joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad9bd
Capabilities:
Encode data using xor

Disassembly:
pop ebx
inc edx
stosb byte es:[edi], al
bnd jb 0x4ad96e
and dword [eax + 0x14cd05e9], 0x61
sti
mov cs, edx
mov dword [ebx - 0x155edb96], esp
popal
js 0x4ad92e
aaa
fsub qword [ebx + 0x657d2499]
out 0x71, al
cmp byte [ebp - 0x38fc9d34], dl
pop ss
fmul dword [eax + 0x3b77add5]
cmp ecx, edx
cld
dec ecx
fisub dword [ecx + 0x39]
movsb byte es:[edi], byte [esi]
sub al, 0xe
retf
jno 0x4ad957
call 0xda10cecb
cmpsb byte [esi], byte es:[edi]
leave
cmp bl, 0x66
cmp cl, byte [edx + 0x7f]
cmp byte [ebx + 0x477c8dac], bl
dec ebp
pop eax
cmc
invalid
lea edi, [edi + eax*2 + 0x4d]
xor eax, 0xf79409e4
pop ebp
mov ebp, 0x893efb34
inc esi
or cl, dl
push ebx
add dword [ebx - 0x7f], ebp
stosb byte es:[edi], al
cbw
jnp 0x4ad97e
dec esi
popal
cmp eax, 0x8b1eb5e1
dec ebp
fsub qword [esi]
das
leave
inc esi
pop edi
loopne 0x4ad93c
in eax, 0xc9
and al, 0x71
jno 0x4ad96d
std
cmp al, 0xf6
xchg dword [edx], ebx
xchg esp, eax
enter 0x6ef6, 0xffffffffffffff89
arpl word [ecx + 0x66043964], ax
add al, 0x66
add al, 0x66
mov byte [0x4c2e34f3], al
test byte [ebx + ecx*4 + 0x53], bh
pop esp
dec edx
cld
wait
aas
xchg bh, bh
outsb dx, byte [esi]
dec edi
push ds
jl 0x4ad9cc
jge 0x4ada39
jp 0x4ad9a6
out 0x86, eax
call dword [0x329860c1]
inc ecx
rcl byte [esp + ebp*8 - 0x37]
retf 0x34a8
cmpsd dword [esi], dword es:[edi]
xor al, 0xa3
mov edx, dword [ebx + ebx*8 - 0x23]
mov dword [esi], edi
clc
inc esi
sub ah, dh
jno 0x4ada1c
inc ebx
mov cl, 0x6b
xchg ecx, eax
add ecx, dword [edi - 0x1cd758cd]
mov byte [esi + 0x4b57e066], dh
jecxz 0x4ad9a6
mov dh, 0x66
loopne 0x4ada79
dec ebx
mov dl, 0xb1
sbb al, 0xcb
arpl dx, sp
adc edi, esi
and ch, cl
imul esp, esi, 0xffffffd3
mov byte [eax - 0x4652b48b], bl
jns 0x4ada03
push esp
pop eax
mov esp, 0x1e5075a0
pminsw mm4, qword [eax + 0x43]
ror byte [edi - 0x6dd0a1a9], 1
pop edi
invalid
stosb byte es:[edi], al
and edx, dword [ecx - 0x71]
xchg edx, eax
sbb al, 0x30
aaa
ror dword [ebp + 0x38], 0x33
int1
js 0x4ada8b
xchg byte [ebx - 0x71f6f5f2], dl
loopne 0x4adaaf
or cl, byte [ecx]
mov fs, eax
pop ds
inc ebx
cmp edx, dword [edi + 0x311a3824]
nop
xchg esi, eax
aas
pop ebp
mov esi, 0x776bfd3f
mov byte [ebx - 0x3f5058bd], bl
mov cs, word [edx + 0x3d]
insd dword es:[edi], dx
into
mov dh, byte [esi - 0x5e]
sbb dword [ebx + 0x54], eax
mov al, byte [0x899fd9f6]
invalid
mov byte [0xa0544319], al
neg cl
lahf
mov esi, edi
cmp edi, dword [eax - 0xafda75e]
mov dl, 0xf6
lea ebp, [eax + 0x4e4a1f67]
push es
jle 0x4adb12
mov byte [0x3f0208c9], al
add bl, byte [eax + 0x3c4c22c5]
pop ss
sub al, 6
pop esi
fisubr dword [0xeb0ac846]
in al, 0x2c
add bh, byte [edi]
jecxz 0x4adb0f
and ebx, eax
push ebx
fbld tbyte [edx - 0x2a15a59b]
dec dword [ebx]
xlatb
pop ds
xchg edx, eax
retf 0xbb22
mov cl, 0x10
fnstsw word [eax + edx*2]
cmp al, 0x50
mov ecx, dword es:[0x63ebba0a]
dec edx
mov word [edi], gs
wait
inc edx
iretd
Function at 0x4b33b7
Capabilities:
Encode data using xor

Disassembly:
ljmp 0x48ee:0x8808aef9
pop eax
sahf
sbb ecx, esi
in al, dx
mov ebx, 0x3c3640d9
cmp eax, 0x3706fd37
js 0x4b3314
mov word [ecx - 0x19], fs
dec ecx
xchg esp, eax
clc
mov al, 0x45
pop esi
xchg esp, eax
jnp 0x4b335c
fistp dword [ecx]
mov dh, 0x14
mov eax, 0xe3064056
mov cs, word [edx]
insb byte es:[edi], dx
xor edi, edi
inc esp
nop
or edx, ecx
invalid
int 0xa
mov dh, dh
loope 0x4b33b2
arpl di, sp
add edi, dword [eax + 0x69]
mov dh, dh
cmp dword [eax + eax*2 - 0x59], edx
mov edx, 0xd836aa88
jmp 0x5d8f9fea
ljmp 0xe86f:0xb54ce176

Function at 0x4b94b6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf5f0
push 0x4b934c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4c6dc8], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4c6dc4], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c6dc0], ecx
shr eax, 0x10
mov dword [0x4c6dbc], eax
push 1
call fcn.004ba53b
pop ecx
test eax, eax
jne 0x4b948f
push 0x1c
call fcn.004b9551
pop ecx
call fcn.004ba2f8
test eax, eax
jne 0x4b94a0
push 0x10
call fcn.004b9551
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004ba13c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c7474], eax
call fcn.004ba00a
push eax
or eax, dword [eax]
add byte [ebx + 0x4c6dac], ah
call fcn.004b9dbd
call fcn.004b9d04
call fcn.004b9a14
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004b9cac
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b94ef
movzx eax, word [ebp - 0x2c]
jmp 0x4b94f2
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004b9a41
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004b9b34
pop ecx
pop ecx
ret
Function at 0x4ba5d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2410
cmp edx, dword [eax]
je 0x4ba5f3
add eax, 8
inc ecx
cmp eax, 0x4c24a0
jl 0x4ba5e4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2410]
jne 0x4ba721
mov eax, dword [0x4c6db4]
cmp eax, 1
je 0x4ba6fb
test eax, eax
jne 0x4ba624
cmp dword [0x4c2338], 1
je 0x4ba6fb
cmp edx, 0xfc
je 0x4ba721
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba65b
lea eax, [ebp - 0x1a4]
push 0x4bf958
push eax
call fcn.004bafb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb440
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba69e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb440
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf954
push edi
call fcn.004bd310
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf938
push eax
call fcn.004bafb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bafc0
lea eax, [ebp - 0xa0]
push 0x4bf934
push eax
call fcn.004bafc0
push dword [esi + 0x4c2414]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bafc0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf90c
push eax
call fcn.004bd284
add esp, 0x2c
pop edi
jmp 0x4ba721
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2414]
push 0
push eax
push dword [esi]
call fcn.004bb440
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x409ce1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ce1
lcall 0x5de5, 0x8b10c483
jmp loc.0095f1ac
Function at 0x4e5444
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [edi + eax]
movzx edx, al
mov ebx, edx
mov dword [esp + 0x24], edx
sub ebx, ecx
cmp edi, dword [esp + 0x20]
jl 0x4e53cd
or ebx, 0xffffffff
jmp 0x4e53e3
mov edx, dword [esp + 0x1c]
cmp al, byte [edi + edx + 1]
jne 0x4e54be
test ebx, ebx
je 0x4e54be
mov eax, ebx
mov ecx, edi
cdq
sub ecx, esi
xor eax, edx
dec ecx
sub eax, edx
mov dword [esp + 0x10], ecx
cmp eax, 1
jne 0x4e54a4
mov eax, dword [esp + 0x18]
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jg 0x4e54a4
test ecx, ecx
jle 0x4e54a4
lea eax, [ebx + ebp]
mov edx, ebx
mov dword [esp + 0x18], edx
test eax, eax
jne 0x4e546c
cmp esi, edi
jge 0x4e54b2
xor ebp, ebp
nop dword [eax]
mov eax, ebp
cdq
idiv ecx
add eax, 0xff
cdq
xor eax, edx
sub eax, edx
test ebx, ebx
fstp xword [ecx + 0xd]
fstp xword [ecx + 0xd]
mov ecx, 0xff
sub ecx, eax
mov eax, ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub ebp, 0x1fe
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x4e5434
mov edx, dword [esp + 0x18]
jmp 0x4e54b2
cmp ebp, ebx
jne 0x4e54b2
cmp esi, edi
jge 0x4e54b2
xor ebp, ebp
mov eax, ebp
cdq
idiv ecx
test ebx, ebx
jns 0x4e548c
mov ecx, 0xff
sub ecx, eax
mov eax, ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add ebp, 0xff
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x4e5476
mov edx, dword [esp + 0x18]
jmp 0x4e54b2
xor edx, edx
test ebx, ebx
setg dl
lea edx, [edx*2 - 1]
mov ecx, dword [esp + 0x24]
mov ebp, edx
mov dword [esp + 0x18], ebx
mov esi, edi
mov eax, dword [esp + 0x1c]
inc edi
cmp edi, dword [esp + 0x2c]
jl 0x4e53b4
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x18
ret

Function at 0x52b5c0
Capabilities:
Encode data using xor

Disassembly:
in eax, 8
psrad mm6, 8
psrad mm7, 8
punpcklwd mm4, mm5
punpcklwd mm6, mm7
punpckldq mm4, mm6
