joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a1590
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x61c573
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0060d40e
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x61f0a8]
push eax
mov ecx, edi
call fcn.00612b74
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.006140cc
test eax, eax
je 0x5a16ac
mov ecx, dword [esp + 0x3c]
call fcn.00612ba1
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x61f4e0]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x5a1670
push edi
mov ecx, esi
call fcn.0061015f
mov ecx, esi
call fcn.005a1850
cmp dword [esp + 0x38], 1
jne 0x5a16a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.006102c9
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x5a3890
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x5a38c3
push esi
call fcn.005b1b20
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x5a38bc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x5a3949
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x5a3932
mov eax, dword [esi + 8]
test eax, eax
je 0x5a38e7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x5a392e
cmp eax, 2
je 0x5a3932
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5a38da
cmp eax, 3
je 0x5a390d
cmp eax, 1
jne 0x5a38da
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x5a38da
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x5a38da
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.005a3970
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x5a3958
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.005a3970
add esp, 4
pop esi
ret
Function at 0x5d4ab0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x7a6554]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x5d4ac3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x5d4b04
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x7a65fc]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x5d4b36
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5d4b3a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x5d4b2b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x5d4b58
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5d4b5c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x5d4b4d
xor ecx, ecx
mov eax, 0x7a6564
xor ebx, ebx
mov bl, byte [ecx + 0x7a660c]
cmp byte [esp + ebx + 0x14], 0
je 0x5d4b87
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x7a6624]
cmp byte [esp + ebx + 0x14], 0
je 0x5d4b9e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x5d4b6e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x5d4af7
lea edx, [esp + 0x84]
push edx
call fcn.005d4be0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x5de4a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x7e70f4]
xor edx, edx
cmp eax, edx
jne 0x5de4c6
xor eax, eax
mov byte [eax + 0x7e6ff4], al
inc eax
cmp eax, 0x100
jl 0x5de4ae
mov dword [0x7e70f4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x7e6ff4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x5de557
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x5de52a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x5de4f8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5de560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x5de5b3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x5de59a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e4f40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61dd6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.005e5860
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x77f1d4
call fcn.0060bb2a
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x5e4fd3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0060bb2a
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x5e4fcc
push 0
mov ecx, eax
call fcn.005dc0e0
mov dword [esi + 0xc], eax
jmp 0x5e4fd5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x5e4fd5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x805c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x805d1c
test eax, eax
je 0x805d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x820fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x805d03
lea edi, [eax + 4]
jmp 0x805c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x805c7c
mov dword [ebp - 4], 2
jmp 0x805c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x805c93
mov dword [ebp - 4], 1
jmp 0x805c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x805d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x805cd6
mov byte [ecx], 0x3d
jmp 0x805ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x805ced
mov byte [ecx], 0x3d
jmp 0x805cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x805c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x841101
Capabilities:
Packed with generic packer

Disassembly:
push ebp
bt bp, 0x7c
btr ebp, ebx
mov ebp, esp
stc
cmc
clc
sub esp, 0x1c
jmp 0xaefb23
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp 0xb61ce8
add eax, 8
push eax
jmp 0xc0afb0
push dword [ebp - 0x18]
jmp 0xae0e53
mov dword [ebp - 8], 0
jmp 0x854e0b
call fcn.00556793
lea esp, [esp + 4]
dec al
sal eax, 0x41
pop eax
mov dword [ebp - 4], eax
bsr eax, ebp
test bx, 0x193c
adc eax, esp
push reloc.WS2_32.dll_getpeername
sar eax, cl
movsx ax, dh
push 0
mov eax, dword [ebp - 4]
cmp sp, sp
test bl, 0xf6
cmc
test eax, eax
jmp 0xba73fe
push eax
jmp 0xa9f75f
call fcn.004014be
mov dword [ebp - 0xc], eax
jmp 0xae4ea8
call fcn.00556799
add esp, 0x10
mov dword [ebp - 8], eax
cwde
lea eax, [ebp - 4]
jmp 0xa62ce7
push dword [ebp + 0xc]
call fcn.00b0849f
mov dword [ebp - 0x10], eax
movzx ax, dh
cwde
mov dword [ebp - 0x18], esp
setb ah
movzx eax, bp
xchg ah, al
push 0x40
cwde
push 0x1000
mov eax, esi
xchg al, ah
movzx ax, al
push 0x64
not al
bswap eax
lahf
push 0
lahf
mov eax, 0x3e
call fcn.005567a5
cmp dword [ebp - 0x18], esp
jmp 0x411d2f
mov dword [ebp - 0x18], 0
push 0
jmp 0x8d93a6
mov dword [ebp - 4], 0
jmp 0x8f9fd6
je 0xc0afc7
push eax
cmp edi, 0x7721668a
mov eax, dword [eax + 4]
cmp bp, si
jmp 0x86dcfe
je 0xa5c826
push ebx
jmp 0xa5c818
mov dword [ebp - 0x14], 0
jmp 0xbf2a20
jne 0xba740c
mov eax, 0x62c9f0
mov bh, 0xa9
push eax
cmovo bx, di
movzx bx, bh
push 1
bswap ebx
mov bx, bp
mov ebx, 0x556e70
jmp 0xaad837
pushal
mov eax, 1
and bp, si
mov eax, 2
rcr dx, cl
cwd
mov eax, 4
mov eax, esi
sal ch, 0x5b
mov eax, 2
neg bl
bt esi, 0xe7
mov eax, 5
and eax, 0x43c52bf7
dec dx
mov eax, 4
inc esi
bsf bp, di
cmp bx, sp
mov eax, 2
mov eax, 5
clc
xor ebx, ecx
mov eax, 6
neg ax
bt eax, ebx
bswap dx
popal
and eax, 0x6c7b62f8
bsf bx, bx
btc eax, esp
push edx
cwde
clc
mov edx, 1
mov edx, 2
setl bh
mov edx, 4
mov edx, 2
mov edx, 5
shld ax, di, 0x57
movsx eax, ax
mov edx, 4
test bl, 0x3c
bts dx, bx
clc
mov edx, 2
cmp edx, ebx
mov edx, 5
bsf dx, di
btr bx, di
mov edx, 5
pop edx
sar bh, cl
movsx bx, bh
rol ah, cl
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
cmp si, 0x2180
cmc
test eax, eax
jmp 0xb1ea8b
call fcn.0055678d
pop ecx
cmovo esi, esp
pop esi
mov edi, eax
cmovnp bx, dx
rep movsb byte es:[edi], byte [esi]
sal ebx, cl
dec ebx
adc ebx, ebx
push eax
mov bh, 0xe6
bsr ebx, ebp
mov ebx, dword [ebp - 4]
test ebx, ebx
jmp 0xb501ec

Function at 0x8489f4
Capabilities:
Packed with generic packer

Disassembly:
push ebp
sal ebp, 0x9c
mov ebp, esp
sub esp, 0x20
jmp 0xb1969b
mov dword [ebp - 4], 0
jmp loc.00423597
Function at 0x9e15ec
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [ebp - 0x18], 0
jmp 0x993fba
mov dword [ebp - 0x14], 0
jmp 0x84b08b
pushal
bswap cx
mov eax, 1
mov eax, 2
not esi
mov eax, 4
xchg ebp, ebp
jmp loc.0041e050
mov dword [ebp - 4], 0
jmp 0xb1723b
push ebp
mov ebp, esp
stc
cmc
clc
sub esp, 0x30
jmp 0x9dcaeb
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp 0x90dfaa
mov dword [ebp - 8], 0
jmp 0xaef2ce
Function at 0xb7095b
Capabilities:
Packed with generic packer

Disassembly:
mov ebx, dword [ebp - 0x18]
cmp ecx, 0x4bbc513b
cmp edi, eax
test ebx, ebx
jmp 0xbc9c1e
pushal
xchg al, dh
mov eax, 1
cdq
mov eax, 2
cmovge esi, edx
mov dl, 0x98
cdq
mov eax, 4
mov edi, ebp
jmp 0xad44ee
push 0x40856ab
jmp 0xc134bf
mov dword [ebp - 0x10], esp
setge ah
mov eax, 0x3a
jmp 0xae84ca
call fcn.004105ea
push 0x80000301
movzx ebx, bp
mov ebx, 0xf917a94
push 0
movzx bx, bh
jmp 0xbfc04a
mov eax, 6
mov bh, 0x94
not di
popal
jmp 0xa42233
call fcn.00556793
lea esp, [esp + 4]
btr ebx, 0x1e
shl ebx, 0x64
mov ebx, dword [ebp - 0xc]
cmp bh, cl
test ch, 0xb9
test ebx, ebx
jmp 0xbb2a14
call fcn.0055679f
add esp, 0xc
movzx ebx, ax
push 0x80000301
jmp 0xb9de65
call fcn.00556793
add esp, 4
call fcn.0040f287
mov dword [ebp - 0xc], eax
cmovns eax, ebx
jmp 0x88bbf1
call fcn.0040ac50
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
xor ax, bx
movsx ax, ch
sbb ah, 0x4e
push 0
mov eax, dword [ebp - 4]
stc
jmp 0xa5fee8
call fcn.0040fff4
mov dword [ebp - 0x20], eax
jmp 0x94f5d0
push edx
cdq
movsx dx, dl
mov edx, 1
mov edx, 2
bswap edx
mov edx, 4
mov edx, 2
jmp 0xc275d7
mov dword [ebp - 0x18], eax
jmp 0xbb06a9
test eax, eax
jmp 0xab3cdc
call fcn.00556799
add esp, 0x10
mov dword [ebp - 0x28], eax
movzx cx, cl
jmp 0xa6c864
push dword [ebp - 0x28]
movzx cx, bh
cmovbe cx, sp
xchg ecx, ecx
push dword [ebp - 0x20]
movzx ecx, si
push dword [ebp - 0x1c]
bswap ecx
setne ch
xchg cl, ch
push dword [ebp - 0x18]
xchg cl, cl
not ecx
push dword [ebp - 0xc]
push dword [ebp - 8]
cmovne cx, dx
bswap ecx
mov ecx, 6
call fcn.004015a0
add esp, 0x18
sbb bl, 0x4c
rcr bl, 0x5b
or ebx, 0x72ba0397
mov dword [ebp - 0x2c], eax
bts ebx, ecx
stc
mov ebx, dword [ebp - 8]
cmp ebp, eax
test ebx, ebx
jmp 0xb800ba
jne 0xab3cec
mov eax, 0x62c99e
mov bl, 0xd9
setae bl
push eax
setle bh
movsx ebx, sp
push 1
mov ebx, 0x558f20
jmp 0xae822e
mov eax, 2
rdtsc
jmp 0xc173eb
je 0x9f9519
push 0xee
jmp 0x87b662
call fcn.00556799
add esp, 0x10
mov dword [ebp - 8], eax
neg ebx
mov ebx, dword [ebp - 4]
clc
test ebx, ebx
je 0xa223de
push ebx
jmp 0xa223d6
call fcn.005567a5
cmp dword [ebp - 0x10], esp
jmp 0xae0e43
jmp 0x8037fa
push ebp
bsr ebp, esp
mov ebp, esp
test cl, bl
sub esp, 0x34
jmp 0xb3b399
je 0x9c8f37
push ebx
jmp 0x9c8f27
push 0
xchg bh, bl
mov ebx, ebp
push eax
push 1
xchg bx, bx
bswap bx
mov ebx, 0x558f20
call fcn.00556799
add esp, 0x10
jmp 0xa4463e
call fcn.0040aed8
mov dword [ebp - 0x1c], eax
jmp 0xa3e762
je 0x411ce9
push ebx
jmp 0x411cdb
push eax
push 1
not bl
mov ebx, 0x558f20
jmp 0xa63734
push 6
jmp 0x9f950e
mov eax, 5
mov ebx, 0x18191a1c
cwd
lahf
mov eax, 4
mov ebp, 0x306560e4
bswap edx
cwde
mov eax, 2
mov eax, 5
jmp 0x96dcdd
mov edx, 5
mov edx, 4
mov edx, 2
movzx edx, dx
mov edx, 5
mov edx, 5
movsx dx, ah
not dx
setg dh
pop edx
jmp 0xa28aca
Function at 0x5709d0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push eax
call sub.ws2_32.dll_connect
mov esp, ebp
pop ebp
ret

Function at 0x1002195
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xf0
push 4
call fcn.010012b0
test eax, eax
pop ecx
je 0x10021b6
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_void___thiscall_CLASS_DESCRIPTOR::constructor_void_]
jmp 0x10021b8
xor eax, eax
test eax, eax
mov dword [0x1004004], eax
je 0x10021c9
mov ecx, eax
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_CLASS_DESCRIPTOR::Initialize_void_]
lea ecx, [ebp - 0x78]
call fcn.010012ff
lea ecx, [ebp - 0x78]
call fcn.01001cd6
test al, al
je 0x10021ee
lea ecx, [ebp - 0x78]
call fcn.0100133e
test al, al
je 0x10021ee
push dword [ebp + 0x10]
jmp 0x10021f0
push 2
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x10021f7
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x1001288
call fcn.01002394
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002232
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002232
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100224a
cmp eax, 0x20b
je 0x1002237
mov dword [ebp - 0x1c], edi
jmp 0x100225e
cmp dword [ecx + 0x84], 0xe
jbe 0x1002232
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1002258
cmp dword [ecx + 0x74], 0xe
jbe 0x1002232
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1004018], 0xffffffff
or dword [0x100401c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1004014]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1004010]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1004020], eax
call fcn.01002390
cmp dword [section..data], edi
jne 0x10022b9
push fcn.01002390
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100237e
push 0x100117c
push 0x1001178
call sub.msvcrt.dll__initterm
mov eax, dword [0x100400c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1004008]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001174
push 0x1001170
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002195
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1002330
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002365
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010023cd
ret
Function at 0x40a43c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42123e
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x432034]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x3fc
call fcn.0040872d
test eax, eax
je 0x40a5ca
call fcn.004010c5
mov edi, eax
call fcn.00404e4d
test eax, eax
je 0x40a5ca
push 0x40
xor esi, esi
lea eax, [esp + 0x34]
push esi
push eax
mov dword [esp + 0x38], 0x44
call sub.MSVCR100.dll_memset
xor eax, eax
mov dword [esp + 0x28], esi
lea edi, [esp + 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
inc ebx
stosd dword es:[edi], eax
mov eax, ebx
add esp, 0xc
lea ecx, [esp + 0x18]
mov dword [esp + 0x58], ebx
mov word [esp + 0x5c], ax
call fcn.00414842
lea ecx, [esp + 0x14]
push 0x42872c
push ecx
mov ecx, eax
mov dword [esp + 0x88], esi
call fcn.004057c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x88], bl
push str.___manual_0
push ecx
mov ebx, eax
call fcn.00405748
add esp, 0x10
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00401613
mov byte [esp + 0x80], 4
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.00401613
mov eax, dword [esp + 0x10]
cmp dword [eax - 4], 1
jle 0x40a53d
push dword [eax - 0xc]
lea eax, [esp + 0x14]
push eax
call fcn.00401506
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x30]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
or eax, 0xffffffff
lea esi, [esp + 0x10]
call fcn.0040583a
test edi, edi
je 0x40a5a6
push 0xffffffffffffffff
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x20]
call esi
push 0x428730
mov ecx, 0x427118
call fcn.00416d9e
mov eax, dword [esp + 0x14]
pop ecx
add eax, 0xfffffff0
call fcn.00401613
xor eax, eax
inc eax
jmp 0x40a5cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.UpdateCrashApp:_launch_txupd_failed__lu
mov ecx, 0x427118
call fcn.00416d9e
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00401613
xor eax, eax
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c568
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
or dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 0x3c], eax
cmp byte [esi + 0x2c], bl
jne 0x40c59e
push str.GIF_not_initialized
mov ecx, 0x427068
call fcn.00416d9e
pop ecx
jmp 0x40c5e5
cmp dword [esi + 0x24], 1
jbe 0x40c5e5
cmp dword [esi + 0x14], ebx
jne 0x40c5e5
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x40c7f3
push ebx
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x40c5de
push str.Couldnt_start_a_GIF_animation_thread_n
mov ecx, 0x427068
call fcn.00416d9e
pop ecx
mov al, 1
jmp 0x40c5e7
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor al, al
pop ebx
pop ebp
ret 0xc