joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004840
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
sub esi, esi
add esi, 0x30
mov edi, dword fs:[esi]
push ecx
mov esi, edi
add esi, 8
mov ecx, dword [esi]
mov ebx, dword [edi + 0xc]
or al, 0x8b
jnp 0x1004865
push eax
mov esi, dword [edi + 0x18]
test esi, esi
je 0x1004881
mov ebx, dword [edi + 0x30]
mov eax, dword [ebx]
and eax, 0xdf00df
fild word [eax]
mov ebx, dword [ebx + 0xc]
shl ebx, 8
add ebx, eax
shr ebx, 2
sub ebx, 0xc914cd2
test ebx, ebx
je 0x100488a
mov ebx, dword [edi]
mov edi, ebx
jmp 0x100485a
mov edi, dword [esi + 0x3c]
add edi, esi
mov ebx, dword [edi + 0x78]
add ebx, esi
push edx
mov eax, dword [ebx + 0x20]
add eax, esi
mov edx, dword [eax]
add edx, esi
mov edi, dword [edx + 0xb]
add edi, 0xff8b9c9b
cmp edi, 0
jne 0x10048ae
jmp 0x10048b9
add eax, 4
jmp 0x100489a
mov edi, dword [ebx + 0x20]
sub eax, edi
sub eax, esi
shr eax, 1
mov edi, dword [ebx + 0x24]
add edi, esi
add edi, eax
mov eax, dword [edi]
mov edi, dword [ebx + 0x1c]
shl eax, 0x10
shr eax, 0xe
add edi, esi
add edi, eax
mov eax, dword [edi]
lea edi, [0x28000]
push esi
add eax, esi
mov edx, 0x40
lea ebx, [0x5a000]
push ecx
add ebx, ecx
push edx
push esp
push edx
push edi
push ebx
call eax
pop edi
pop ecx
push eax
mov ebx, 0x11e00
mov esi, 0x7dc4
mov edi, 0x5a000
mov eax, 3
add edi, ecx
imul esi, eax
add esi, 0x7ac4
add esi, ecx
call fcn.01004940
mov esi, 0x31210
mov edi, 0x6e000
add esi, ecx
lea ebx, [0x2854]
add edi, ecx
call fcn.01004940
jmp 0x1004965
lea edi, [0x5a000]
mov ebx, 0x1c0
mov esi, 0x10000000
add edi, ecx
mov eax, 9
imul ebx, eax
add ebx, 0x40
sub edi, ebx
mov ebx, edi
sub ebx, esi
mov esi, 0x34010
mov eax, 0x35988
add esi, ecx
add eax, ecx
Function at 0x10053ad
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x1007670], edi
jne 0x10054c9
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x1005414
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov eax, dword [ebp - 0x110]
dec eax
mov dword [0x1007670], edi
pop esi
je 0x100549c
dec eax
jne 0x10054c9
cmp dword [ebp - 0x11c], 5
jne 0x1005489
mov eax, dword [ebp - 0x118]
sub eax, edi
je 0x100547d
dec eax
je 0x100546a
dec eax
je 0x1005450
mov dword [0x1007670], 0x14
jmp 0x10054c9
cmp word [ebp - 0xc], 1
jb 0x1005461
mov dword [0x1007670], 0x10
or dword [0x1007670], 4
jmp 0x10054c9
cmp word [ebp - 0xc], 2
jb 0x1005461
mov dword [0x1007670], 8
jmp 0x1005461
mov dword [0x1007670], 4
jmp 0x10054c9
cmp dword [ebp - 0x11c], 4
ja 0x10054db
mov dword [0x1007670], 2
cmp dword [ebp - 0x11c], 4
jne 0x10054c9
cmp dword [ebp - 0x118], edi
je 0x10054bf
cmp dword [ebp - 0x118], 0xa
je 0x10054bf
cmp dword [ebp - 0x118], 0x5a
jne 0x10054c9
mov dword [0x1007670], 1
mov ecx, dword [ebp - 4]
mov eax, dword [0x1007670]
xor ecx, ebp
pop edi
call fcn.01004855
leave
ret
mov dword [0x1007670], 0x20
jmp 0x10054c9

Function at 0x10054ec
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005540
push 3
lea eax, [ebp - 0x44]
push 0x10016f8
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.01004855
leave
ret

Function at 0x1005555
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [0x1007674]
jne 0x10055f0
push esi
lea eax, [ebp - 0x10]
push eax
push 1
xor esi, esi
push esi
push 0x1001628
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10055ef
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x10016e0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x10055ef
push 3
push dword [esi*8 + 0x1001478]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x10055e1
inc esi
cmp esi, 0x1c
jb 0x10055c0
jmp 0x10055ef
mov ax, word [esi*8 + 0x100147c]
mov word [0x1007674], ax
pop esi
mov ecx, dword [ebp - 4]
mov ax, word [0x1007674]
xor ecx, ebp
call fcn.01004855
leave
ret
Function at 0x409a62
Capabilities:
Encode data using xor

Disassembly:
loope 0x409a6f
jo 0x409a61
mov al, byte [0xb7cee080]
jmp 0xf87d6a72
movsd dword es:[edi], dword [esi]
or byte [ebx - 4], al
inc ebx
cld
or al, 0xa
clc
or bh, al
and cl, byte [eax + 0x4d]
push 0xffffffffffffffb8
movsb byte es:[edi], byte [esi]
jge 0x409a65
test byte [esi + 0x40e071e1], al
jo 0x409a60
outsd dx, dword [esi]
pushfd
sar dword [eax - 0x30f860d0], 0x1a
inc esp
cdq
cmp al, 0xd1
aaa
adc edx, esp
jno 0x409a31
invalid

Function at 0x40bf41
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
popfd
push eax
fstp qword [eax]
invalid
loop 0x40bf38
xchg ebx, eax
fmulp st(0)
iretd
je 0x40beb8
xor byte [edx - 0xa287b9b], ah
mov ecx, 0xb5794804
push ecx
test bl, bl
lodsd eax, dword [esi]
cmp dword [ecx + 0x48d92a4], ecx
fcom qword [esi - 0x7b]
test byte [eax - 0x7d], cl
ret 0xfa14
popfd
imul byte [ebx - 9]
mov ch, 0x6e
add ebx, dword ds:[ebp + 4]
add al, 0x2e
jnp 0x40bf14
cmp dword [ecx], esi
in al, dx
dec ebp
push ecx
mov eax, 0x44f872f7
sbb al, byte [edi + 0x77]
mov esp, 0xefafe06d
adc edx, ebp
and al, 0xb9
xor byte gs:[edi + 0x666670b9], dh
bound ebx, qword [ecx - 0x2d8783eb]
sub dl, al
lcall 0x398d, 0xabf478c6
jb 0x40bf39
pop es
cmp bl, 0x5c
invalid

Function at 0x40fa4b
Capabilities:
Encode data using base64

Disassembly:
pop esi
cmp eax, 0x47048abe
push ebp
or byte [esi - 0x5d], cl
fild dword [ecx + ecx*2 + 1]
out dx, al
xchg ebp, eax
mov bh, 0x4d
mov al, 5
popal
leave
invalid

Function at 0x40fafe
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
insb byte es:[edi], dx
cwde
dec edi
sbb eax, 0x79a72dc0
cli
dec esi
popfd
dec ebx
cmp dl, ch
mov edx, 0x539e9902
cdq
pop ds
and al, 0x8b
in eax, dx
mov ecx, 0xcbe4a415
sbb eax, 0x20619353
test byte [edx], al
xchg ebp, eax
adc al, 0x93
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
das
inc ecx
xor byte [ecx - 0xf7a3bbb], 0xa7
wait
jns 0x40fafd
pop ebx
insd dword es:[edi], dx
xlatb
sub ebx, dword [esi]
push 0xffffffffffffff80
ja 0x40fbb9
push edi
ja 0x40fb8f
aas
xchg esp, eax
lahf
les edx, [eax - 0x333ab6d9]
mov cl, 0x4a
xchg dword [edi + ebx*8 + 0x2098a89a], edx
jmp 0xe052c05d
fdivr qword [eax]
iretd
invalid
Function at 0x418c50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x4c4f14
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x418c6d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDEA92A799_267E_4DF5_A6ED_6A7E0684BB8AVersionIndependentProgID
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0x4c621c], eax
jne 0x418cea
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x4c4f14
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0x4c621c], eax
jne 0x418cd2
cmp dword [esp + 8], ebx
je 0x418cd4
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x418cea
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c621c]
test ecx, ecx
jne 0x418d0d
test eax, eax
jle 0x418d08
and eax, 0xffff
or eax, 0x80070000
mov dword [0x4c621c], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret

Function at 0x423ce0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
jnp 0x423ceb
or al, 0xb1
and dword [edi - 0x6083f6d], esi
fidivr word [eax - 0x41]
cld
cmpsd dword [esi], dword es:[edi]
or al, 0xa7
fmul qword [esi + ebx*8]
daa
pop esp
pop ds
loopne 0x423c7b
cwde
insb byte es:[edi], dx
cld
cmpsd dword [esi], dword es:[edi]
pushfd
cmpsd dword [esi], dword es:[edi]
pushal
push 0x1b
xor ecx, dword [edx + edi + 0x68343a19]
stosb byte es:[edi], al
wait
jge 0x423d12
mov dl, byte [ebx]
jle 0x423cf5
adc eax, 0xc027e034
out 0xe0, eax
sbb eax, 0xc66cdb2
pushfd
int 0x66
or al, 0x9c
loop 0x423c9a
ror byte [edi], cl
cmp eax, 0xfc070cfa
xchg byte [eax], bh
push es
jge 0x423ce5
and byte [edi + 0x26fc1a46], ah
loopne 0x423cb8
loopne 0x423cfc
fstp qword [edx + 0x1c]
insd dword es:[edi], dx
and byte [esi + 0x5d], dh
xchg dword [eax - 0x46], esi
fist word [esi + 0x25dde63d]
xchg esi, eax
invalid
out 0xdd, al
invalid
xchg esi, eax
cmp eax, 0xc525dde6
jbe 0x423c90
lds edi, [esi]
jbe 0x423c90
mov esp, 0xb7691116
adc dword [ecx - 0x49], ebp
cmpsd dword [esi], dword es:[edi]
fsubp st(2)
lodsb al, byte [esi]
int3
call 0xb28f6d14
dec ebp
push edx
cmp byte [ebx - 0x42e92238], dh
wait
cmp eax, 0xdd27fd8c
mov edx, 0xb4321a42
outsb dx, byte [esi]
push ebx
int1
int1
sar dword [edx + edi*2 - 0x75], 0x70
xor byte [esi + 0x38], dh
jl 0x423d8e
mov esi, dword [eax + 0x30]
jbe 0x423d51
into
sub eax, 0xbecf613d
xchg ebx, eax
jecxz 0x423d5f
cmp eax, 0x6467eee4
mov cl, 0x4d
and ch, byte [ebp + 0x30]
dec ebp
and bh, byte [ebp + 0x52b4311d]
out dx, eax
loopne 0x423ce7
int3
outsd dx, dword [esi]
push ecx
xchg dword [ebp - 0x63275e13], ebx
mov esp, 0x7cf266f1
and byte [ebx + 0x2db37040], ch
adc ebx, dword [eax - 0x7b]
mov cl, 0xef
pop ebx
mov bh, 0xb1
not dword [eax - 0x7d2d24ac]
inc ecx
sub bl, cl
cmp al, 0x80
mov ch, 0x3d
jmp 0xd32dc968
mov ebx, 0x99c7ef1a
invalid
Function at 0x43c001
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
mov al, byte [0x6ad3de6f]
invalid
jmp 0x43c033
test byte [ebp + 0x65b754a], ah
movsd dword es:[edi], dword [esi]
dec edx
jne 0x43c060
push es
outsb dx, byte [esi]
jo 0x43c021
jnp 0x43bf9a
xor byte [edx + 0x1d], 0x37
insb byte es:[edi], dx
add dword [edx + 0x79a10550], ebp
imul byte [ebx]
add byte [esi + 0x1f4064c6], cl
jno 0x43bfae
int 0xa8
fisub dword [eax - 0x4e9d1b77]
retf
and byte [ebp - 0x6e], cl
retf 0x8ae6
loopne 0x43c000
cmpsb byte [esi], byte es:[edi]
xor ah, dl
dec ebp
loopne 0x43bffc
sbb al, 0x5d
imul edi, dword [ebx + 0x2cae1764], 0xa6e0a8ee
rol dword [edi - 0x15e9290f], cl
sub byte [ebx + 0x2e], al
wait
xor ch, dl
xor byte [edi + 0x52], dl
mov dl, 0xf9
cli
dec ebp
jl 0x43c021
int 0xc3
outsd dx, dword [esi]
invalid

