joyce8/EMBER2024-capa huggingface dataset:
Function at 0x549280
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x57df90
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x549427
mov ecx, dword [0x5edc88]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x54937c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00547fa0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.0056dc09
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0056db1c
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5ea120
call fcn.0056db8a
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.00548360
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.0056dc09
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.0056db1c
lea ecx, [esp + 0xc]
call fcn.0056dfe4
mov ecx, dword [esp + 0xc]
push 0x5eab5c
push ecx
call fcn.0055c514
add esp, 8
test eax, eax
je 0x5493a4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x5492dd
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.0056db1c
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0056db1c
jmp 0x54942b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00549020
test eax, eax
push 0
je 0x54940f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.005476c0
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x5493f5
cmp eax, 0x64
jg 0x5493e3
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x549380
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x549380
cmp eax, 0x64
jge 0x54937c
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x549380
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.005476c0
mov esi, eax
jmp 0x549380
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x549435
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x553790
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5caa90
push 0x55ea54
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.0055c4e0
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x553940
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x553981
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x5539ee
cmp dword [esp + 0x1c], 2
jne 0x5539ee
cmp dword [esp + 0x10], 5
jne 0x5539ee
cmp dword [esp + 0x14], 1
jne 0x5539ee
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5539d8
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x5539c9
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x5539d1
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x5539ee
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret
Function at 0x554580
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2820
call fcn.0055cdc0
mov eax, dword [esp + 0x2824]
push ebx
push esi
push edi
push eax
lea ecx, [esp + 0x20]
push str..PhysicalDrive_d
push ecx
call fcn.0055e05f
add esp, 0xc
lea edx, [esp + 0x1c]
push 0
push 0
push 3
push 0
push 3
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x55472d
xor eax, eax
mov ecx, 0x9c4
mov dword [esp + 0x10], eax
lea edi, [esp + 0x11c]
mov dword [esp + 0x14], eax
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x124]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0x2710
push edx
lea eax, [esp + 0x20]
push 0xc
push eax
push 0x2d1400
push esi
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x55472d
mov ecx, dword [esp + 0x283c]
mov edx, dword [esp + 0x128]
push ecx
push 0
lea eax, [esp + 0x124]
push edx
push eax
call fcn.00554740
mov ecx, dword [esp + 0x2848]
mov edx, dword [esp + 0x13c]
push ecx
push 0
lea eax, [esp + 0x134]
push edx
push eax
call fcn.00554740
mov ecx, dword [esp + 0x2860]
mov edx, dword [esp + 0x150]
push ecx
push 0
lea eax, [esp + 0x144]
push edx
push eax
call fcn.00554740
mov ecx, dword [esp + 0x2864]
mov edx, dword [esp + 0x164]
push ecx
push 1
lea eax, [esp + 0x154]
push edx
push eax
call fcn.00554740
mov ecx, dword [esp + 0x2884]
add esp, 0x40
xor eax, eax
lea edi, [esp + 0x11c]
mov dword [ecx], 1
mov ecx, 0x9c4
lea edx, [esp + 0xc]
push eax
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x124]
push 0x2710
push eax
push 0
push 0
push 0x700a0
push esi
call ebx
test eax, eax
je 0x55472d
mov edi, dword [esp + 0x124]
mov edx, dword [esp + 0x2848]
mov eax, dword [esp + 0x284c]
xor ecx, ecx
cmp edi, 0xc
push esi
setne cl
inc ecx
mov dword [edx], ecx
mov ecx, dword [esp + 0x138]
mov edx, dword [esp + 0x13c]
mov dword [eax], ecx
mov dword [eax + 4], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2820
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2820
ret
Function at 0x556a00
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x5ebf3c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x556a13
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x556a54
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x5ebfe4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x556a86
mov bl, byte [esp + ecx + 0x4c]
jmp 0x556a8a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x556a7b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x556aa8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x556aac
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x556a9d
xor ecx, ecx
mov eax, 0x5ebf4c
xor ebx, ebx
mov bl, byte [ecx + 0x5ebff4]
cmp byte [esp + ebx + 0x14], 0
je 0x556ad7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x5ec00c]
