joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404640
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x40a864], ebx
jne 0x40468f
call esi
cmp eax, ebx
mov edi, eax
je 0x40466d
mov dword [0x40a864], 1
jmp 0x40468f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x404685
mov dword [0x40a864], 2
jmp 0x40468f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x40a864], 1
jne 0x40473e
test edi, edi
jne 0x4046b2
call esi
mov edi, eax
test edi, edi
jne 0x4046b2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x4046cc
add esi, 2
cmp word [esi], 0
jne 0x4046ba
add esi, 2
cmp word [esi], 0
jne 0x4046ba
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x40472d
push ebp
call fcn.00405de0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x40472d
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x40471c
push ebx
call fcn.004025d0
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x40a864], 2
jne 0x4047c2
test ebx, ebx
jne 0x404761
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x404761
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x404776
inc ebp
cmp byte [ebp], 0
jne 0x404768
inc ebp
cmp byte [ebp], 0
jne 0x404768
sub ebp, ebx
inc ebp
push ebp
call fcn.00405de0
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x40479b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x404d50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x40aaa8
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x404d77
add eax, 8
inc ecx
cmp eax, 0x40ab38
jb 0x404d68
cmp dword [ecx*8 + 0x40aaa8], edx
lea ebx, [ecx*8]
jne 0x404f3b
cmp dword [0x40a53c], 1
je 0x404ef7
cmp dword [0x40a53c], 0
jne 0x404dae
cmp dword [0x40a540], 1
je 0x404ef7
cmp edx, 0xfc
je 0x404f3b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x404deb
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x404e2f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x409368
push ebp
call fcn.004067e0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x409348
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x40aaac]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.00406740
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x40d910], 0
je 0x404f0d
mov eax, dword [0x40d910]
mov esi, dword [eax + 0x48]
cmp esi, 0xffffffff
jne 0x404f17
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x40aaac]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x405770
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
push ebp
xor edi, edi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], edi
cmp ebp, edi
jne 0x405798
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov edx, dword [esp + 0x42c]
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x40d910
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ebx, dword [esp + 0x18]
shl eax, 2
lea ecx, [eax + eax*8]
mov eax, dword [ebx]
mov dword [esp + 0x1c], ecx
test byte [eax + ecx + 4], 0x20
je 0x4057d9
push 2
push 0
push edx
call fcn.004059f0
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x405875
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x4058ae
lea esi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x40583c
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x40582a
mov byte [esi], 0xd
inc edi
inc esi
mov byte [esi], al
inc esi
mov eax, esi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x405811
lea eax, [esp + 0x24]
push 0
sub esi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push esi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4058a4
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, esi
jge 0x4057fc
jmp 0x4058ae
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4058a4
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x4058ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x40595a
cmp dword [esp + 0x10], 0
je 0x40590a
cmp dword [esp + 0x10], 5
jne 0x4058ed
call fcn.004025b0
mov dword [eax], 9
call fcn.004025c0
mov ecx, dword [esp + 0x10]
pop ebp
pop edi
mov dword [eax], ecx
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00402530
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x405934
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x405934
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
call fcn.004025b0
mov dword [eax], 0x1c
call fcn.004025c0
pop ebp
mov dword [eax], 0
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, edi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x4069a0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1008
call fcn.00407de0
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1018]
push ebp
push 1
push ebx
push esi
call fcn.004059f0
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x406ac2
push 2
push ebx
push esi
call fcn.004059f0
add esp, 0xc
cmp eax, 0xffffffff
je 0x406ac2
mov ecx, dword [esp + 0x1020]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x406a63
lea edi, [esp + 0x18]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.00407d70
mov dword [esp + 0x1c], eax
add esp, 8
mov eax, 0x1000
cmp ebp, eax
jge 0x406a1e
mov eax, ebp
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.00405770
add esp, 0xc
mov edi, eax
cmp edi, 0xffffffff
je 0x406a3c
sub ebp, edi
test ebp, ebp
jg 0x406a13
jmp 0x406a53
call fcn.004025c0
cmp dword [eax], 5
jne 0x406a51
call fcn.004025b0
mov dword [eax], 0xd
mov ebx, edi
mov eax, dword [esp + 0x14]
push eax
push esi
call fcn.00407d70
add esp, 8
jmp 0x406aa5
jge 0x406aa5
push 0
push ecx
push esi
call fcn.004059f0
add esp, 0xc
push esi
call fcn.00406140
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x406aa5
call fcn.004025b0
mov dword [eax], 0xd
call fcn.004025c0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.004059f0
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1008
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1008
ret
Function at 0x4082c0
Capabilities:
Get geographical location

Disassembly:
push ebx
mov eax, dword [0x40c30c]
push esi
test eax, eax
push edi
push ebp
jne 0x408308
push 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 1
push 0
call esi
test eax, eax
je 0x4082e8
mov eax, 1
jmp 0x40830e
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x408301
mov eax, 2
jmp 0x40830e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [0x40c30c], eax
cmp eax, 1
jne 0x408333
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov ebx, dword [esp + 0x18]
push ecx
push edx
push ebx
call esi
pop ebp
pop edi
pop esi
pop ebx
ret
mov dword [0x40c30c], eax
cmp eax, 2
jne 0x4083c1
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x40834f
mov edi, dword [0x40b838]
mov eax, dword [esp + 0x18]
push 0
mov ebx, dword [esp + 0x18]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebp, eax
test ebp, ebp
jne 0x408370
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push ebp
call fcn.00405de0
add esp, 4
mov esi, eax
test esi, esi
jne 0x408386
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x18]
push ebp
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4083b6
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4083c6
push 0
push 0
push 0xffffffffffffffff
push esi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jne 0x4083de
push esi
call fcn.004025d0
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push eax
mov eax, dword [esp + 0x20]
push eax
push 0xffffffffffffffff
push esi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
je 0x4083b6
push esi
call fcn.004025d0
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4083f0
Capabilities:
Get geographical location

Disassembly:
push ebx
mov eax, dword [0x40c310]
push esi
test eax, eax
push edi
push ebp
jne 0x408438
push 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 1
push 0
call esi
test eax, eax
je 0x408418
mov eax, 2
jmp 0x40843e
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x408431
mov eax, 1
jmp 0x40843e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [0x40c310], eax
cmp eax, 2
jne 0x408463
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov ebx, dword [esp + 0x18]
push ecx
push edx
push ebx
call esi
pop ebp
pop edi
pop esi
pop ebx
ret
mov dword [0x40c310], eax
cmp eax, 1
jne 0x4084ff
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x40847f
mov edi, dword [0x40b838]
mov eax, dword [esp + 0x18]
push 0
mov ebx, dword [esp + 0x18]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebp, eax
test ebp, ebp
jne 0x4084a0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
lea eax, [ebp*2]
push eax
call fcn.00405de0
add esp, 4
mov esi, eax
test esi, esi
jne 0x4084bd
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x18]
push ebp
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4084f4
mov eax, dword [esp + 0x20]
push 0
push 0
test eax, eax
jne 0x408504
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x40851f
push esi
call fcn.004025d0
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push eax
mov eax, dword [esp + 0x28]
push eax
push 0xffffffffffffffff
push esi
push 0x220
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x4084f4
push esi
call fcn.004025d0
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x102c2e7c]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x102c2e8c], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x102c2e9c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.101317ff
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x102c2e9c], 0
call fcn.10001a30
mov ecx, dword [0x102c2e98]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.101317ff
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x102c2e98], 0
mov dword [0x102c2e8c], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002660
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x102c2e90], 0
je 0x10002679
mov eax, dword [0x102c2e90]
jmp 0x10002719
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000268b
xor eax, eax
jmp 0x10002719
push 8
call fcn.10131b5d
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100026e1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100026ca
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.101317ff
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x102c2e90], eax
mov dword [0x102c2e94], 0
mov eax, dword [ebp - 8]
jmp 0x10002719
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100026fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100026ab
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x102c2e98]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x102c2e98], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10008c40
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x10008c5b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10008c66
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10008c71
bts eax, 5
shr ecx, 1
test cl, 1
je 0x10008c7c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10008c87
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10008c92
bts eax, 2
shr ecx, 1
test cl, 1
je 0x10008c9d
bts eax, 1
test cl, 2
je 0x10008ca6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10008d42
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10008d33
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10008c50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008d70
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x1013d3d0
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10008daa
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10008dd8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x10008e2c
push esi
nop
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10008df2
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10008df0
pop esi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000c000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x1000b350
push 0x900de9
push 0xe8
call fcn.100d5c50
push 0x1000a620
push 0x8c5bb5
push 0xe8
call fcn.100d5c50
push 0xa
call fcn.10131c6d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, eax
mov eax, 0x90909090
mov dword [ebp - 4], 0
add esp, 0x1c
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov word [ebx + 8], ax
lea eax, [ebp - 4]
push eax
push 0x40
push 0xa
push 0x56fc5e
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000c09d
movq xmm0, qword [ebx]
mov ecx, 0x56fc5e
movq qword [ecx], xmm0
mov ax, word [ebx + 8]
mov word [ecx + 8], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 0xa
push ecx
call esi
test eax, eax
jne 0x1000c09f
call edi
mov eax, 0x1000b230
mov byte [ebp - 0x10], 0xe9
sub eax, 0x56fc63
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x56fc5e
call esi
test eax, eax
je 0x1000c0f1
mov eax, dword [ebp - 0x10]
mov ecx, 0x56fc5e
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1000c0f3
call edi
push 0xa
call fcn.10131c6d
mov ebx, eax
mov dword [ebp - 4], 0
mov eax, 0x90909090
add esp, 4
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov word [ebx + 8], ax
lea eax, [ebp - 4]
push eax
push 0x40
push 0xa
push 0x56fd1a
call esi
test eax, eax
je 0x1000c153
movq xmm0, qword [ebx]
mov ecx, 0x56fd1a
movq qword [ecx], xmm0
mov ax, word [ebx + 8]
mov word [ecx + 8], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 0xa
push ecx
call esi
test eax, eax
jne 0x1000c155
call edi
mov eax, 0x1000b2d0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x56fd1f
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x56fd1a
call esi
test eax, eax
je 0x1000c1a7
mov eax, dword [ebp - 0x10]
mov ecx, 0x56fd1a
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1000c1a9
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret