joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003aad0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10086040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push edi
push eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
mov ebx, dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10044743
mov esp, ebp
pop ebp
ret

Function at 0x1003ad60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x10086040]
xor eax, esp
mov dword [esp + 8], eax
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [esp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1003ade9
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1003adb5
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Foreground_process_terminated_successfully.
jmp 0x1003adc0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_terminate_foreground_process.
call fcn.10041cc0
push 0x10041ea0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.10044743
mov esp, ebp
pop ebp
ret
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_open_process.
call fcn.10041cc0
push 0x10041ea0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [esp + 0xc]
pop esi
xor ecx, esp
call fcn.10044743
mov esp, ebp
pop ebp
ret
Function at 0x100401d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x100401e3
xor al, al
pop esi
ret
push ebx
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esi + 0x10]
lea ebx, [esi + 0x10]
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x1004021b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
test ecx, ecx
jne 0x10040227
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
xor al, al
pop esi
ret
cmp dword [esi + 0x14], 7
jbe 0x1004022f
mov esi, dword [esi]
mov eax, dword [ebx]
push esi
inc eax
push eax
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
mov al, 1
pop esi
ret
Function at 0x10040a10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10040a74
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1fffff
mov dword [0x10087a04], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x104
push 0x10087590
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [ebp + 8]
push 0x10040810
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10040a74
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10042a80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
mov esi, 1
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
jbe 0x10042aac
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [0x10087a44]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
mov ecx, 0x10087a4c
lea eax, [esi + esi]
push eax
call fcn.10035230
lea eax, [esi - 1]
mov dword [0x10087a5c], esi
mov esi, dword [0x10087a44]
mov dword [0x10087a58], eax
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x10042bdc
cmp dword [esi + 0x1c], 0xf
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
jbe 0x10042b10
mov edx, dword [ecx]
mov dword [ebp - 4], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x10042b39
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
movzx ecx, byte [eax + edx]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x10042b22
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
and ebx, dword [0x10087a58]
mov ecx, dword [0x10087a4c]
lea ecx, [ecx + ebx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x10042b56
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x10042bd2
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.10037e30
test al, al
jne 0x10042b90
mov ebx, dword [ebx]
cmp ebx, esi
je 0x10042b88
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x10042bcf
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x10042bb2
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.10037e30
test al, al
je 0x10042be5
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x10042b97
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x10042af4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x10042bcf
Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x5e377d53
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x7ad11ce1
nop
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10001299
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001299
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000128a
cmp esi, edx
jae 0x10001299
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10001278
cmp esi, edx
jae 0x10001299
cmp word [esi], 0
je 0x10001299
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10010260
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100469ba
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1005f07c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10001380
mov ecx, eax
test ecx, ecx
je 0x10010424
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10001380
mov ecx, eax
test ecx, ecx
je 0x1001042e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10001380
mov ecx, eax
test ecx, ecx
je 0x10010438
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x10010342
xor ecx, ecx
jmp 0x10010360
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10010350
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.10004e20
push edi
mov ecx, ebx
call fcn.10010520
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1001037c
xor ecx, ecx
jmp 0x10010394
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10010384
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10004e20
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.10010e20
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.10010520
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100103d5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1001040e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001040e
cmp dword [esi + 0x10], 0
je 0x10010405
push dword [edi]
call fcn.10032925
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10001130