cmp byte [esp + ebx + 0x14], 0
je 0x556aee
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x556abe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x556a47
lea edx, [esp + 0x84]
push edx
call fcn.00556b30
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x558e70
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x558eb9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x559330
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57e420
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00558ee0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00558f60
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00558f60
lea ecx, [esi + 0xc]
call fcn.0056daa7
lea ecx, [esi + 0x10]
call fcn.0056daa7
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0055a4f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0055a4f0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0055a4f0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0056db1c
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0056db1c
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x55a6e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x55a746
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x55a746
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x55a727
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x56ff2a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x56ff62
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0056df77
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0056df4f
jmp 0x56ff6e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x571621
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x571663
call fcn.005774a8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x571663
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x57165a
xor eax, eax
jmp 0x57166b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00571671
pop edi
pop esi
pop ebx
ret 4

Function at 0x5779d8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x577a06
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x577a24
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0057793e
jmp 0x577a24
mov eax, dword [esi + 0x14]
test eax, eax
je 0x577a24
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0057793e
test edi, edi
mov eax, edi
jne 0x577a0e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x14c
mov edx, dword [esi + 0x3c]
lea eax, [esi + 0x88]
add eax, edx
lea ecx, [esi + 0x78]
add ecx, edx
cmp word [edx + esi + 4], di
cmovne ecx, eax
mov eax, dword [ecx]
test eax, eax
je 0x100015b5
cmp dword [ebp + 0x10], 0
lea ecx, [eax + esi]
mov dword [ebp - 8], ecx
ja 0x100014fc
mov eax, dword [ebp + 0xc]
jb 0x100014cb
cmp eax, 0xffff
ja 0x100014fc
movzx edx, ax
xor eax, eax
sub edx, dword [ecx + 0x10]
sbb eax, eax
test eax, eax
ja 0x100015b5
jb 0x100014e8
cmp edx, dword [ecx + 0x14]
jae 0x100015b5
mov eax, dword [ecx + 0x1c]
pop edi
lea eax, [eax + edx*4]
mov eax, dword [eax + esi]
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, esi
mov dword [ebp - 0x14], eax
add edx, esi
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
cmp dword [ecx + 0x18], eax
jbe 0x100015b5
nop word [eax + eax]
mov ebx, dword [edx + eax*4]
add ebx, esi
mov esi, ebx
mov dword [ebp - 0xc], ebx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001530
sub esi, ecx
call fcn.10001b70
push 0xeeeeeeee
push 0x7fed7fed
mov edi, eax
push edi
push 1
push esi
push ebx
call fcn.10001aa0
push 0xeeeeeeee
push 0x7fed7fed
push edi
push 2
push esi
push dword [ebp - 0xc]
mov ebx, eax
call fcn.10001aa0
xor ecx, ecx
or ecx, ebx
cmp dword [ebp + 0xc], eax
jne 0x1000157a
cmp dword [ebp + 0x10], ecx
je 0x10001591
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ecx + 0x18]
jae 0x100015b5
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
jmp 0x10001520
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
movzx ecx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
add eax, ecx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10001aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10001afa
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
nop word [eax + eax]
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0x14]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10001ac0
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
Function at 0x10005880
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
mov ebx, ecx
sub esp, 0x2c
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
mov eax, dword [eax + 0x60]
mov dword [esp], eax
call fcn.10024060
mov eax, dword [edi + 0x1c]
movzx edx, si
lea ecx, [edx + edx*2]
lea esi, [eax + ecx*8]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x100059d0
shl edx, 6
add eax, edx
mov edx, dword [eax]
mov dword [ebx], edx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov edx, dword [eax + 8]
mov dword [ebx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0xc], edx
mov edx, dword [eax + 0x10]
mov dword [ebx + 0x10], edx
mov edx, dword [eax + 0x14]
mov dword [ebx + 0x14], edx
mov edx, dword [eax + 0x18]
mov dword [ebx + 0x18], edx
mov edx, dword [eax + 0x1c]
mov dword [ebx + 0x1c], edx
mov edx, dword [eax + 0x20]
mov dword [ebx + 0x20], edx
mov edx, dword [eax + 0x24]
