joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a735
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov edi, dword [esi + 4]
inc ebx
cmp edi, 2
jae 0x43a7a5
test edi, edi
je 0x43a752
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov al, byte [eax]
mov byte [ecx], al
call fcn.00442c8b
and dword [eax], 0
push dword [esi + 0x40]
mov ecx, edi
mov eax, 0x4000
sar eax, cl
push eax
mov eax, dword [esi + 0x44]
add eax, edi
push ebx
push eax
call fcn.00442f6b
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x43a78d
push dword [esi + 0x40]
call fcn.004430d5
test eax, eax
pop ecx
je 0x43a78d
or dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
cmp eax, 2
mov ecx, dword [esi + 0x44]
mov dword [esi], ecx
jae 0x43a7a5
mov dword [esi + 0x58], eax
jmp 0x43a85e
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x43a85b
cmp byte [eax + 1], 0x8b
jne 0x43a85b
add dword [esi + 4], 0xfffffffe
add eax, 2
mov dword [esi], eax
call fcn.0043a6d4
mov edi, eax
call fcn.0043a6d4
cmp edi, 8
mov ebx, eax
jne 0x43a852
test bl, 0xe0
jne 0x43a852
push 6
pop edi
call fcn.0043a6d4
dec edi
jne 0x43a7de
test bl, 4
je 0x43a80d
call fcn.0043a6d4
mov edi, eax
call fcn.0043a6d4
shl eax, 8
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x43a80d
call fcn.0043a6d4
cmp eax, 0xffffffff
jne 0x43a7fc
test bl, 8
je 0x43a820
call fcn.0043a6d4
test eax, eax
je 0x43a820
cmp eax, 0xffffffff
jne 0x43a812
test bl, 0x10
je 0x43a833
call fcn.0043a6d4
test eax, eax
je 0x43a833
cmp eax, 0xffffffff
jne 0x43a825
test bl, 2
je 0x43a843
push 2
pop edi
call fcn.0043a6d4
dec edi
jne 0x43a83b
mov eax, dword [esi + 0x3c]
neg eax
sbb eax, eax
and eax, 0xfffffffd
mov dword [esi + 0x38], eax
jmp 0x43a85e
mov dword [esi + 0x38], 0xfffffffd
jmp 0x43a85e
mov dword [esi + 0x58], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x43ab7d
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x47e614]
test eax, eax
je 0x43ac7d
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [0x47e614], 0
xor eax, eax
movzx edx, byte [eax + 0x457d28]
push 0x1f
pop ecx
sub ecx, edx
xor edx, edx
inc edx
shl edx, cl
or esi, edx
inc eax
cmp eax, 0xe
jb 0x43ab9d
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x43abc7
shr eax, 1
xor eax, esi
jmp 0x43abc9
shr eax, 1
dec edx
jne 0x43abbd
mov dword [ecx*4 + 0x480010], eax
inc ecx
cmp ecx, 0x100
jl 0x43abb8
mov edi, 0x481010
mov ecx, 0xff00
mov eax, dword [edi - 0x1000]
mov esi, eax
and esi, ecx
mov ebx, eax
shl ebx, 0x10
add esi, ebx
mov edx, eax
shr edx, 8
shl esi, 8
mov ebx, edx
and ebx, ecx
add esi, ebx
mov ebx, eax
shr ebx, 0x18
add esi, ebx
mov dword [edi], esi
lea esi, [edi + 0x400]
mov dword [esp + 0x10], 3
and eax, 0xff
mov eax, dword [eax*4 + 0x480010]
xor eax, edx
mov ebx, eax
and ebx, ecx
mov ebp, eax
shl ebp, 0x10
add ebx, ebp
mov edx, eax
shr edx, 8
shl ebx, 8
mov ebp, edx
and ebp, ecx
add ebx, ebp
mov ebp, eax
shr ebp, 0x18
add ebx, ebp
mov dword [esi - 0x1000], eax
mov dword [esi], ebx
add esi, 0x400
dec dword [esp + 0x10]
jne 0x43ac1c
add edi, 4
cmp edi, 0x481410
jl 0x43abe6
pop edi
pop esi
pop ebp
mov dword [0x47e610], 0
pop ebx
pop ecx
ret
mov eax, dword [0x47e610]
test eax, eax
jne 0x43ac7d
pop ecx
ret
Function at 0x43c524
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x43c5b1
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0043f3d0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x43c571
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x43c593
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x43c670
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x43c5d9
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x43c5e4
xor eax, eax
jmp 0x43c631
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x43c602
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
push edx
call fcn.0043d5d9
pop ecx
