joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x10039cb7
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.100253c0
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10039cdc
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.100253c0
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10039d01
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.100253c0
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov eax, dword [esi + 0x78]
test eax, eax
je 0x10039d42
push eax
mov dword [esi + 0x74], 0
mov dword [esi + 0x70], 0
call fcn.100253c0
add esp, 4
mov dword [esi + 0x78], 0
mov eax, dword [esi + 0x84]
test eax, eax
je 0x10039d70
push eax
mov dword [esi + 0x80], 0
mov dword [esi + 0x7c], 0
call fcn.100253c0
add esp, 4
mov dword [esi + 0x84], 0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x10039d95
push eax
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
call fcn.100253c0
add esp, 4
mov dword [esi + 0x40], 0
lea ecx, [esi + 0x5c]
pop esi
jmp fcn.100358f0
Function at 0x10043020
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push esi
call fcn.10021380
test eax, eax
je 0x10043034
call fcn.10021620
mov esi, dword [eax + 0x6c]
jmp 0x10043036
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x10043059
mov dword [esi], eax
pop esi
ret
Function at 0x10059ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x1009b0bc]
test eax, eax
je 0x10059cfc
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x10059d4b
mov eax, dword [eax]
test eax, eax
jne 0x10059cf0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10059d59
push esi
push edi
xor edi, edi
mov dword [eax + 8], 0
lea edx, [eax + 0x20]
lea esi, [edi + 0x20]
mov dword [edx], edi
mov ecx, edx
mov dword [eax + 4], edx
add esi, 0x20
add edx, 0x20
mov edi, ecx
cmp esi, 0xfe0
jbe 0x10059d25
mov ecx, dword [0x1009b0bc]
pop edi
mov dword [eax], ecx
pop esi
mov dword [0x1009b0bc], eax
mov edx, dword [eax + 4]
mov ecx, dword [edx]
inc dword [eax + 8]
mov dword [eax + 4], ecx
mov eax, edx
ret
xor eax, eax
ret
Function at 0x1005a6e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
imul esi, dword [ebp + 8], 0x2c
push edi
add esi, dword [0x1009b0b0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp + 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1005a728
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1005a74d
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1005a76e
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1005a76e
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1005a768
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1005a76e
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
shl bl, 2
add cl, cl
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
xor eax, eax
mov byte [esi + 0x14], bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005a850
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100969c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1005a948
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1005a941
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x1005a928
call ebx
cmp dword [ebp - 0x14], eax
jne 0x1005a928
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1005a928
mov edx, dword [esi]
test edx, edx
jne 0x1005a8f1
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x1009a634]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1005a941
jmp 0x1005a91c
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1005a91c
shl eax, 3
push eax
push edx
push 0
push dword [0x1009a634]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1005a941
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1005a8b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1005a98c
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x1005a98c
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1005a986
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.1005ac20
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x1005a954
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b715
mov esp, ebp
pop ebp
ret

Function at 0x1005ad90
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0
je 0x1005ade0
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x1005adcf
push ebx
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1005adc8
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x1005ada5
pop ebx
push dword [edi]
push 0
push dword [0x1009a634]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebp
ret
Function at 0x100661d2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10079ba0
mov eax, dword [0x100969c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1006d531
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10066214
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10066370
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10079af0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1009abc0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.10070368
mov ecx, dword [esi*4 + 0x1009abc0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x10066369
cmp eax, dword [edi + ecx + 0x24]
jne 0x10066369
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10066369
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10070368
add esp, 0x14
test edx, edx
jl 0x10066369
jg 0x100662df
test eax, eax
jb 0x10066369
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10066369
jl 0x100662f9
cmp dword [ebp - 0x1008], eax
ja 0x10066369
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10066317
test ebx, ebx
je 0x10066350
cmp ecx, edi
jae 0x10066350
mov al, byte [ecx]
cmp al, 0xd
jne 0x10066331
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1006633d
cmp byte [ecx + 1], 0xa
jne 0x1006633d
inc ecx
jmp 0x1006633d
movzx eax, al
movsx eax, byte [eax + 0x10096c00]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10066317
cmp edx, ebx
jne 0x10066317
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1006636e
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1005b715
leave
ret

Function at 0x1006df3a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100897c0
push 0x100897b8
push str.FlsAlloc
push 0x1e
call fcn.1006de58
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006df6e
push dword [ebp + 8]
mov ecx, esi
call dword [0x1007d244]
call esi
jmp 0x1006df74
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1006dfb8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100897d0
push 0x100897c8
push str.FlsGetValue
push 0x20
call fcn.1006de58
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006dfef
push dword [ebp + 8]
mov ecx, esi
call dword [0x1007d244]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1006f66c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1009abc0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1006f6ac
cmp byte [ebx], 0xa
jne 0x1006f6ac
or byte [eax + edi + 0x28], 4
jmp 0x1006f6b1
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x1006f7af
mov al, byte [edx]
cmp al, 0x1a
je 0x1006f791
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1006f6e0
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1006f705
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1006f70f
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1006f6c2
jmp 0x1006f7af
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006f78c
cmp dword [ebp - 0xc], 0
je 0x1006f78c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x1009abc0]
test byte [eax + edi + 0x28], 0x48
je 0x1006f766
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1006f751
mov byte [esi], dl
jmp 0x1006f762
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1009abc0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x1006f7af
cmp byte [ebp - 1], 0xa
jne 0x1006f775
cmp esi, ebx
jne 0x1006f775
mov byte [esi], 0xa
jmp 0x1006f7ae
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10070386
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1006f7af
mov byte [esi], 0xd
jmp 0x1006f7ae
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x1009abc0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1006f7ab
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1006f7af
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1006f7b8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x1009abc0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1006f7fb
cmp word [esi], dx
jne 0x1006f7fb
or byte [edi + eax + 0x28], 4
jmp 0x1006f800
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x1006f953
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x1006f933
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x1006f842
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1006f878
cmp eax, edx
jae 0x1006f884
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x1006f81a
jmp 0x1006f953
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006f92f
cmp dword [ebp - 0x14], 0
je 0x1006f92f
mov eax, dword [ebx*4 + 0x1009abc0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x1006f907
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x1006f8d0
mov word [esi], cx
jmp 0x1006f903
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x1009abc0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x1009abc0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x1009abc0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x1006f953
pop ebx
cmp word [ebp - 4], bx
jne 0x1006f918
cmp esi, dword [ebp + 0xc]
jne 0x1006f918
mov word [esi], bx
jmp 0x1006f950
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10070386
add esp, 0x10
cmp word [ebp - 4], bx
je 0x1006f953
push 0xd
jmp 0x1006f94c
mov ecx, dword [ebx*4 + 0x1009abc0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1006f94a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1006f953
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10070174
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006ffe5
Function at 0x10072b97
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10072c34
push ebx
push esi
call fcn.10072b60
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10072aa9
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10072be1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10072c33
push edi
push eax
call fcn.1006c3f2
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10072c01
call fcn.1006c3b8
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10072c32
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10072aa9
add esp, 0x20
test eax, eax
jne 0x10072c20
push edi
call fcn.1006c3b8
jmp 0x10072c28
push ebx
call fcn.1006c3b8
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10078d41
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10078cbd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10078eb9
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10078eb9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10078e68
jg 0x10078d9a
test eax, eax
je 0x10078e5e
push 1
push 0x1000
call fcn.1006dce2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10078dc0
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x10078e55
push 0x8000
push ebx
call fcn.10078bee
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10078dec
jg 0x10078de7
cmp ecx, 0x1000
jb 0x10078dec
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1006f46c
add esp, 0x10
cmp eax, 0xffffffff
je 0x10078e31
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10078de7
jl 0x10078e18
test ecx, ecx
jne 0x10078dd9
push dword [ebp - 0xc]
push ebx
call fcn.10078bee
push esi
call fcn.1006c3b8
add esp, 0xc
xor edi, edi
jmp 0x10078eca
cmp byte [edi + 0x24], 0
je 0x10078e48
cmp dword [edi + 0x20], 5
jne 0x10078e48
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10078e53
mov edi, dword [edi + 0x18]
jmp 0x10078e55
xor edi, edi
push esi
call fcn.1006c3b8
pop ecx
jmp 0x10078eca
test ecx, ecx
jg 0x10078e2a
jl 0x10078e68
test eax, eax
jae 0x10078e2a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10070386
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10078e8b
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x10078e2a
jmp 0x10078ec2
push ebx
call fcn.100759cf
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10078e2a
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x10078eca
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x10078ec7
mov edi, dword [edi + 0x18]
jmp 0x10078eca
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10070386
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10079960
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1007998d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1007998d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x43ebc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x43ec52
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x43ec44
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x43ec3c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x43ec05
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x43ec60
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x43ecca
push esi
lea edi, [eax + 0x400]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x43ec9a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x43ece6
push ecx
push esi
call fcn.0043f600
add esp, 8
mov ebx, eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x43ed40
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43ed5e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43ed53
pop esi
ret

Function at 0x43b66f
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
or ecx, ecx
push ecx
pop ebx
or ecx, ecx
call fcn.0043b6ae
add ebx, 0xb9239fd3
add ebx, 0xaab9ad70
xor dword [edi], edx
mov ecx, 0x169350fa
inc edi
dec ebx
dec ebx
push 0x48e8da93
mov ebx, dword [esp]
add esp, 4
cmp edi, eax
jne fcn.0043b66f
dec ebx
ret
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44c014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x57
call fcn.0040d6f2
xor ecx, ecx
inc ecx
test eax, eax
cmovs eax, ecx
cmp eax, 0xfffffffd
jl 0x401114
push ecx
mov ecx, 0x27b13ecc
mov ecx, 0x11911498
sbb ecx, esi
nop
pop ecx
mov word [ebp - 0x1f], 0x6f72
call fcn.0040d6f2
test eax, eax
push 1
pop esi
cmovs eax, esi
cmp eax, 0xffffffde
jge 0x40105f
call fcn.004028b3
mov dword [ebp - 0x1d], 0x4e20676e
mov word [ebp - 0x19], 0x6d75
call fcn.0040d6f2
test eax, eax
cmovs eax, esi
cmp eax, 0xffffffdf
jl 0x401114
mov dword [ebp - 0x17], 0x20726562
mov dword [ebp - 0x13], 0x4120664f
mov dword [ebp - 0xf], 0x6d756772
mov byte [ebp - 0xb], 0x65
call fcn.0040d6f2
test eax, eax
cmovs eax, esi
cmp eax, 0xfffffffc
jl 0x401114
mov dword [ebp - 0xa], 0x73746e
push ebx
mov ebx, 0xe87c12a9
sbb ebx, esi
add ebx, edx
sbb ebx, esi
or ebx, ebx
nop
pop ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
add eax, esp
add eax, esp
xor eax, esp
add eax, esp
add eax, esp
pop eax
xor eax, eax
mov edx, eax
cmp dword [ebp + 0xc], eax
jle 0x4010f4
mov ebx, dword [ebp - 0x24]
sub eax, 1
push 0x18
pop ecx
cmovs eax, ecx
mov cl, byte [ebp + eax - 0x20]
xor byte [ebx + edx], cl
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x4010de
push edx
add edx, esi
sbb edx, esi
sbb edx, esi
add edx, eax
sbb edx, edx
sbb edx, esp
pop edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00403422
leave
ret
call fcn.00402861
int3