mov dword [ebx + 0x24], edx
mov edx, dword [eax + 0x28]
mov dword [ebx + 0x28], edx
mov edx, dword [eax + 0x2c]
mov dword [ebx + 0x2c], edx
mov edx, dword [eax + 0x30]
mov dword [ebx + 0x30], edx
mov edx, dword [eax + 0x34]
mov dword [ebx + 0x34], edx
mov edx, dword [eax + 0x38]
mov dword [ebx + 0x38], edx
mov eax, dword [eax + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 4]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x44], eax
movzx edx, byte [esi + 4]
mov ecx, edx
and ecx, 3
jne 0x10005990
movzx ecx, byte [esi + 7]
mov edx, 8
shr cl, 7
shl edx, cl
mov ecx, edx
xor edx, edx
sar ecx, 3
div ecx
xor edx, edx
mov dword [ebx + 0x44], eax
movzx ecx, byte [esi + 4]
shr cl, 2
and ecx, 7
div ecx
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov esi, dword [ebp - 0x1c]
mov dword [ebx + 0x48], eax
mov dword [ebx + 0x4c], edx
movzx eax, word [esi + 0x30]
mov dword [ebx + 0x50], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x60]
mov dword [esp], eax
call fcn.10024080
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp cl, 2
jne 0x1000595b
movzx ecx, byte [esi + 6]
shr dl, 2
and edx, 7
shr cl, 7
movzx edi, cl
movzx ecx, byte [esi + 7]
and ecx, 0x7f
add ecx, ecx
or ecx, edi
lea edi, [ecx + 0x16]
add ecx, 0x10
imul edi, edx
xor edx, edx
div edi
imul eax, ecx
add eax, eax
mov dword [ebx + 0x44], eax
jmp 0x1000595b
lea edi, [ebx + 4]
mov ecx, ebx
mov dword [ebx], 0
and edi, 0xfffffffc
mov dword [ebx + 0x3c], 0
sub ecx, edi
add ecx, 0x40
shr ecx, 2
rep stosd dword es:[edi], eax
jmp 0x10005919
Function at 0x10008140
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
test eax, eax
je 0x10008160
movzx edx, dx
pop ebp
jmp fcn.10005880
mov eax, 1
pop ebp
ret

Function at 0x10009a90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x10028044]
cmp eax, 0x9bf
ja 0x10009adb
mov ecx, dword [eax + section..bss]
lea edx, [eax + 4]
mov dword [0x10028044], edx
mov edx, ecx
mov ebx, dword [ebp - 4]
leave
shr edx, 0xb
xor edx, ecx
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
cmp eax, 0x9c0
jne 0x10009bbe
mov ecx, dword [section..bss]
xor eax, eax
nop
and ecx, 0x80000000
mov ebx, ecx
mov ecx, dword [eax*4 + 0x10042004]
mov edx, ecx
and edx, 0x7fffffff
or edx, ebx
mov ebx, edx
and edx, 1
imul edx, edx, 0x9908b0df
shr ebx, 1
xor ebx, dword [eax*4 + 0x10042634]
xor edx, ebx
mov dword [eax*4 + section..bss], edx
add eax, 1
cmp eax, 0xe3
jne 0x10009af0
mov ecx, dword [0x1004238c]
lea esi, [esi]
lea esi, [esi]
and ecx, 0x80000000
mov ebx, ecx
mov ecx, dword [eax*4 + 0x10042004]
mov edx, ecx
and edx, 0x7fffffff
or edx, ebx
mov ebx, edx
and edx, 1
imul edx, edx, 0x9908b0df
shr ebx, 1
xor ebx, dword [eax*4 + 0x10041c74]
xor edx, ebx
mov dword [eax*4 + section..bss], edx
add eax, 1
cmp eax, 0x26f
jne 0x10009b40
mov ecx, dword [section..bss]
mov eax, dword [0x100429bc]
mov edx, ecx
and eax, 0x80000000
and edx, 0x7fffffff
or eax, edx
mov edx, eax
and eax, 1
imul eax, eax, 0x9908b0df
shr edx, 1
xor edx, dword [0x10042630]
xor eax, edx
mov edx, 4
mov dword [0x100429bc], eax
jmp 0x10009aa9
xor eax, eax
xor edx, edx
lea esi, [esi]
imul eax, eax, 0x7ff8a3ed
add eax, 0x2aa01d31
mov ecx, eax
rol ecx, 0x10
xor ecx, 0x31415926
mov dword [edx*4 + section..bss], ecx
add edx, 1
cmp edx, 0x270
jne 0x10009bc8
jmp 0x10009ae6
Function at 0x10011050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x54], edx
mov dword [eax + 0x40], ecx
movzx ecx, word [0x1002b4a8]
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ebp + 0x14]
mov dword [eax], 0x10010bf0
mov dword [eax + 4], fcn.10010e90
mov dword [eax + 8], 0x10010dc0
mov dword [eax + 0xc], 0x10010c10
mov dword [eax + 0x10], 0x10010ed0
mov dword [eax + 0x14], 0x10010cb0
mov dword [eax + 0x18], fcn.10010cc0
mov dword [eax + 0x1c], 0x10010cd0
mov dword [eax + 0x20], 0x10010d90
mov dword [eax + 0x28], 0x10010da0
mov dword [eax + 0x2c], 0x10010ec0
mov dword [eax + 0x30], 0x10010e10
mov dword [eax + 0x34], 0x10010e70
mov dword [eax + 0x3c], 0x10010db0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov word [eax + 0x50], cx
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], edx
mov byte [eax + 0x68], 0
mov edx, dword [ebp + 0x18]
mov byte [eax + 0x69], dl
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0x6c], 1
mov dword [eax + 0x70], edx
mov edx, dword [ebp + 0x20]
mov dword [eax + 0x74], edx
mov edx, dword [ebp + 0x24]
mov dword [eax + 0x78], edx
pop ebp
ret
Function at 0x100240d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0xc
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x1002412c
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10022fa0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
leave
ret

Function at 0x10027270
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x22c
mov eax, dword [0x10042b00]
test eax, eax
je 0x10027328
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x100272b0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x220]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1002729c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1002735d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x10042b00], eax
sub esp, 8
test eax, eax
jne 0x1002728d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1002729e