jmp 0x43c615
cmp ecx, 2
jne 0x43c61b
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.0043ac88
add esp, 0xc
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.0043f3d0
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x43c65c
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x43c670
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x43c52f
pop edi
pop ebx
leave
ret
Function at 0x442ccf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x442d0c
cmp dword [ebp + 0x14], edi
je 0x442d0c
cmp ecx, edi
jne 0x442d13
call fcn.00442c8b
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00443f19
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x442d27
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x442d48
cmp ebx, 0xffffffff
je 0x442d37
push ebx
push edi
push ecx
call fcn.0043efa0
add esp, 0xc
cmp esi, edi
je 0x442cf4
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x442cf4
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x442d64
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x442d6b
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x442e5c
test word [esi + 0xc], 0x10c
je 0x442dbf
mov eax, dword [esi + 4]
test eax, eax
je 0x442dbf
jl 0x442ebd
cmp ebx, eax
mov edi, ebx
jb 0x442d90
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x442e64
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0044a6df
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x442e54
cmp ebx, dword [ebp - 0xc]
jb 0x442e2c
cmp dword [ebp - 0xc], 0
je 0x442de9
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x442dde
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x442de5
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x442df4
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x442df4
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x442e90
push eax
push dword [ebp - 8]
push esi
call fcn.00445937
pop ecx
push eax
call fcn.0044a5e2
add esp, 0xc
test eax, eax
je 0x442ecf
cmp eax, 0xffffffff
je 0x442ebd
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x442e54
push esi
call fcn.00449f01
cmp eax, 0xffffffff
pop ecx
je 0x442ec1
cmp dword [ebp - 4], 0
je 0x442e90
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x442d73
mov eax, dword [ebp + 0x14]
jmp 0x442d0e
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x442e7b
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0043efa0
add esp, 0xc
call fcn.00442c8b
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x442d04
cmp dword [ebp + 0xc], 0xffffffff
je 0x442ea6
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0043efa0
add esp, 0xc
call fcn.00442c8b
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x442d04
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x442d0e
or dword [esi + 0xc], 0x10
jmp 0x442ec1
Function at 0x447000
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x47da88]
je 0x44701b
inc edi
cmp edi, 0x17
jb 0x44700c
cmp edi, 0x17
jae 0x44719b
push ebp
push 3
call fcn.0044f0b2
cmp eax, 1
pop ecx
je 0x447167
push 3
call fcn.0044f0b2
test eax, eax
pop ecx
jne 0x44704f
cmp dword [0x47d040], 1
je 0x447167
cmp ebx, 0xfc
je 0x44719a
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x47ed68
push ebp
call fcn.00449de9
add esp, 0xc
test eax, eax
je 0x447085
push esi
push esi
push esi
push esi
push esi
call fcn.00443e1d
add esp, 0x14
push 0x104
mov esi, 0x47ed81
push esi
push 0
mov byte [0x47ee85], 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x4470c9
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00449de9
add esp, 0xc
test eax, eax
je 0x4470c9
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00443e1d
add esp, 0x14
push esi
call fcn.0043f060
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x44710e
push esi
call fcn.0043f060
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x47f07c
push 0x453bcc
sub ecx, eax
push ecx
push eax
call fcn.00449e4e
add esp, 0x14
test eax, eax
je 0x44710e
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00443e1d
add esp, 0x14
jmp 0x447110
xor esi, esi
push 0x453bc8
push ebx
push ebp
call fcn.0044be9e
add esp, 0xc
test eax, eax
je 0x447130
push esi
push esi
push esi
push esi
push esi
call fcn.00443e1d
add esp, 0x14
push dword [edi*8 + 0x47da8c]
push ebx
push ebp
call fcn.0044be9e
add esp, 0xc
test eax, eax
je 0x447152
push esi
push esi
push esi
push esi
push esi
call fcn.00443e1d
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0044eef5
add esp, 0xc
jmp 0x44719a
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x44719a
cmp ebp, 0xffffffff
je 0x44719a
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x47da8c]
push dword [esi]
call fcn.0043f060
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x44894e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47da70]
jne 0x448958
repz ret
jmp fcn.0044fd05
Function at 0x44eef5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004440af
xor ebx, ebx
cmp dword [0x47f444], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x44efcb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x44f0ab
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x44f0ab
push eax
call fcn.00444041
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x47f444], eax
call esi
push eax
call fcn.00444041
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47f448], eax
call esi
push eax
call fcn.00444041
mov dword [0x47f44c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004447b0
test eax, eax
pop ecx
pop ecx
je 0x44ef99
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00443e1d
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x44efcb
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00444041
cmp eax, ebx
pop ecx
mov dword [0x47f454], eax
je 0x44efcb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00444041
pop ecx
mov dword [0x47f450], eax
mov eax, dword [0x47f450]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x44f050
cmp dword [0x47f454], ecx
je 0x44f050
push eax
call fcn.004440b8
push dword [0x47f454]
mov esi, eax
call fcn.004440b8
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x44f050
cmp edi, ebx
je 0x44f050
call esi
cmp eax, ebx
je 0x44f01d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44f01d
test byte [ebp - 0x18], 1
jne 0x44f050
lea eax, [ebp - 0x10]
push eax
call fcn.004447e7
test eax, eax
pop ecx
je 0x44f038
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00443e1d
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x44f047
or dword [ebp + 0x10], 0x200000
jmp 0x44f08b
or dword [ebp + 0x10], 0x40000
jmp 0x44f08b
mov eax, dword [0x47f448]
cmp eax, dword [ebp - 8]
je 0x44f08b
push eax
call fcn.004440b8
cmp eax, ebx
pop ecx
je 0x44f08b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44f08b
mov eax, dword [0x47f44c]
cmp eax, dword [ebp - 8]
je 0x44f08b
push eax
call fcn.004440b8
cmp eax, ebx
pop ecx
je 0x44f08b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47f444]
call fcn.004440b8
cmp eax, ebx
pop ecx
je 0x44f0ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44f0ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003b09
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x28
push 0x1d9288
call 0x10008ee0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov esi, 0x14c
cmp word [eax + 4], si
jne 0x10003b35
add eax, 0x78
jmp 0x10003b3a
add eax, 0x88
mov esi, dword [eax]
add esi, ecx
cmp dword [eax], edx
je 0x10003c28
cmp dword [eax + 4], edx
je 0x10003c28
cmp dword [esi + 0x1c], edx
je 0x10003c28
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x28], eax
cmp eax, edx
je 0x10003c28
mov eax, dword [esi + 0x1c]
add eax, ecx
mov dword [ebp - 0x30], eax
cmp dword [esi + 0x24], edx
je 0x10003c18