pmaddwd mm4, qword [esp + 8]
movq mm0, mm4
psrlq mm4, 0x20
paddd mm0, mm4
mov ecx, dword [ebp + 0x1c]
mov ecx, dword [ecx]
movd eax, mm0
add eax, 0x80000
sar eax, 0x14
mov ebx, 0xff
cmp eax, ebx
cmovg eax, ebx
xor ebx, ebx
cmp eax, ebx
cmovl eax, ebx
mov byte [ecx + edi], al
int3
pushal
xchg esi, eax
push eax
inc esi
and edi, dword [ecx - 0x765136ba]
nop
jp 0x52b626
sub byte [ecx + 3], ah
mov esp, 0x9a4e4840
leave
pushal
jo 0x52b56a
imul esi
cmp al, 0xd8
ljmp 0x442d
dec esi
sal esi, 0xbf
dec esi
xor byte [0x9ee96096], 0x1e
mov eax, dword [0x3a91505]
mov esi, 0x450dbf14
cwde
sbb dword [ebx], ebx
and bl, byte [eax + 0x7e78e72d]
adc al, 0x32
mov ch, 0x64
mov ebp, 0x95eabaac
xchg ebp, eax
out 0xf3, al
sub byte [esi + 0x42], 0xc1
push ecx
push 0x60
inc eax
add dh, byte [edi]
mov ebp, ebx
dec edx
dec ebx
xor dword [ecx + 0x62], 0xffffffec
dec ebp
sub eax, esp
loop 0x52b60b
loop 0x52b5ff
lds eax, [edx - 0x33]
sahf
adc al, 0xf5
in al, dx
sbb byte [edi - 0x17729a38], ch
inc ebx
xchg edi, eax
in eax, dx
retf
Function at 0xe8e470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0xbe8015
lea edi, [esi - 0x7e7015]
push edi
jmp 0xe8e48a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xe8e491
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe8e480
mov eax, 1
add ebx, ebx
jne 0xe8e4a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xe8e4b4
jne 0xe8e4d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe8e4d3
dec eax
add ebx, ebx
jne 0xe8e4c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xe8e498
add ebx, ebx
jne 0xe8e4cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xe8e525
xor ecx, ecx
sub eax, 3
jb 0xe8e4eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xe8e55a
sar eax, 1
mov ebp, eax
jmp 0xe8e4f6
add ebx, ebx
jne 0xe8e4f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe8e4c4
inc ecx
add ebx, ebx
jne 0xe8e504
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe8e4c4
add ebx, ebx
jne 0xe8e511
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xe8e506
jne 0xe8e522
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xe8e506
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xe8e544
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xe8e536
jmp 0xe8e486
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xe8e544
add edi, ecx
jmp 0xe8e486
pop esi
mov edi, esi
mov ecx, 0x3b9c4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xe8e562
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xe8e567
lea edi, [esi + 0xa8c000]
mov eax, dword [edi]
or eax, eax
je 0xe8e5cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa96e3c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa96ef0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xe8e58d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa96ef4]
or eax, eax
je 0xe8e5c9
mov dword [ebx], eax
add ebx, 4
jmp 0xe8e5aa
call dword [esi + 0xa96f04]
mov ebp, dword [esi + 0xa96ef8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xe8e603
sub esp, 0xffffff80
jmp 0x4012a0
Function at 0x10004069
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10007014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
push edi
push 0x10001b24
push 0x32
mov word [eax], cx
mov ecx, dword [ebp + 0x10]
pop edx
call fcn.10002890
mov eax, dword [ebp + 0x18]
xor ecx, ecx
push 0x10001bec
mov word [eax], cx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x100041b3
xor edi, edi
push edi
push 1
push 0x10
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
test eax, eax
je 0x100041b3
push eax
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
test eax, eax
je 0x100041b3
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x100041b3
movzx esi, word [ebx]
mov eax, esi
shr eax, 1
add eax, esi
call fcn.10006420
mov eax, esp
push esi
push ebx
push eax
mov dword [ebp - 0xc], eax
call sub.msvcrt.dll_memcpy
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
add esp, 0xc