Function at 0x448d20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.video_storage_ext_530A6E9C_AA5B_4b1c_A846_BF817B85D25C
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x448d64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x448d5a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 0x68
call fcn.00418c50
jmp 0x448d67
mov esi, dword [ebp - 4]
call fcn.00418c50
jmp 0x448d67
mov esi, dword [ebp - 4]
push edi
mov ecx, 0x41
xor eax, eax
mov edi, 0x4c4b64
rep stosd dword es:[edi], eax
jmp 0x566dda

Function at 0x4523d2
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
sti
test al, 0x71
shr ecx, cl
xor dword [eax + 0x22], ebx
cld
sub dword [edi - 0x71d45583], 0xffffffe3
jl fcn.004523d2
cmp eax, 0xa0b55e4e
or dword [esi], eax
or bh, 0xf9
std
adc edx, dword [eax]
xchg ecx, eax
jecxz 0x452464
or eax, 0xd62d6dbb
out dx, eax
mov ebp, 0xef25b0d6
imul ebx, dword [0xd2a03053], 0x2c
inc eax
pop eax
pop ds
pop ebx
ret
cmp al, 0x6a
hlt

Function at 0x46a0b2
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xc9
xchg ecx, eax
and eax, 0xed6b4c89
invalid

Function at 0x46f9d8
Capabilities:
Encode data using xor

Disassembly:
jno 0x46fa31
xor eax, 0x42fc3584
sal dword [ebp - 0x1c], cl
aam 0xb1
enter 0x33bd, 0x23
cmp bl, bl
or esp, dword [edi - 0x5c8aebd5]
push ss
test eax, 0xdbfc7867
and dword [edi + ecx*2], ebp
fcomp dword [esi - 0x7a]
jb 0x46f9c0
daa
mov dword [0x7be6d622], eax
push 0xffffffffffffffc7
inc esi
cmp byte [edx - 0x1a], dh
add dword [ecx], esp
xchg al, bh
lodsd eax, dword [esi]
and ebx, dword [edx + eax*8 - 0x764d8a6]
movsb byte es:[edi], byte [esi]
sub al, 0x78
push 0x4e
in eax, dx
and edi, edi
or dh, ch
ljmp 0xf071
and esp, dword [ecx]
in al, 0x51
pop edi
push esi
add eax, 0x944c660b
xor cl, byte [esi - 0x2fe8a6d7]
inc ecx
xchg ecx, ebx
sar byte [edx + 0x75], 0xcf
add dword [edi - 0x5e], 0x6f78aa36
ficomp dword [eax - 0xf281192]
push ebx
xor eax, 0x2f25788
pop ss
cli
invalid
Function at 0x4986ff
Capabilities:
Encode data using xor