mov edi, dword [esi + 0x24]
add edi, ecx
mov dword [ebp - 0x38], edi
mov ebx, dword [esi + 0x20]
add ebx, ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jae 0x10003c28
and dword [ebp - 0x1c], 0
xor eax, eax
inc eax
je 0x10003ba9
movzx ecx, word [edi]
add ecx, dword [esi + 0x10]
cmp eax, ecx
jmp 0x10003bda
mov eax, dword [ebx]
add eax, ecx
mov dword [ebp - 0x2c], eax
xor ecx, ecx
inc ecx
je 0x10003bc7
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003be3
push ecx
push eax
call dword [0x1d9094]
test eax, eax
jmp 0x10003bda
push eax
call dword [0x1d9034]
mov edx, dword [ebp - 0x2c]
call fcn.100062b9
xor ecx, ecx
cmp ecx, eax
jne 0x10003be3
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
je 0x10003c02
movzx eax, word [edi]
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x20], eax
xor eax, eax
je 0x10003c28
mov ecx, dword [ebx]
add ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x10003c28
add ebx, 4
mov dword [ebp - 0x34], ebx
inc edi
inc edi
mov dword [ebp - 0x38], edi
inc dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
jmp 0x10003b8a
mov dword [ebp - 0x20], eax
jmp 0x10003c28
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
call 0x10008f1b
ret 4

Function at 0x100060b4
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x100062b9
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
test edx, edx
je 0x100062fe
or eax, 0xffffffff
test esi, esi
je 0x100062fa
push edi
mov cl, byte [edx]
movzx edi, al
movzx ecx, cl
xor edi, ecx
and edi, 0xf
shr eax, 4
xor eax, dword [edi*4 + 0x1d9238]
shr ecx, 4
mov edi, eax
and edi, 0xf
xor ecx, edi
shr eax, 4
xor eax, dword [ecx*4 + 0x1d9238]
dec esi
inc edx
test esi, esi
jne 0x100062c8
pop edi
not eax
jmp 0x10006300
xor eax, eax
not eax
pop esi
ret
Function at 0x10006e69
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edx + 0x3c]
add eax, edx
movzx ecx, word [eax + 0x14]
sub esp, 0x14
push esi
movzx esi, word [eax + 6]
push edi
xor edi, edi
lea eax, [ecx + eax + 0x18]
xor ecx, ecx
cmp dword [eax + 4], edi
jne 0x10006e95
cmp dword [eax], 0x7373622e
jne 0x10006e95
mov ecx, eax
add eax, 0x28
dec esi
je 0x10006e9f
test ecx, ecx
je 0x10006e86
test ecx, ecx
je 0x10006ebd
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x10006eb9
mov ecx, dword [ecx + 0x10]
test ecx, ecx
je 0x10006eb9
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jmp 0x10006ec0
push 0xb
jmp 0x10006ebf
push 2
pop edi
mov eax, edi
test edi, edi
jne 0x10006f8c
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 4]
and esi, 0xfff
neg esi
sbb esi, esi
shr eax, 0xc
neg esi
add esi, eax
mov eax, dword [ebp - 0xc]
lea edi, [eax + edx]
mov eax, esi
push ebx
shl eax, 0xc
push eax
mov dword [ebp - 0x14], edi
call fcn.10003fdc
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x10006f88
push dword [ebp - 4]
push edi
push ebx
call fcn.10005dd2
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add esp, 0xc
test esi, esi
jbe 0x10006f62
mov eax, ebx
sub eax, edi
mov dword [ebp - 8], ebx
lea edi, [eax + ecx + 0x1db690]
mov ebx, 0x1000
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
lea eax, [eax + ecx - 0x7e47c82f]
push 1
push eax
mov eax, ebx
call fcn.10007ff0
mov ecx, dword [edi + 0xc]
sub ecx, dword [edi + 8]
add dword [ebp - 8], ebx
add ecx, dword [edi + 4]
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jb 0x10006f2e
mov ebx, dword [ebp - 0x10]
lea eax, [ecx - 0x43175ac3]
test eax, eax
jne 0x10006f7d
sub ebx, dword [ebp - 0x14]
mov dword [0x1da344], ecx
mov dword [0x1da348], ebx
jmp 0x10006f8b
push ebx
call fcn.10006dda
xor eax, eax
inc eax
jmp 0x10006f8b
push 8
pop eax
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x10011de0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push eax
push 0x1000fd80
push 0
mov dword [esi], 0
push 0
mov dword [edi], 0x80004005
call fcn.1004166b