push 0x80004005
call fcn.10001130
push 0x80004005
call fcn.10001130
int3
Function at 0x10010c00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046aa8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1005f07c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x10010dd4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10010c55
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x10010dd4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10010c73
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x10010dd4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10010c91
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x10010dd4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10010caf
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x10010dd4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10010dd4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10010cd4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x10010d07
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x10010d1f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x10010d5d
mov esi, ecx
mov eax, 0x7ffffffe
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10009110
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.100294a0
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x1004a714
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100118f0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10010d8b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x10010dc4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x10010dc4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10006f00
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10009060
lea ecx, [ebp - 0x28]
call fcn.10009060
lea ecx, [ebp - 0x34]
call fcn.100104f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001223c
mov esp, ebp
pop ebp
ret 4
Function at 0x10011240
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046b67
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1005f07c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x1001128a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10011296
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.10008f10
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x10011303
push 0x48
call fcn.1001294f
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x100112f7
push 0x48
push 0
push ebx
call fcn.10029fa0
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.10010260
jmp 0x100112f9
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10011330
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.10008f10
push 3
push 0x1004a714
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.1000ead8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001137f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x100113ce
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x100113ce
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.10008f10
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10009060
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10011404
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100113fa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10011441
push edx
push ecx
call fcn.1001224d
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x10011423
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001223c
mov esp, ebp
pop ebp
ret 0x14
call fcn.1002d2de
int3
Function at 0x10015092
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1003f15c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003ee1c

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x10001039
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov cl, cl
jmp 0x1000117c
or ebp, dword [esp + 0x18]
or ebp, 0x6cf75e6d
dec ebp
sub ebp, 0x459830cd
mov ebp, esp
sub esp, 0x10
nop
push ebx
push ebx
pop ebx
push edi
xchg dl, dl
call fcn.10001399
nop
add ax, 0x3bc7
mov eax, dword [esi + 0x3c]
jmp 0x1000166f
mov eax, dword [eax + esi + 0x78]
nop
and dword [ebp - 4], 0
push edi
pop edi
jmp 0x10001869
jne 0x10001cf5
shl al, cl
mov al, cl
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
push ecx
pop ecx
je 0x100022c8
jmp 0x1000229d
add eax, esi
nop
xor edi, esi
add edi, dword [esp + 0x1c]
dec edi
shl edi, cl
or edi, 0x68593fbf
mov edi, dword [eax + 0x24]
sub cx, 0x4659
mov ecx, dword [eax + 0x20]
shl bl, cl
or ebx, 0x43e02a9b
add ebx, edx
and bl, 0xad
rol ebx, cl
mov ebx, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
xchg dx, dx
add edi, esi
xchg eax, eax
add ecx, esi
xchg ax, ax
jmp 0x10001ad7
add ebx, esi
mov cl, cl
test eax, eax
jmp 0x10001af3
mov dword [ebp - 0x10], eax
jmp 0x10001b12
jle 0x100022c0
inc al
mov eax, dword [ebp - 4]
mov edx, dword [ecx + eax*4]
nop
jmp 0x10001cc9
and dword [ebp - 0xc], 0
nop
add edx, esi
nop
mov al, byte [edx]
xchg bl, bl
test al, al
jmp 0x10001ceb
je 0x10001741
mov dword [ebp - 8], edx
nop
dec edx
xor dl, 0xf9
dec edx
and dl, 0x20
xor edx, dword [esp + 0xc]
mov edx, dword [ebp - 0xc]
movsx eax, al
jmp 0x10001d29
rol edx, 3
jmp 0x10001d4a
jmp 0x10001eea
xor edx, eax
xchg dl, dl
inc dword [ebp - 8]
nop
mov eax, ebx
shl ax, cl
or eax, 0x28ff4c27
inc ax
mov eax, dword [ebp - 8]
mov al, byte [eax]
xchg dl, dl
test al, al
jmp 0x10001f28
mov dword [ebp - 0xc], edx
jmp 0x10001f4b
jmp 0x1000173b
inc dword [ebp - 4]
mov cl, cl
or eax, 0x44dc508d
xor eax, dword [esp + 0x1c]
sub eax, 0x7fcf2ccc
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
xchg bl, bl
jl 0x10001b18
xor eax, eax
nop
jmp 0x10002472
xor ax, ax
xor eax, 0x6f0e773b
mov eax, esi
mov eax, dword [ebp - 4]
movzx eax, word [edi + eax*2]
jmp 0x100022e9
mov eax, dword [ebx + eax*4]
nop
jmp 0x1000246f
add eax, esi
nop
dec edi
pop edi
ror ebx, cl
or ebx, dword [esp]
dec bx
mov bl, 0xd5
shr bx, cl
pop ebx
leave
jmp 0x10002494
ret