Disassembly:
std
mov edx, 0xca59388e
cmc
jae 0x498765
dec edx
dec edx
adc dl, byte [0x73739c91]
pop ss
xor dword [ebx + 0x53], edx
and dword [esi - 0x14b48da6], esi
xchg ebx, eax
sub esp, esp
or bl, dh
call [eax - 0x77]
mov dl, 0x71
popfd
sub ebx, ebx
bound edi, qword [edi + 0x7924f73]
xor al, 0x46
and dh, byte [eax]
je 0x498703
sbb dword [ecx - 0x30a42ed], ebp
jp 0x4986fa
or dword [edi + eax], eax
push edi
jecxz 0x49876c
int1
aad 0xad
ret
add byte [eax + 0x5a18442b], ah
rol ecx, 3
inc edx
rol dword [ebx], 0x42
sbb esp, edi
jnp 0x4986f9
push esi
xor al, 0xfe
xchg esp, eax
mov cl, 4
lcall 0xa2e9, 0x2c2a9f69
loope 0x49875e
pop edx
inc edi
invalid

Function at 0x49ab42
Capabilities:
Encode data using xor

Disassembly:
jge 0x49ab1f
xor ah, byte [edx]
cmp bl, cl
xchg dword [eax + 0x2f], esi
aas
pop eax
iretd
or ebp, esp
mov bl, byte [esi]
xor dword [bp - 0xa17], esi
cmc
push ecx
and byte [edi - 6], ch
outsd dx, dword [esi]
test al, 0x6d
wait
mov fs, word [ebx + 0x70]
stosd dword es:[edi], eax
mov fs, word [edi]
and cl, byte [ecx - 0x1f010c01]
push cs
aaa
pop edx
mov dh, 0x6f
xchg edx, eax
js 0x49ab17
mov edi, esi
loop 0x49ab17
in al, dx
sbb edi, dword [0xafd30a3f]
outsd dx, dword [esi]
ja 0x49ab8a
mov ecx, 0x4637856f
stosb byte es:[edi], al
sub eax, dword [ebx + 0x4f]
jmp 0x49aafb
bnd ret

Function at 0x4a179e
Capabilities:
Encode data using xor

Disassembly:
sar dword [ebx], cl
and edx, dword [esi + ebp*4]
and eax, 0x6a18d2
in eax, dx
dec ebp
fld dword [ebx - 0x4cef24f0]
mov ah, 0xec
outsb dx, byte [esi]
mov al, dl
aas
clc
pop es
movsb byte es:[edi], byte [esi]
and bl, byte [ecx]
wait
pop ecx
and eax, 0x7785ba76
and eax, 0x8eb587b2
fldcw word [ecx + 0x1e]
dec edi
jg 0x4a1820
sbb eax, 0xc2e5460c
in al, dx
inc ebx
mov byte [0xbac817b6], al
sbb dword ss:[esi + 0x5fa691ee], ebx
pop edi
xor byte [esi - 0xcf12dbe], bh
jno 0x4a17df
inc dword [ebp + 0x6977f805]
or dword [eax + 0xc], ebp
out dx, eax
mov ah, 0xab
sar dword [eax - 0x19], 0x97
sub eax, 0xa59c3bec
push ss
sbb al, 0x30
push 0xffffffffffffffa0
xlatb
add byte [esi - 0x20], dl
shl byte [ecx - 0x1cb1de8e], cl
pop ebx
cmc
inc byte [edi + 0x2c94a3e3]
cmp byte [esp + ebx*4 + 0x7a15b652], bl
mul dword [esi - 0x1817a618]
out dx, al
out 0xee, eax
fnsave dword [eax + 0x1f]
int1
mov edi, 0xdbc4b9d7
dec eax
add esp, dword [ebx - 0x1cfa5ced]
fisttp dword [eax + 3]
mov dword [0xe305a313], eax
outsb dx, byte [esi]
sbb dword [edx - 0x78eac611], esp
clc
jne 0x4a17ca
sub eax, 0xffeb43f7
mov bh, 0x9a
je 0x4a182a
inc eax
adc cl, dh
lodsb al, byte [esi]
xchg ebp, eax
lea edx, [ebp - 0x50]
push edi
dec edi
xchg edi, eax
mov dword [0xf7024f66], eax
lds ecx, [ebp + 0x61]
mov byte [0x16ed3d1d], al
push eax
sbb edx, dword [edx + 0x45]
xchg esi, eax
cwde
mov dword [edi + 0x1f3df3f9], edx
inc dword [edi - 0x1c]
and al, byte [ecx + 0x35]
sbb al, 0x3d
inc edx
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x100080d6
pop dword [ebp - 8]
mov eax, 0x100080d6
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3d4da
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xffe7524e
add ecx, 0x1906e6
xor edx, edx
add edx, eax
mov edi, 0x595d241
add edi, 0xa6bb3bf
add edi, dword [ebp - 8]
mov esi, 0x55450a94
xor dword [ebp - 4], 0x79462773
mov ebx, dword [edi]
sub dword [ebp - 4], edx
add ebx, esi
sub dword [ebp - 4], esi
mov dword [edx], ebx
xor dword [ebp - 4], ebx
add edx, 0x78575647
add edx, 0x87a8a9bd
add edi, 4
loop 0x10008127
add eax, 0xf1e2ea5a
add eax, 0xe1e6d49
mov ebx, eax
add eax, 5
mov ecx, 0xec4e70b7
sub ecx, 0xdc4e70b7
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401098
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4010aa
mov eax, dword [0x40d09f]
shl eax, 2
mov dword [0x40d0a3], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
mov dword [0x40d0a7], edx
call fcn.00404214
pop edx
call fcn.00402854
call fcn.00404218
push 0
call fcn.0040a528
pop ecx
push 0x40d048
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40d0a7], eax
push 0
jmp fcn.00409990

Function at 0x4031d4
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
call fcn.004031a0
push str.LocalFastMM_PID________
push 0
push 4
call sub.KERNEL32.DLL_OpenFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x4031f4
xor eax, eax
pop esi
pop ebx
ret
push 0
push 0
push 0
push 4
push ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, dword [eax]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
pop esi
pop ebx
ret

Function at 0x403280
Capabilities:
Read file via mapping

Disassembly:
push ebx
call fcn.00402870
test eax, eax
jne 0x4032dd
cmp dword [0x412408], 0
jne 0x4032dd
call fcn.004031d4
test eax, eax
jne 0x4032d9
push str.LocalFastMM_PID________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
push 0
push 0
push 0
mov ebx, eax
push 2
push ebx
mov dword [0x412408], ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [eax], fcn.00403896
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
mov eax, 1
pop ebx
ret
xor eax, eax
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x4089b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x4089e5
jmp 0x408a1c
call fcn.00408968
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004045ec
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004045ec
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x408a88
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x40f0bc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x408b62
cmp dword [0x40f0b8], 0
jne 0x408b62
cmp dword [0x40f2a0], 0
je 0x408b1c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00408868
add esp, 8
mov ebx, eax
test eax, eax
jne 0x408b02
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00408868
add esp, 8
mov ebx, eax
test eax, eax
jne 0x408b02
lea ebx, [ebp - 0x84]
jmp 0x408b03
inc ebx
call fcn.00408a40
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x408b9d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x40f0c0
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004045ec
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x40f0c3
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x408b9d
cmp dword [0x40f0b8], 0
je 0x408b7c
cmp dword [0x40f0b8], 0xffffffff
je 0x408b9d
push esi
call dword [0x40f0b8]
pop ecx
mov eax, dword [0x40f0bc]
test eax, eax
je 0x408b9d
cmp dword [0x40f0bc], 0xffffffff
je 0x408b9d
cmp byte [eax], 0
je 0x408b9d
push esi
push eax
call fcn.004089b8
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret