joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490920
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4f7f44]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.004aea1b
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x490984
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x490984
lea edx, [ebp - 0x108]
push edx
call dword [0x4f7ce4]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a79cb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004a79cb
mov esp, ebp
pop ebp
ret

Function at 0x4909a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00490920

Function at 0x498400
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0
push ebx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call fcn.004a8b80
mov eax, dword [ebp + 0x10]
add esp, 0xc
push 0xf0000000
push eax
push 0
push 0
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4984d2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4984b4
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 0
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4984b4
mov ecx, dword [ebp - 4]
push 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 4
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x4984b4
cmp esi, dword [ebp - 0xc]
jb 0x4984b4
mov eax, dword [ebp - 4]
push 0
lea edx, [ebp - 0x14]
push edx
push ebx
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 4]
test eax, eax
je 0x4984c2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4984d2
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret
Function at 0x49b850
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
push edx
push eax
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
test eax, eax
jne 0x49b9f9
push edi
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x49b9db
push ebx
push esi
lea esp, [esp]
mov eax, dword [edi + 4]
cmp eax, 2
jne 0x49b8ad
lea ebx, [eax + 0xe]
jmp 0x49b8b9
cmp eax, 0x17
jne 0x49b958
lea ebx, [eax + 5]
cmp dword [edi + 0x18], 0
je 0x49b958
mov eax, dword [edi + 0x10]
test eax, eax
je 0x49b958
cmp eax, ebx
jb 0x49b958
push 0x20
call dword [0x4f7cd8]
mov esi, eax
xor eax, eax
add esp, 4
cmp esi, eax
je 0x49b965
mov edx, dword [edi]
mov dword [esi], edx
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov ecx, dword [edi + 0xc]
push ebx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], eax
call dword [0x4f7cd8]
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
je 0x49b96e
mov edx, dword [edi + 0x18]
push ebx
push edx
push eax
call fcn.004a9120
mov eax, dword [edi + 0x14]
add esp, 0xc
test eax, eax
je 0x49b942
push eax
call dword [0x4f7ce4]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x49b981
cmp dword [ebp - 4], 0
jne 0x49b94b
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x49b955
mov dword [eax + 0x1c], esi
mov dword [ebp - 0xc], esi
mov edi, dword [edi + 0x1c]
test edi, edi
jne 0x49b8a0
jmp 0x49b99c
mov dword [ebp - 8], 8
jmp 0x49b99c
push esi
mov dword [ebp - 8], 8
call dword [0x4f7cdc]
add esp, 4
jmp 0x49b99c
mov eax, dword [esi + 0x18]
push eax
mov dword [ebp - 8], 8
call dword [0x4f7cdc]
push esi
call dword [0x4f7cdc]
add esp, 8
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
test eax, eax
je 0x49b9ac
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], 0
je 0x49b9d5
mov ecx, dword [ebp - 4]
push ecx
call fcn.0049b810
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
add esp, 4
mov dword [eax], edx
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 4], 0
jne 0x49b9ed
push 0x2af9
mov dword [ebp - 8], 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x49bd90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.004ae392
add esp, 0x18
test eax, eax
je 0x49bdb4
cmp eax, 0xffffffff
jne 0x49bdb6
xor eax, eax
pop ebp
ret
Function at 0x49ead0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x49eb03
push 0x2e
push esi
call fcn.004ac2e0
add esp, 8
test eax, eax
je 0x49eb01
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x49ebe0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f7f44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov esi, 8
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x49ec71
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
lea esi, [ebp - 0xc]
mov eax, ebx
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
call fcn.0049eb50
mov ecx, esi
push 8
push ecx
call fcn.004a5df0
mov ecx, dword [ebp - 0x1c]
add esp, 8
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x49ec82
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a79cb
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x1c]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004a79cb
mov esp, ebp
pop ebp
ret
Function at 0x49edf0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49ee00
sub eax, edx
mov esi, eax
cmp esi, 0x7fffffff
jbe 0x49ee1e
pop edi
mov eax, 0x1b
pop esi
mov esp, ebp
pop ebp
ret
push ebx
test esi, esi
je 0x49ee2f
lea eax, [esi + esi]
push eax
call dword [0x4f7cd8]
jmp 0x49ee3a
push 0x4e8539
call dword [0x4f7ce4]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x49ee4d
lea eax, [ebx + 0x1b]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.0049edc0
push 0xf0000000
push 1
push 0
push 0
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x49eecc
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x49eec0
mov edx, dword [ebp - 4]
push 0
lea ecx, [esi + esi]
push ecx
push ebx
push edx
mov dword [ebp - 0xc], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [edi + 0x10], eax
push ebx
mov byte [edi + 0x14], al
call dword [0x4f7cdc]
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a6950
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x4f7cd8]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4a697b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x4a69c2
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x4a69c5
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x4a6a26
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x4a69f0
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x4a6a5f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x4e16d1
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x4e16d2
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x4a6a30
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a79cb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f7f44]
jne 0x4a79d5
repz ret
jmp fcn.004b144d
Function at 0x4be6ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f7f44]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004b2c08
and dword [ebp - 0x14], 0
cmp dword [0x4fdcc8], 0
mov dword [ebp - 0x18], eax
jne 0x4be75f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4be807
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4e7ffc
push ebx
call edi
test eax, eax
je 0x4be807
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4fdcc8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4fdccc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4fdcd0], eax
call edi
push eax
call esi
mov dword [0x4fdcd8], eax
test eax, eax
je 0x4be75f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4fdcd4], eax
mov eax, dword [0x4fdcd4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4be7b8
cmp dword [0x4fdcd8], ecx
je 0x4be7b8
push eax
call esi
push dword [0x4fdcd8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4be7b8
test ebx, ebx
je 0x4be7b8
call edi
test eax, eax
je 0x4be7af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4be7af
test byte [ebp - 8], 1
jne 0x4be7b8
or dword [ebp + 0x10], 0x200000
jmp 0x4be7eb
mov eax, dword [0x4fdccc]
cmp eax, dword [ebp - 0x18]
je 0x4be7eb
push eax
call esi
test eax, eax
je 0x4be7eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4be7eb
mov eax, dword [0x4fdcd0]
cmp eax, dword [ebp - 0x18]
je 0x4be7eb
push eax
call esi
test eax, eax
je 0x4be7eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4fdcc8]
call esi
test eax, eax
je 0x4be807
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4be809
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a79cb
leave
ret

Function at 0x4c4e00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4c4e27
call fcn.004ad444
mov dword [eax], esi
call fcn.004ad431
push 0x16
pop esi
mov dword [eax], esi
call fcn.004b1bf9
mov eax, esi
jmp 0x4c4e7c
test dword [ebp + 0xc], 0xfffffff9
jne 0x4c4e0d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4c4e54
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ad457
pop ecx
call fcn.004ad431
mov eax, dword [eax]
jmp 0x4c4e7c
test al, 0x10
jne 0x4c4e7a
test al, 1
je 0x4c4e7a
test byte [ebp + 0xc], 2
je 0x4c4e7a
call fcn.004ad444
mov dword [eax], 5
call fcn.004ad431
mov dword [eax], 0xd
jmp 0x4c4e4b
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4065ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406612
xor eax, eax
test eax, eax
je 0x406625
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406625
xor ecx, ecx
jmp 0x406628
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406751
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427d8c], 0
push esi
jne 0x406788
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406762
mov dword [ecx*4 + 0x427d88], eax
inc ecx
cmp ecx, 0x100
jl 0x40675d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067b9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427d88]
xor eax, esi
inc ecx
dec edx
jne 0x40679b
pop edi
not eax
pop esi
ret 0xc

Function at 0x401686
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404474], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4041cf], ebp
mov dword [0x404404], eax
mov dword [0x4041c7], eax
mov dword [0x4043f0], 0x30
mov dword [0x4043f4], 2
jmp 0x4016c6
mov dword [0x4043f8], 0x403051
mov dword [0x4043fc], 0
mov dword [0x404400], 0
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40440c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404408], eax
mov dword [0x40441c], eax
mov dword [0x404418], 0x40439a
mov dword [0x404410], 0xf
push 0x4043f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4041c7]
push 0
push 0
push 0x1e0
push 0x1fe
push 0xfffff862
push 0xfffff8f8
push 0xcf0000
push 0x4043e7
push str.lunt
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404468], eax
push 5
push dword [0x404468]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404468]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404420]
jmp 0x40179a
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x40178c
mov eax, dword [0x404428]
jmp 0x4017b5
call 0x402a06
ret
Function at 0x10011490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x78
mov eax, dword [0xccfa2f0]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
mov ebx, dword [esp + 0x80]
mov eax, 1
push esi
push 0x30
mov word [esp + 0x7c], ax
mov esi, 2
lea eax, [esp + 0x1c]
mov dword [esp + 0x70], 0x40000
push 0
push eax
mov dword [esp + 0x7c], 0x20004
mov dword [esp + 0x80], 0x10001
mov dword [esp + 0x20], 0
call fcn.1000d861
push 0x24
lea eax, [esp + 0x58]
push 0
push eax
call fcn.1000d861
push 0x2b
push ebx
call fcn.100269f0
mov edx, eax
add esp, 0x20
test edx, edx
jne 0x10011520
pop esi
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
mov al, byte [edx + 5]
cmp al, 9
ja 0x10011673
cmp al, 1
jb 0x10011673
movzx eax, al
cmp dword [esp + eax*4 + 0x44], 0
jne 0x100115a0
mov dword [esp + eax*4 + 0x44], edx
movzx eax, byte [edx + 5]
dec eax
cmp eax, 8
ja 0x100115a0
jmp dword [eax*4 + 0xcce0cec]
movzx eax, byte [edx + 5]
movzx ecx, byte [edx + 6]
shl eax, 8
or eax, ecx
cmp eax, 0x200
jg 0x1001161e
je 0x10011614
sub eax, 0x100
cmp eax, 0x46
ja 0x10011673
movzx eax, byte [eax + 0xcce0d2c]
jmp dword [eax*4 + 0xcce0d10]
mov dword [esp + 0x30], 0
jmp 0x10011673
cmp eax, 0x714
jg 0x10011653
je 0x10011649
cmp eax, 0x300
je 0x1001163f
cmp eax, 0x70a
jne 0x10011673
mov dword [esp + 0x38], 0
jmp 0x10011673
mov dword [esp + 0x34], 0
jmp 0x10011673
mov dword [esp + 0x3c], 0
jmp 0x10011673
cmp eax, 0x80a
je 0x1001166b
cmp eax, 0x90a
jne 0x10011673
mov dword [esp + 0x44], 0
jmp 0x10011673
mov dword [esp + 0x40], 0
push edx
push ebx
call fcn.10026a90
mov edx, eax
add esp, 8
test edx, edx
jne 0x10011520
push 0x14
push 1
push ebx
call fcn.10026a50
add esp, 0xc
test eax, eax
je 0x10011731
add eax, 0xf
mov dword [esp + 0x10], 0
push 2
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1000d79d
mov ecx, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x38], 0
jne 0x100116d7
cmp dword [esp + 0x3c], 0
jne 0x100116d7
cmp dword [esp + 0x40], 0
jne 0x100116d7
cmp dword [esp + 0x44], 0
je 0x100116f2
test cx, cx
je 0x100116f2
pop esi
mov eax, 0xb
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
cmp cx, 7
jae 0x10011702
movzx eax, cx
movzx eax, word [esp + eax*2 + 0x6c]
jmp 0x1001172d
cmp cx, 0xb
jne 0x10011712
mov dword [esp + 0x14], 1
jmp 0x10011731
cmp cx, 0x14
jne 0x10011722
mov dword [esp + 0x14], 4
jmp 0x10011731
mov eax, dword [esp + 0x14]
cmp cx, 0x15
cmove eax, esi
mov dword [esp + 0x14], eax
xor esi, esi
push edi
cmp dword [esp + esi*4 + 0x1c], 0
je 0x1001189d
movq xmm0, qword [0xccfaa74]
mov al, byte [0xccfaa7c]
movq qword [esp + 0x70], xmm0
mov byte [esp + 0x78], al
mov dword [esp + 0x14], 0
cmp esi, 0xb
ja 0x100118d2
jmp dword [esi*4 + 0xcce0d74]
inc esi
cmp esi, 0xc
jl 0x10011734
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
mov ecx, dword [esp + 0x80]
mov eax, 0xb
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10010f50
add esp, 0x78
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x438ca1
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
inc eax
push 0x598df5e9
pop edi
and edi, edi
call fcn.00438cf6
sub esp, 4
mov dword [esp], 0xf43de976
mov edi, dword [esp]
add esp, 4
mov eax, 0xf5d00a4e
sub edi, 0x41c57687
xor dword [ebx], ecx
add eax, 0xe7423780
sub eax, 1
sub edi, 0xeaf7809d
inc ebx
add edi, eax
mov edi, 0xfa0593a4
cmp ebx, edx
jne fcn.00438ca1
or edi, eax
or edi, eax
ret
Function at 0x7c4411c4
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
cmp dword [ecx], 0
mov esi, ecx
je 0x7c4411f6
mov edi, dword [esi]
mov eax, dword [0x7c506ae8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x7c441229
cmp dword [eax + 8], edi
jle 0x7c441229
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
test edi, edi
je 0x7c44122d
mov eax, edi
pop edi
pop esi
ret 4
cmp dword [0x7c506ae8], 0
je 0x7c44120e
mov ecx, dword [0x7c506ae8]
call sym.MFC40.DLL_Ordinal_1386
mov dword [esi], eax
jmp 0x7c4411cd
mov ecx, 0x7c506af0
test ecx, ecx
je 0x7c469f78
push 1
call sym.MFC40.DLL_Ordinal_491
mov dword [0x7c506ae8], eax
jmp 0x7c4411ff
xor edi, edi
jmp 0x7c4411eb
call dword [esp + 0xc]
push eax
mov edi, eax
push dword [esi]
mov ecx, dword [0x7c506ae8]
call sym.MFC40.DLL_Ordinal_5477
jmp 0x7c4411ef
mov dword [0x7c506ae8], 0
jmp 0x7c4411ff

Function at 0x7c441261
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov eax, dword [ecx]
mov esi, ecx
cmp eax, 0xffffffff
jne 0x7c469f87
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
test eax, eax
je 0x7c4412a6
mov ecx, dword [esp + 0xc]
cmp dword [eax + 8], ecx
jle 0x7c4412a6
mov eax, dword [eax + 0xc]
mov edi, dword [eax + ecx*4]
cmp dword [esi], 0xffffffff
jne 0x7c44129f
add esi, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
ret 4
xor edi, edi
jmp 0x7c441290
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x7c44127d