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10001b3c
push esi
call dword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x1000414d
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp ax, word [edi*8 + 0x100010c0]
je 0x1000413b
inc edi
cmp edi, 0x27
jb 0x10004129
jmp 0x1000414d
push dword [edi*8 + 0x100010c4]
mov ecx, dword [ebp + 8]
push 5
pop edx
call fcn.10002890
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0x10001814
push esi
call dword [sym.imp.api_ms_win_core_version_l1_1_0.dll_VerQueryValueW]
test eax, eax
je 0x100041b3
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0xffffffff
je 0x10004197
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x10001b70
push 0x32
push dword [ebp + 0x10]
call fcn.10003bf4
mov ecx, dword [ebp - 8]
add esp, 0x1c
test byte [ecx + 0x1c], 1
mov eax, 0x10001b88
jne 0x100041a7
mov eax, 0x10001b90
mov ecx, dword [ebp + 0x18]
push eax
push 5
pop edx
call fcn.10002890
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005e20
leave
ret 0x14
Function at 0x1000424f
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
mov dword [ebp - 0xc], ecx
mov eax, ebx
mov dword [ebp - 8], ebx
shr eax, 0x1e
push esi
push edi
cmp eax, 1
jbe 0x10004278
push 2
pop edi
cmp eax, edi
je 0x1000427b
xor edi, edi
inc edi
jmp 0x1000427b
push 4
pop edi
mov esi, dword [0x10008d64]
test esi, esi
je 0x100042de
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, esi
call dword [0x1000a1a0]
call esi
test eax, eax
js 0x100042de
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100042db
mov esi, dword [ebx]
xor eax, eax
push eax
push dword [ebp + 0x14]
mov ecx, dword [esi + 0xc]
push eax
push 1
push eax
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, ax
push eax
movzx eax, di
push eax
push ebx
call dword [0x1000a1a0]
call dword [esi + 0xc]
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x1000a1a0]
call esi
jmp 0x1000430f
mov ebx, dword [ebp - 8]
push 0x10001c04
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x1000430f
xor eax, eax
push eax
push dword [ebp + 0x14]
push eax
push 1
push eax
mov eax, dword [ebp - 0xc]
push ebx
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x100044b1
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x10007014]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
lea ecx, [ebp - 0x414]
mov word [ebp - 0x414], ax
mov edx, 0x208
mov word [ebp - 6], ax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.10003bbd
test eax, eax
js 0x100045a6
push edi
push 0x44
xor edi, edi
lea eax, [ebp - 0x46c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x46c], 0x44
mov dword [ebp - 0x440], 0x81
push 6
pop eax
mov word [ebp - 0x43c], ax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x46c]
push eax
push edi
push edi
push 8
push edi
push edi
push edi
lea eax, [ebp - 0x414]
push eax
push edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
je 0x10004593
push 0xffffffffffffffff
push dword [ebp - 0x428]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], edi
push eax
push dword [ebp - 0x428]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
push dword [ebp - 0x428]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push dword [ebp - 0x424]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [ebp - 0x418]
jmp 0x10004599
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x100045a5
movzx eax, ax
or eax, 0x80070000
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005e20
leave
ret
Function at 0x10004e6a
Capabilities:
Print debug messages

Disassembly:
push 0x18
push 0x10006610
call fcn.10006194
xor esi, esi
mov dword [ebp - 0x24], esi
mov ebx, esi
mov dword [ebp - 0x20], ebx
cmp dword [0x1000907c], ebx
je 0x10004e97
push 0x10009064
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
inc ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], esi
xor eax, eax
mov word [0x10007350], ax
cmp dword [ebp + 0x14], eax
je 0x10004ecb
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
