joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45160a
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00451586
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x451779
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x451779
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x45172e
jg 0x451666
test eax, eax
je 0x451724
push 1
push 0x1000
call fcn.00447852
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x451689
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x45171b
push 0x8000
push ebx
call fcn.004457c6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4516b2
jg 0x4516ad
cmp ecx, 0x1000
jb 0x4516b2
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0044971c
add esp, 0x10
cmp eax, 0xffffffff
je 0x4516f7
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4516ad
jl 0x4516de
test ecx, ecx
jne 0x45169f
push dword [ebp - 0xc]
push ebx
call fcn.004457c6
push esi
call fcn.004478af
add esp, 0xc
xor ebx, ebx
jmp 0x451787
cmp byte [edi + 0x24], 0
je 0x45170e
cmp dword [edi + 0x20], 5
jne 0x45170e
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x451719
mov ebx, dword [edi + 0x18]
jmp 0x45171b
xor ebx, ebx
push esi
call fcn.004478af
pop ecx
jmp 0x451787
test ecx, ecx
jg 0x4516f0
jl 0x45172e
test eax, eax
jae 0x4516f0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00448be2
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x45174e
cmp byte [edi + 0x1c], 0
je 0x4516f0
jmp 0x45177f
push ebx
call fcn.0044c84d
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4516f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x451787
cmp byte [edi + 0x1c], 0
je 0x451784
mov ebx, dword [edi + 0x18]
jmp 0x451787
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00448be2
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x452ba0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x452bcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x452bcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10002360
Capabilities:
Get system firmware table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x52534d42
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10002399
xor eax, eax
jmp 0x1000243e
mov edx, dword [ebp - 8]
push edx
call fcn.1000dfb0
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0x52534d42
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100023dc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1000c170
add esp, 4
xor eax, eax
jmp 0x1000243e
push 1
mov edx, dword [ebp - 0xc]
add edx, 1
push edx
call fcn.1000c160
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
lea ecx, [eax + edx + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10007bb0
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10002df0
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.1000c170
add esp, 4
mov eax, dword [ebp - 4]
push eax
call fcn.1000c170
add esp, 4
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x10002450
Capabilities:
Connect socket
Initialize winsock library
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x1002d4c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x298]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x10002489
jmp 0x100025f8
mov dword [ebp - 0x2a0], 0
lea ecx, [ebp - 0x2a0]
push ecx
push 0
push str.1500
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x100024bf
jmp 0x100025f8
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x2a0]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x2a0]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0xffffffff
jne 0x100024f7
jmp 0x100025f8
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x2a0]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x1000252c
jmp 0x100025f8
push 0x104
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.100083a0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.GET__s__HTTP_1.1_nHost:__s_n_n
lea edx, [ebp - 0x108]
push edx
call fcn.10001bf0
add esp, 0x10
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.1000c0d0
add esp, 4
push eax
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x2a4]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffff
jne 0x10002595
jmp 0x100025f8
push 1
mov eax, dword [ebp - 0x2a4]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffff
jne 0x100025b5
jmp 0x100025f8
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffff
jne 0x100025d3
jmp 0x100025f8
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xffffffff
jne 0x100025ea
jmp 0x100025f8
mov edx, dword [ebp - 0x2a0]
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006c90
mov esp, ebp
pop ebp
ret
Function at 0x10002d10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
push 0
push 0x80
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10002d52
or ecx, 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], ecx
jmp 0x10002d76
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10002e40
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x1002d4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1002d2bc
mov eax, dword [ebp + 8]
push eax
call fcn.100084fa
add esp, 8
test eax, eax
je 0x10003007
push 0x208
push 0
lea ecx, [ebp - 0x414]
push ecx
call fcn.100083a0
add esp, 0xc
push 0x208
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.100083a0
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x61c]
push eax
call fcn.100083a0
add esp, 0xc
push 0x208
push 0
lea ecx, [ebp - 0x824]
push ecx
call fcn.100083a0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.1000bcb0
add esp, 4
mov esi, eax
push str.Hand2Note.exe
call fcn.1000bcb0
add esp, 4
sub esi, eax
sub esi, 1
push esi
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.1000bf80
add esp, 0xc
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.1000bb53
add esp, 8
push str.umpdc.dll
lea ecx, [ebp - 0x20c]
push ecx
call fcn.1000bb30
add esp, 8
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x61c]
push eax
call fcn.1000bb53
add esp, 8
push str.umpdc.tmp
lea ecx, [ebp - 0x61c]
push ecx
call fcn.1000bb30
add esp, 8
lea edx, [ebp - 0x61c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x824]
push ecx
call fcn.1000bb53
add esp, 8
push str.integrationumpdc.dll
lea edx, [ebp - 0x824]
push edx
call fcn.1000bb30
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call fcn.10002d10
add esp, 4
mov esi, eax
mov edi, edx
lea ecx, [ebp - 0x824]
push ecx
call fcn.10002d10
add esp, 4
mov dword [ebp - 0x82c], esi
mov dword [ebp - 0x828], edi
mov dword [ebp - 0x834], eax
mov dword [ebp - 0x830], edx
mov edx, dword [ebp - 0x82c]
cmp edx, dword [ebp - 0x834]
jne 0x10002fdb
mov eax, dword [ebp - 0x828]
cmp eax, dword [ebp - 0x830]
je 0x10002ff0
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
nop
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
nop
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006c90
mov esp, ebp
pop ebp
ret
Function at 0x10003020
Capabilities:
Check mutex on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1004e860], 0
jne 0x10003040
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1004e860], eax
push 0xffffffffffffffff
mov eax, dword [0x1004e860]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0xc], 0x40000
jle 0x1000306f
mov ecx, dword [ebp + 0xc]
push ecx
push str.Max_amount_of_data_to_send_to_hand2note_is_256kb_but_was__d_bytes
push 4
call fcn.100031e0
add esp, 0xc
jmp 0x100031d9
push 0xffffffffffffffff
mov edx, dword [0x1004e874]
push edx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x1000312f
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov ecx, dword [0x1004e874]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x100030b9
jmp 0x1000312f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x100030f2
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_pipe_file_n._error_d__dataLength_d
push 4
call fcn.100031e0
add esp, 0x10
mov eax, dword [0x1004e860]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
jmp 0x100031d9
push 0x1388
mov ecx, dword [0x1004e874]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
jne 0x1000312a
push str.Could_not_open_pipe:_5_second_wait_timed_out.
push 4
call fcn.100031e0
add esp, 8
mov edx, dword [0x1004e860]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
jmp 0x100031d9
jmp 0x10003085
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
call fcn.1000dfb0
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10003380
add esp, 8
push 4
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10007bb0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
add eax, 4
push eax
call fcn.10007bb0
add esp, 0xc
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100031ab
push str.Failed_to_write_into_pipe_n
push 4
call fcn.100031e0
add esp, 8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call fcn.1000c170
add esp, 4
mov edx, dword [0x1004e860]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
mov esp, ebp
pop ebp
ret
Function at 0x100031e0
Capabilities:
Check mutex on windows
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.10006ca0
mov eax, dword [0x1002d4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1000
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.100083a0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.100033f0
add esp, 4
push eax
lea edx, [ebp - 0x1004]
push edx
call fcn.1000bfd0
add esp, 8
lea eax, [ebp + 0x10]
mov dword [ebp - 0x100c], eax
mov ecx, dword [ebp - 0x100c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x1004]
push eax
call fcn.1000c0d0
add esp, 4
lea ecx, [ebp + eax - 0x1004]
push ecx
call fcn.100034b0
add esp, 0xc
mov dword [ebp - 0x100c], 0
cmp dword [0x1004e85c], 0
jne 0x10003280
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1004e85c], eax
push 0xffffffffffffffff
mov edx, dword [0x1004e85c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0xffffffffffffffff
mov ecx, dword [0x1004e870]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
push 0
push 0
push 3
push 0
push 1
push 0x40000000
mov edx, dword [0x1004e870]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0xffffffff
jne 0x100032f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_log_pipe_file._Error___lu__n
call fcn.10003430
add esp, 8
mov eax, dword [0x1004e85c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
jmp 0x10003366
push 0
lea ecx, [ebp - 0x1010]
push ecx
lea edx, [ebp - 0x1004]
push edx
call fcn.1000c0d0
add esp, 4
push eax
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp - 0x1008]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000333e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_write_into_log_pipe._Error___lu_n
call fcn.10003430
add esp, 8
mov edx, dword [ebp - 0x1008]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov eax, dword [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1004e85c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006c90
mov esp, ebp
pop ebp
ret

Function at 0x10003430
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.10006ca0
mov eax, dword [0x1002d4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1000
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.100083a0
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1008], ecx
mov edx, dword [ebp - 0x1008]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1004]
push ecx
call fcn.100034b0
add esp, 0xc
mov dword [ebp - 0x1008], 0
lea edx, [ebp - 0x1004]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006c90
mov esp, ebp
pop ebp
ret
Function at 0x100034d0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1002d4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x224
lea eax, [ebp - 0x228]
push eax
call fcn.10003940
add esp, 8
mov dword [ebp - 0x228], 0x224
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
call sub.KERNEL32.dll_Module32First
mov dword [ebp - 0x230], eax
jmp 0x10003549
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call sub.KERNEL32.dll_Module32Next
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
je 0x100035b7
mov dword [ebp - 0x228], 0x224
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x208]
push eax
call fcn.1000f080
add esp, 8
test eax, eax
jne 0x100035b2
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.10003820
add esp, 0x10
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
je 0x100035ae
mov eax, dword [ebp - 0x214]
add eax, dword [ebp - 0x234]
jmp 0x100035b9
xor eax, eax
jmp 0x100035b9
jmp 0x10003530
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006c90
mov esp, ebp
pop ebp
ret

Function at 0x10003a80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10003c30
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10003b4d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1002d4b8]
jb 0x10003aca
mov eax, dword [ebp - 4]
cmp eax, dword [0x1002d4bc]
ja 0x10003aca
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10003a9a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100083a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10003af0
jmp 0x10003b4d
cmp dword [ebp - 0x14], 0x10000
jne 0x10003b33
cmp dword [ebp - 0x18], 0x10000
jb 0x10003b33
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10003b26
mov eax, dword [ebp - 8]
jmp 0x10003b4f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10003b48
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10003c30
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10003a9a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10003b60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10003c60
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10003c25
mov edx, dword [ebp - 4]
cmp edx, dword [0x1002d4b8]
jb 0x10003ba5
mov eax, dword [ebp - 4]
cmp eax, dword [0x1002d4bc]
ja 0x10003ba5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10003b75
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100083a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10003bcb
jmp 0x10003c25
cmp dword [ebp - 0x14], 0x10000
jne 0x10003c0e
cmp dword [ebp - 0x18], 0x10000
jb 0x10003c0e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10003c01
mov eax, dword [ebp - 8]
jmp 0x10003c27
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10003c20
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10003c60
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10003b75
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000e5ae
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000e5ed
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e5ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e5ed
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000e5ed
cmp dword [ecx + 0x74], 0xe
jbe 0x1000e5ed
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001294d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100129ea
push ebx
push esi
call fcn.10012916
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100128ac
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10012997
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100129e9
push edi
push eax
call fcn.1000f720
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100129b7
call fcn.1000f320
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100129e8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100128ac
add esp, 0x20
test eax, eax
jne 0x100129d6
push edi
call fcn.1000f320
jmp 0x100129de
push ebx
call fcn.1000f320
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1001a670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001a69d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a69d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x797a7539
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1ebd1f68
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219