add esp, 0x18
mov dword [esi], eax
test eax, eax
mov eax, esi
je 0x10011e10
mov dword [edi], 0
ret

Function at 0x100124a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
push ebx
push edi
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 8]
sub eax, dword [esi]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
sbb eax, dword [esi + 4]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x1c], eax
call fcn.10013790
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
add esp, 8
sub eax, dword [esi + 8]
sbb ecx, dword [esi + 0xc]
sub edi, dword [esi + 0x10]
mov dword [esp + 8], eax
sbb ebx, dword [esi + 0x14]
cmp dword [esi + 0x1c], 0
mov dword [esp + 0xc], ecx
je 0x1001251b
mov ecx, dword [esi + 0x1c]
mov edx, dword [esp + 0x10]
add dword [ecx], edx
mov edx, dword [esp + 0x14]
adc dword [ecx + 4], edx
mov ecx, dword [esp + 0xc]
cmp dword [esi + 0x20], 0
je 0x10012529
mov edx, dword [esi + 0x20]
add dword [edx], eax
adc dword [edx + 4], ecx
cmp dword [esi + 0x24], 0
je 0x10012537
mov eax, dword [esi + 0x24]
add dword [eax], edi
adc dword [eax + 4], ebx
cmp dword [esi + 0x18], 0
je 0x100125b5
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
add edi, dword [esp + 8]
mov ecx, dword [esp + 0x40]
adc ebx, dword [esp + 0xc]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
fild qword [esp + 0x20]
fdiv qword [0x1009f770]
fmul qword [0x1009f790]
fild qword [esp + 0x10]
fild qword [0x100af160]
fdivp st(1)
fild dword [esp + 0x40]
test ecx, ecx
jns 0x100125ac
fadd qword [0x1009f738]
fmulp st(1)
mov edx, dword [esi + 0x18]
fdivp st(1)
fstp qword [edx]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
test ebx, ebx
je 0x100136a2
cmp dword [ebp + 8], 0
je 0x100136a2
test eax, eax
je 0x100136a2
movzx ecx, word [eax + 0x26]
movzx edx, word [eax + 0x28]
push esi
movzx esi, word [eax + 0x2c]
push edi
movzx edi, word [eax + 0x2a]
movzx eax, word [eax + 0x2e]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100135eb
mov esi, edi
imul esi, dword [ebp + 0xc]
add esi, edx
add esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push ebx
push eax
push 1
push esi
call fcn.10041862
push ebx
call fcn.1004154a
add esi, dword [ebp + 0xc]
add esp, 0x14
dec dword [ebp - 0xc]
jne 0x100135c4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
imul edi, esi
imul ecx, esi
shr edi, 1
add edi, edx
add ecx, edi
add dword [ebp + 8], ecx
mov edi, eax
shr edi, 1
mov dword [ebp - 0x14], edi
je 0x10013645
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
shr eax, 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], edi
test eax, eax
je 0x1001363d
mov esi, dword [ebp - 4]
mov edi, eax
push ebx
push 1
push 1
push esi
call fcn.10041862
add esp, 0x10
add esi, 2
dec edi
jne 0x10013620
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0x14]
add dword [ebp - 4], esi
dec dword [ebp - 0x10]
jne 0x10013617
push ebx
call fcn.1004154a
mov ecx, dword [ebp + 8]
add esp, 4
inc ecx
test edi, edi
je 0x10013697
mov eax, dword [ebp - 8]
shr eax, 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edi
test eax, eax
je 0x1001368a
mov esi, ecx
mov edi, eax
lea esp, [esp]
push ebx
push 1
push 1
push esi
call fcn.10041862
add esp, 0x10
add esi, 2
dec edi
jne 0x10013670
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
add ecx, esi
dec dword [ebp - 8]
mov dword [ebp - 0x10], ecx
jne 0x10013664
push ebx
call fcn.1004154a
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100139f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 0x208
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10013a27
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push esi
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
pop esi
jne 0x10013a1d
cmp dword [ebp - 8], 1
mov eax, 0x80004005
jne 0x10013a61
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret