], 0
push eax
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2ec], eax
pop eax
jmp 0x10002461
mov dword [ebp - 4], 0xfffffffe
push 0x2c8
push 0
lea eax, [ebp - 0x2e4]
push eax
call fcn.1010efd0
add esp, 0xc
mov dword [ebp - 0x2e8], 0x10010
lea eax, [ebp - 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x100024cb
cmp dword [ebp - 0x2e4], 0
jne 0x100024c4
cmp dword [ebp - 0x2e0], 0
jne 0x100024c4
cmp dword [ebp - 0x2dc], 0
jne 0x100024c4
cmp dword [ebp - 0x2d8], 0
je 0x100024cb
mov eax, 1
jmp 0x100024d1
mov eax, dword [ebp - 0x2ec]
test eax, eax
setne al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1010cf1c
mov esp, ebp
pop ebp
ret
Function at 0x10004000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10004032
jl 0x10004025
test ecx, ecx
jne 0x10004032
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100040f2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10005490
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000409e
jg 0x1000405d
test esi, esi
je 0x1000409e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10004075
mov eax, dword [esp + 0x10]
jl 0x1000406f
cmp eax, esi
jae 0x10004075
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1010ea50
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x100040bf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x100040db
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10004044
jl 0x100040db
test ecx, ecx
jne 0x10004044
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10004136
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10004136
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.1010ea50
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x100041a7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000415c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x10004192
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1011b75a
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100041a7
cmp edi, eax
ja 0x10004170
test edi, edi
je 0x100041a7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1011b75a
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10005850
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101367c0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101a6ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1010cf2f
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1010c58e
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.100057f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a270
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x1000a297
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x1000a286
pop edi
movzx eax, dl
pop esi
ret