mov edx, 0x3fd
mov ecx, 0x10007350
call fcn.10003bbd
xor eax, eax
mov word [0x10007b4a], ax
mov ax, word [0x10007350]
mov edi, 0x400
test ax, ax
je 0x10004ee6
push 0x10001e58
mov edx, edi
mov ecx, 0x10007350
call fcn.100028c5
mov ecx, 0x10007350
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10004eee
sub ecx, edx
sar ecx, 1
sub edi, ecx
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x1c]
push eax
call fcn.10003dae
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], esi
je 0x10004f1c
lea eax, [ebp - 0x1c]
push eax
call fcn.10003f61
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, dword [edi]
call fcn.10003f99
cmp dword [edi], esi
jne 0x10004f31
cmp dword [edi + 0x18], esi
je 0x10004f42
lea eax, [ebp - 0x1c]
push eax
push ecx
push ecx
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
call fcn.10004013
lea eax, [ebp - 0x1c]
push eax
call fcn.100041c7
movzx ecx, word [edi + 4]
mov dword [ebp - 0x28], 0x10007350
lea eax, [ebp - 0x28]
push eax
sub esp, 0xc
mov edx, dword [edi + 8]
call fcn.1000424f
mov eax, dword [edi + 8]
mov ecx, 0xc0000000
and eax, ecx
cmp eax, ecx
jne 0x10004f7a
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000501c
cmp dword [edi + 0x18], esi
je 0x10005004
cmp dword [edi + 0x1c], esi
je 0x10004fed
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
test eax, eax
jne 0x10004fa2
cmp byte [0x7ffe02d4], al
je 0x10004fed
push dword [edi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
push eax
push 0x10001e60
push 0x3ff
mov ebx, 0x10007d60
push ebx
call fcn.10003bf4
add esp, 0x20
push 0x10001f08
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
push ebx
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
push 0x10001f98
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
cmp dword [edi + 0x18], esi
je 0x10005004
push ecx
push dword [edi + 0x1c]
push dword [ebp - 0x24]
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
call fcn.10004ab7
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005301
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
jne 0x10005323
push eax
push eax
push 0x100022f4
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov dword [esi], eax
test eax, eax
je 0x1000548a
push 0x1000230c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 4], eax
test eax, eax
je 0x1000548a
push 0x1000231c
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 8], eax
test eax, eax
je 0x1000548a
push 0x1000232c
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0xc], eax
test eax, eax
je 0x1000548a
push 0x10002338
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x10], eax
test eax, eax
je 0x1000548a
push 0x1000234c
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x14], eax
test eax, eax
je 0x1000548a
push 0x1000235c
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x18], eax
test eax, eax
je 0x1000548a
push 0x1000236c
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x1000548a
push 0x1000237c
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x20], eax
test eax, eax
je 0x1000548a
push 0x1000238c
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x24], eax
test eax, eax
je 0x1000548a
push 0x100023a4
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x28], eax
test eax, eax
je 0x1000548a
push 0x100023bc
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x1000548a
push 0x100023d0
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x30], eax
test eax, eax
je 0x1000548a
push 0x100023e4
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x34], eax
test eax, eax
je 0x1000548a
push 0x100023f8
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x38], eax
test eax, eax
je 0x1000548a
push 0x1000240c
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x3c], eax
test eax, eax
je 0x1000548a
push 0x1000241c
push dword [esi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [esi + 0x40], eax
test eax, eax
je 0x1000548a
mov al, 1
pop esi
ret
xor al, al
pop esi
ret