joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401704
Capabilities:
Create thread

Disassembly:
call fcn.004017f9
pop eax
pop edx
pop dword [0x40e1b4]
pop ecx
test edx, edx
push eax
je 0x401703
push ebx
push esi
push edi
push ebp
mov ebx, 0x40c1a4
mov ebp, 0x40e1c8
xor eax, eax
mov dword [ebp - 0x10], eax
test cl, 1
mov esi, 0x401508
jne 0x40173f
test cl, 2
lea esi, [esi + 0xc]
jne 0x40173f
lea esi, [esi - 0x14]
test cl, 8
setne byte [ebp - 0x18]
and cl, 0x10
mov byte [ebp - 0x17], cl
mov edi, ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
cmp dword [ebp - 4], eax
jne 0x40175e
mov word [ebp - 4], 0x8000
push eax
push eax
push eax
push eax
push eax
push eax
push 0x4014f0
push 0xffffffffffffffff
push ebx
call dword [sym.imp.WINMM.DLL_waveOutOpen]
call dword [sym.imp.KERNEL32.dll_HeapCreate]
test eax, eax
mov dword [ebx - 8], eax
je 0x40178d
mov dword [ebp - 0xc], esi
call fcn.00401f8c
xchg edi, eax
call dword [ebp + 8]
test edi, edi
je 0x4017fd
mov esi, 0x41e1d8
mov dword [esi + 4], 0x10000
or dword [esi + 0x14], 0xffffffff
push 0xc
mov dword [esi], 0x40e1d8
pop dword [esi + 0x10]
push 0x20
push esi
push dword [ebx]
call dword [sym.imp.WINMM.DLL_waveOutPrepareHeader]
xor edi, edi
call fcn.004018c2
cmp dword [ebx + 4], edi
jne 0x4017b7
mov dword [ebx + 8], edi
push 0x20
push esi
push dword [ebx]
call dword [sym.imp.WINMM.DLL_waveOutWrite]
test eax, eax
jne 0x4017fd
push ebp
push edi
push edi
push 0x40186c
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [ebx - 4], eax
je 0x4017fd
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xchg ebx, eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403cc5
Capabilities:
Hash data with md5

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x68
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x67452301
mov dword [ebp - 0x5c], 0xefcdab89
mov dword [ebp - 0x58], 0x98badcfe
mov dword [ebp - 0x54], 0x10325476
call fcn.00403c23
mov ecx, 8
lea eax, [ebp - 0x68]
lea edx, [ebp - 0x50]
call fcn.00403520
mov eax, dword [ebp - 0x50]
mov ecx, 0x38
shr eax, 3
and eax, 0x3f
cmp eax, 0x37
jbe 0x403d25
mov ecx, 0x78
sub ecx, eax
mov edx, 0x408cc0
lea eax, [ebp - 0x60]
call fcn.00403c23
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x60]
mov ecx, 8
call fcn.00403c23
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x60]
mov ecx, 0x10
call fcn.00403520
leave
ret
Function at 0x403d58
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push ebx
xor ebx, ebx
mov eax, dword [eax]
mov edx, dword [esi]
xor eax, dword [ecx + ebx*4]
mov esi, edx
inc ebx
mov edx, eax
shr eax, 0x10
movzx edi, al
mov eax, edx
shr eax, 0x18
mov eax, dword [ecx + eax*4 + 0x48]
add eax, dword [ecx + edi*4 + 0x448]
movzx edi, dh
xor eax, dword [ecx + edi*4 + 0x848]
movzx edi, dl
add eax, dword [ecx + edi*4 + 0xc48]
xor eax, esi
cmp ebx, 0x10
jne 0x403d6d
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, dword [ecx + 0x40]
xor edx, dword [ecx + 0x44]
mov dword [ebx], edx
mov dword [esi], eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403dbb
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ecx, 0x400
xor edx, edx
mov ebp, esp
push edi
push esi
mov esi, 0x409100
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x48]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov esi, 4
xor eax, eax
mov edi, dword [ebp + 0xc]
shl eax, 8
movzx edi, byte [edi + edx]
inc edx
or eax, edi
cmp edx, dword [ebp + 0x10]
jl 0x403df5
xor edx, edx
dec esi
jne 0x403de1
xor eax, dword [ecx*4 + 0x40a100]
mov dword [ebx + ecx*4], eax
inc ecx
cmp ecx, 0x12
jne 0x403dda
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
lea edx, [ebp - 0x20]
lea edi, [ebp - 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], edi
mov dword [ebp - 0x2c], eax
call fcn.00403d58
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x1c]
mov dword [ebx + eax*4 + 4], edx
add eax, 2
cmp eax, 0x12
jne 0x403e12
mov eax, esi
xor edx, edx
lea ecx, [ebp - 0x20]
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], ebx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
call fcn.00403d58
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x30]
mov dword [ebx + eax + 0x48], ecx
mov ecx, dword [ebp - 0x1c]
add edx, 2
mov dword [ebx + eax + 0x4c], ecx
add eax, 8
cmp edx, 0x100
jne 0x403e47
add esi, 0x400
cmp esi, 0x1000
jne 0x403e43
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403ec9
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], 0x41e2cc
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
sub esp, 0x14
leave
ret
Function at 0x4045c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00405350
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00405350
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x404620
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x41e2fc]
test esi, esi
jle 0x404740
mov eax, dword [0x41e300]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x404654
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4046d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x404640
mov dword [esp], ebx
call fcn.00405030
mov edi, eax
test eax, eax
je 0x404767
mov eax, dword [0x41e300]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00405170
mov edx, dword [0x41e300]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x404747
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4046d0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4046e0
add dword [0x41e2fc], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x41e300]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4046d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004045c0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40465e
mov eax, dword [0x41e300]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004045c0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004045c0
lea esi, [esi]
nop
Function at 0x404c80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x41e318
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41e310]
sub esp, 4
test ebx, ebx
je 0x404cd5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x404cce
test esi, esi
je 0x404cce
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x404cb0
mov dword [esp], 0x41e318
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404f00
Capabilities:
Parse pe header
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_exit]
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__exit]
mov eax, dword [esp + 4]
xor edx, edx
cmp word [eax], 0x5a4d
jne 0x404f38
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
je 0x404f40
mov eax, edx
ret
xor edx, edx
cmp word [eax + 0x18], 0x10b
sete dl
mov eax, edx
ret

Function at 0x405030
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x405055
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x405060
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x405055
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4050a8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40509e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4050aa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x405090
xor eax, eax
pop ebx
pop esi
ret
Function at 0x1012769
Capabilities:
Get system firmware table

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
mov edi, 0x52534d42
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [eax], ebx
call esi
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x10127b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10127ad
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x10127d1
push dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10127d1
push dword [ebp - 0xc]
push eax
push ebx
push edi
call esi
cmp eax, ebx
jne 0x10127ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10127e5
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
jmp 0x1012808
cmp eax, dword [ebp - 0xc]
ja 0x1012801
cmp eax, 9
jb 0x1012801
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
add ecx, 8
cmp ecx, eax
jbe 0x101280d
mov dword [ebp - 4], 0x8000ffff
cmp dword [ebp - 4], ebx
jne 0x1012817
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x1012826
cmp dword [ebp - 8], ebx
je 0x1012826
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10005a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100179c8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1001f494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x10005bee
cmp byte [ebx + 0x49], 0
je 0x10005bee
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x10005be2
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x10005ab5
lea eax, [ebp - 0x2c]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x10005ad2
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
push edx
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x10005b09
dec eax
je 0x10005b0d
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x10005be9
call fcn.100017c0
xor al, al
jmp 0x10005bf0
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x10005b1d
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x10005b4a
cmp edi, 0x10
jae 0x10005b2c
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.10008a87
add esp, 0x10
cmp esi, eax
jne 0x10005bda
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x10005be6
test esi, esi
jne 0x10005ac6
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x10005c0b
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x10005c0b
cmp edi, esi
jae 0x10005bc3
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.10001bf0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x10005ac6
mov ecx, eax
cmp edi, 0x10
jae 0x10005b9f
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x10005bba
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x10005ac0
test esi, esi
jne 0x10005b95
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x10005bd2
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x10005ac0
lea ecx, [ebp - 0x2c]
call fcn.100017c0
xor al, al
jmp 0x10005bf0
lea ecx, [ebp - 0x2c]
call fcn.100017c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000791e
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.10006e97
int3
Function at 0x10006010
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001783b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1001f494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10007767
push 4
mov dword [ebp - 4], 0
call fcn.10007f1e
mov edi, eax
add esp, 4
test edi, edi
je 0x1000608c
call fcn.100072b8
mov dword [edi], eax
call fcn.10007077
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.10006fac
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10006082
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.10006fd4
jmp 0x1000608e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10006c70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push str.GetLogicalProcessorInformation
xor esi, esi
push str.kernel32
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
jne 0x10006cb0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
push ecx
push esi
call edi
test eax, eax
jne 0x10006cfe
call ebx
cmp eax, 0x7a
jne 0x10006cf2
test esi, esi
je 0x10006cd6
push esi
call fcn.100082e3
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.10009071
mov esi, eax
add esp, 4
test esi, esi
jne 0x10006cb7
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
cmp ecx, 0x18
jb 0x10006d21
mov eax, 0x18
jmp 0x10006d10
cmp dword [esi + eax - 0x14], 0
jne 0x10006d1a
inc dword [ebp - 8]
add eax, 0x18
cmp eax, ecx
jbe 0x10006d10
push esi
call fcn.100082e3
mov eax, dword [ebp - 8]
add esp, 4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000791e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001f494]
jne 0x10007928
repz ret
jmp fcn.1000bf6d
Function at 0x403bd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
test edi, edi
jne 0x403bf0
push str.Error:_Unable_to_register_MTU_notification__no_callback__n
call fcn.00403fb0
add esp, 4
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push esi
push 0x10
call fcn.004040cb
mov esi, eax
add esp, 4
test esi, esi
jne 0x403c17
push str.Error:_NOTIFICATION_CONTEXT_memory_allocation_failure._n
call fcn.00403fb0
add esp, 4
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov cl, byte [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x403c70
push 0
push 0
mov byte [esi + 4], cl
mov dword [esi + 8], edi
mov dword [esi + 0xc], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, 0xffffffff
jne 0x403c62
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_Unable_to_register_notification__error__d_n
call fcn.00403fb0
push esi
call fcn.00404091
add esp, 0xc
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x403fb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x411014]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x404]
push 0x400
push edx
call fcn.0040464c
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403ffe
mov esp, ebp
pop ebp
ret

Function at 0x403ffe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411014]
jne 0x404008
repz ret
jmp fcn.00404887

Function at 0x4065a1
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4065dc
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4065c3
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4065d4
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4065de
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4065b9
xor eax, eax
pop edi
pop esi
Function at 0x407f01
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 1
pop eax
test eax, eax
je 0x408607
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x4080dc
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
cmp dword [ebp - 0x6fc], 1
jne 0x40818d
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00406571
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.004064d2
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x4084d9
cmp dword [ebp - 0x6fc], 2
jne 0x40824a
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
mov byte [ebp - 0x798], 0xb3
mov byte [ebp - 0x797], 0x8c
mov byte [ebp - 0x796], 0x80
mov byte [ebp - 0x795], 0x81
mov byte [ebp - 0x794], 0x9d
mov byte [ebp - 0x793], 0x8a
mov byte [ebp - 0x792], 0x9c
mov byte [ebp - 0x791], 0xc1
mov byte [ebp - 0x790], 0x8b
mov byte [ebp - 0x78f], 0x83
mov byte [ebp - 0x78e], 0x83
mov byte [ebp - 0x78d], 0xef
call fcn.00406561
sal ecx, 1
pop eax
mov edi, 0x858d0c6a
invalid