joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59a3a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x59a571
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
mov eax, dword [0x5f6da4]
cmp dword [eax], 2
je 0x59a550
xor eax, eax
push ebp
push 0x59a546
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x444b98]
call fcn.00444c98
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x59a535
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.00444d38
xor ecx, ecx
mov edx, 0x59a58c
mov eax, dword [ebp - 0xc]
call fcn.00444d9c
test al, al
je 0x59a51f
mov edx, 0x59a5ac
mov eax, dword [ebp - 0xc]
call fcn.004451c8
test eax, eax
je 0x59a51f
push 0xff
lea eax, [ebp - 0x115]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edx, [ebp - 0x11c]
lea eax, [ebp - 0x115]
call fcn.0040b978
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x10]
mov edx, 0x59a5cc
call fcn.0044599c
mov eax, dword [ebp - 0x10]
call fcn.00405538
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x59a51f
xor eax, eax
push ebp
push 0x59a518
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x59a5dc
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov ebx, eax
mov eax, dword [0x5f68e8]
cmp byte [eax], 3
jne 0x59a4ce
mov eax, dword [0x5f67f0]
mov eax, dword [eax]
cmp byte [eax + 0x484], 0
je 0x59a4ce
push 0xffffffffffffffff
call sub.user32.dll_ShowCursor
mov eax, dword [0x5f67f0]
mov eax, dword [eax]
call fcn.00457540
push eax
call ebx
mov byte [ebp - 1], al
mov eax, dword [0x5f68e8]
cmp byte [eax], 3
jne 0x59a501
mov eax, dword [0x5f67f0]
mov eax, dword [eax]
cmp byte [eax + 0x484], 0
je 0x59a501
push 0
call sub.user32.dll_ShowCursor
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a51f
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a53c
mov eax, dword [ebp - 0xc]
call fcn.0040411c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59a578
lea eax, [ebp - 0x11c]
call fcn.0040504c
lea eax, [ebp - 0x10]
call fcn.0040504c
ret
Function at 0x5b73d8
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 1
push 0x5b7428
push 0x5b7428
mov eax, ebx
call fcn.00405538
push eax
push 0x5b742c
mov eax, dword [0x5f6ad0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x5b7412
xor eax, eax
call fcn.005deac0
pop ebx
ret
mov eax, dword [0x5f67f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x400]
call fcn.005deac0
pop ebx
ret

Function at 0x5db65c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040504c
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x5db6f0
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x5db6eb
xor eax, eax
push ebp
push 0x5db6e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x104
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10d]
push eax
push 0
push 0
push 0x5db72c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x5db6cd
mov edx, ebx
lea eax, [ebp - 0x10d]
call fcn.0040b978
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5db6eb
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5db730
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc0
mov edi, edx
mov esi, eax
xor ebx, ebx
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x3c
call fcn.004038a8
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x40
mov eax, dword [0x5f6ad0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 0xc], eax
mov eax, esi
call fcn.00405538
mov dword [esp + 0x14], eax
mov eax, edi
call fcn.00405538
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x20], eax
lea eax, [esp + 4]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x5db7cb
mov eax, dword [0x5f6ad0]
mov eax, dword [eax]
call fcn.004708d0
push esp
mov eax, dword [esp + 0x40]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
cmp dword [esp], 0x103
jne 0x5db7c4
mov eax, dword [0x5f6ad0]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
je 0x5db794
cmp dword [esp], 0
sete bl
mov eax, ebx
add esp, 0x40
pop edi
pop esi
pop ebx
ret
Function at 0x5dbd6c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x5dbe3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x5dbe54
call fcn.004050a0
xor ebx, ebx
lea eax, [ebp - 4]
xor edx, edx
mov dl, bl
add edx, 0x41
call fcn.00405234
lea eax, [ebp - 4]
mov edx, 0x5dbe64
call fcn.00405340
mov eax, dword [ebp - 4]
call fcn.00405538
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x5dbdd4
cmp eax, dword [esp]
pop edx
pop eax
jne 0x5dbe0e
lea eax, [ebp - 8]
xor edx, edx
mov dl, bl
add edx, 0x41
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.0040371c
mov edx, 0x5dbe68
lea eax, [ebp - 0xc]
mov cl, 2
call fcn.004036ec
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004052c0
jmp 0x5dbe0f
inc ebx
cmp bl, 0x19
ja 0x5dbe26
mov eax, dword [esi]
mov edx, 0x5dbe54
call fcn.00405484
je 0x5dbd9a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dbe43
lea eax, [ebp - 4]
call fcn.0040504c
ret

Function at 0x5dbe6c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0040504c
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x5dbf70
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5dbf70
xor eax, eax
push ebp
push 0x5dbf69
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x5dbf56
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5dbf4f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalSize
mov edx, 0x7fffffff
call fcn.00445730
mov esi, eax
mov eax, esi
call fcn.00402ca8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5dbf31
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, esi
call fcn.00402f58
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040b978
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dbf38
mov eax, dword [ebp - 4]
call fcn.00402cd8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dbf70
call sub.user32.dll_CloseClipboard
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5dc0a4
Capabilities:
Get session user name

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, eax
mov dword [esp], 0x104
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x5dc0d1
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040b978
jmp 0x5dc0e2
mov esi, dword [0x5f68a4]
mov esi, dword [esi]
mov edx, ebx
mov eax, 0xe4
call esi
add esp, 0x10c
pop esi
pop ebx
ret
Function at 0x5dc0ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5dc227
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040504c
mov eax, dword [0x5f6bac]
cmp dword [eax], 0
je 0x5dc170
lea eax, [ebp - 0x105]
push eax
push 0
push 0
push esi
push 0
mov eax, dword [0x5f6bac]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x5dc209
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.0040b978
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.0040fd00
jmp 0x5dc209
sub esi, 5
je 0x5dc185
sub esi, 0x1f
je 0x5dc193
dec esi
je 0x5dc1c8
dec esi
je 0x5dc1fd
jmp 0x5dc209
mov eax, ebx
mov edx, 0x5dc23c
call fcn.004050a0
jmp 0x5dc209
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
test eax, eax
jbe 0x5dc209
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x105]
call fcn.0040b978
mov eax, dword [ebp - 0x110]
mov edx, ebx
call fcn.0040fd00
jmp 0x5dc209
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
jbe 0x5dc209
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x105]
call fcn.0040b978
mov eax, dword [ebp - 0x114]
mov edx, ebx
call fcn.0040fd00
jmp 0x5dc209
mov eax, ebx
mov edx, 0x5dc258
call fcn.004050a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dc22e
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00405070
ret

Function at 0x5dc280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5dc2f7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jbe 0x5dc2d7
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.0040b978
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.0040fcec
jmp 0x5dc2de
mov eax, ebx
call fcn.0040504c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5dc2fe
lea eax, [ebp - 0x10c]
call fcn.0040504c
ret

Function at 0x5dc304
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffff4
push 0
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x5dc338
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x5dc331
mov eax, dword [esp]
jmp 0x5dc333
xor eax, eax
add esp, 0xc
ret
Function at 0x10004c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x10003d60
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10001260
mov edi, eax
call ebp
push ebx
push ebx
push ebx
push ebx
mov dword [0x1001f730], eax
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x28], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x10004d44
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10004c65
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov cl, 0x6c
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov al, 0x65
mov byte [esp + 0x21], cl
mov byte [esp + 0x26], cl
mov byte [esp + 0x27], cl
mov cl, 0x74
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0xe], al
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov byte [esp + 0x10], cl
mov byte [esp + 0x16], cl
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x20]
mov dl, 0x6e
xor ebx, ebx
push eax
push ecx
mov dword [esi], 0x10003d60
mov byte [esp + 0x28], 0x6b
mov byte [esp + 0x2a], 0x72
mov byte [esp + 0x2b], dl
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x34], bl
mov byte [esp + 0x18], 0x43
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], 0x76
mov byte [esp + 0x21], dl
mov byte [esp + 0x23], 0x41
mov byte [esp + 0x24], bl
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10001260
mov edi, eax
call ebp
push ebx
push ebx
push ebx
push ebx
mov dword [0x1001f730], eax
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 4], 0x3e8
mov byte [esi + 0x44], bl
mov byte [esi + 0x45], bl
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [esi + 4]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x28], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi], eax
mov eax, dword [esi + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x20
mov dword [edi - 0x20], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [edi + 8], eax
add esp, 0x10
add edi, 4
dec ebp
jne 0x10004d44
lea eax, [esi + 0x46]
xor ecx, ecx
mov edx, eax
pop edi
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov word [eax], 0x31
mov word [esi + 0x48], 1
mov dword [esi + 0x4a], 0x1f40
mov dword [esi + 0x4e], 0x659
mov word [esi + 0x52], 0x41
mov word [esi + 0x54], bx
mov word [esi + 0x56], 2
mov word [esi + 0x58], 0x140
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10004df0
Capabilities:
Link many functions at runtime
Terminate thread

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.MSVCRT.dll_puts]
push 0x100012e0
mov dword [esi], 0x10003d60
call edi
mov eax, dword [0x1001f730]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
push 0x100012d4
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov dword [esp + 0x18], eax
call ebp
push 0x100012e0
call edi
mov ecx, dword [0x1001f730]
add esp, 4
push 0x100012c8
push ecx
call ebx
push 0
mov dword [esp + 0x14], eax
call ebp
push 0x100012e0
call edi
mov edx, dword [0x1001f730]
add esp, 4
push 0x100012bc
push edx
call ebx
push 0
mov dword [esp + 0x20], eax
call ebp
push 0x100012e0
call edi
mov eax, dword [0x1001f730]
add esp, 4
push 0x100012a4
push eax
call ebx
push 0
mov dword [esp + 0x1c], eax
call ebp
push 0x100012e0
call edi
mov ecx, dword [0x1001f730]
add esp, 4
push 0x10001294
push ecx
call ebx
push 0
mov dword [esp + 0x24], eax
call ebp
push 0x100012e0
call edi
mov edx, dword [0x1001f730]
add esp, 4
push 0x10001284
push edx
call ebx
push 0
mov dword [esp + 0x28], eax
call ebp
push 0x100012e0
call edi
mov eax, dword [0x1001f730]
add esp, 4
push 0x1000126c
push eax
call ebx
push 0
mov ebx, eax
call ebp
mov al, byte [esi + 0x44]
test al, al
je 0x10004f32
mov ecx, dword [esi + 0x18]
push ecx
call dword [esp + 0x14]
mov edx, dword [esi + 0x18]
push edx
call dword [esp + 0x18]
lea edi, [esi + 0x30]
mov ebp, 2
mov eax, dword [edi]
mov ecx, dword [esi + 0x18]
push 0x20
push eax
push ecx
call dword [esp + 0x24]
add edi, 4
dec ebp
jne 0x10004f0b
mov edx, dword [esi + 0x18]
push edx
call dword [esp + 0x20]
mov eax, dword [esi + 0x2c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, byte [esi + 0x45]
test al, al
je 0x10004f62
mov ecx, dword [esi + 0x40]
push ecx
call dword [esp + 0x24]
lea edi, [esi + 0x30]
mov ebp, 2
mov edx, dword [edi]
mov eax, dword [esi + 0x40]
push 0x20
push edx
push eax
call ebx
add edi, 4
dec ebp
jne 0x10004f49
mov ecx, dword [esi + 0x40]
push ecx
call dword [esp + 0x28]
lea edi, [esi + 0x30]
mov ebx, 2
mov edx, dword [edi - 0x28]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [edi]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [edi - 0x20]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [edi + 8]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add edi, 4
dec ebx
jne 0x10004f6a
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x28]
push ecx
call edi
mov edx, dword [esi + 0x2c]
push edx
call edi
mov eax, dword [0x1001f730]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x100050c0
Capabilities:
Create thread
Link many functions at runtime
Resume thread

Disassembly:
mov eax, dword [0x1001f730]
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 0x10001330
mov edi, ecx
push eax
call esi
call eax
test eax, eax
jne 0x100050ec
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
mov ecx, dword [0x1001f730]
push 0x10001324
push ecx
call esi
lea edx, [esp + 0x10]
mov ebp, eax
push edx
push 4
push edi
push 0x100052b0
push 0
push 0
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x2c], eax
mov eax, dword [esp + 0x10]
push 0x20000
push 0
lea ecx, [edi + 0x46]
push eax
lea ebx, [edi + 0x18]
push ecx
push 0xffff
push ebx
call ebp
test eax, eax
je 0x10005147
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
mov edx, dword [0x1001f730]
push 0x10001310
push edx
call esi
mov dword [esp + 0x14], eax
lea esi, [edi + 0x30]
mov ebp, 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [esp + 0x20]
add esi, 4
dec ebp
jne 0x10005161
mov edx, dword [0x1001f730]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10001300
push edx
call esi
mov ecx, dword [edi + 0x1c]
push 0x20
mov edx, dword [edi + ecx*4 + 0x30]
mov ecx, dword [ebx]
push edx
push ecx
call eax
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x1001f730]
push 0x100012f4
push eax
call esi
mov ecx, dword [ebx]
push ecx
call eax
mov al, 1
mov byte [edi + 0x44], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10005aa0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1001da98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ecx, [esi + 4]
call fcn.10005650
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1d0], ebx
call fcn.10005650
lea ecx, [esi + 0x54]
mov byte [esp + 0x1d0], 1
call fcn.10005650
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1d0], 2
call fcn.10005650
mov cl, 0x6c
mov al, 0x65
mov byte [esp + 0x2d], cl
mov byte [esp + 0x32], cl
mov byte [esp + 0x33], cl
mov cl, 0x74
mov byte [esp + 0x29], al
mov byte [esp + 0x2c], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1d], al
mov byte [esp + 0x20], al
mov byte [esp + 0x1c], cl
mov byte [esp + 0x22], cl
lea eax, [esp + 0x18]
lea ecx, [esp + 0x28]
mov dl, 0x6e
push eax
push ecx
mov byte [esp + 0x1d8], 3
mov dword [esi], 0x10003d78
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], dl
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3c], bl
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x26], 0x45
mov byte [esp + 0x27], 0x76
mov byte [esp + 0x29], dl
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x38]
mov edi, eax
push edx
push 0x202
call dword [fcn.10003d4c]
mov ebp, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call ebp
add esp, 4
push ebx
push ebx
push 1
push ebx
call edi
push 0x30
mov dword [esi + 0xac], eax
call ebp
add esp, 4
mov byte [esi + 0xb5], bl
mov dword [esi + 0xa8], 0xffffffff
mov byte [esp + 0x10], 0x43
mov byte [esp + 0x11], 0x42
mov byte [esp + 0x12], 0x39
mov byte [esp + 0x13], 0x35
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0xb0]
mov al, 0x51
pop edi
mov dword [ecx], edx
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x1c4]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c4
ret
Function at 0x100065d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, 9
mov edx, 5
mov word [esp], ax
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
mov word [esp + 0x24], ax
mov word [esp + 0x36], ax
mov word [esp + 0x4a], ax
mov word [esp + 0x4c], ax
mov word [esp + 0x64], ax
mov word [esp + 0x66], ax
mov eax, 0xaaaaaaab
mov word [esp + 8], dx
mov word [esp + 0x1a], dx
mov word [esp + 0x2e], dx
mov word [esp + 0x42], dx
mov word [esp + 0x4e], dx
mov word [esp + 0x5c], dx
mov word [esp + 0x6e], dx
mul dword [esp + 0x78]
push ebx
push ebp
push esi
mov esi, 8
push edi
mov word [esp + 0x14], si
mov word [esp + 0x1e], si
mov word [esp + 0x24], si
mov word [esp + 0x44], si
mov word [esp + 0x58], si
mov word [esp + 0x72], si
mov word [esp + 0x78], si
mov ebp, 2
mov ebx, 4
mov ecx, 6
mov edi, 7
xor esi, esi
mov word [esp + 0x12], bp
shr edx, 1
mov word [esp + 0x16], bx
mov word [esp + 0x1a], cx
mov word [esp + 0x1c], di
mov word [esp + 0x26], di
mov word [esp + 0x28], cx
mov word [esp + 0x2c], bx
mov word [esp + 0x2e], 3
mov word [esp + 0x30], bp
mov word [esp + 0x32], 1
mov word [esp + 0x36], 1
mov word [esp + 0x38], bp
mov word [esp + 0x3a], 3
mov word [esp + 0x3c], bx
mov word [esp + 0x40], cx
mov word [esp + 0x42], di
mov word [esp + 0x48], 0
mov word [esp + 0x4a], 1
mov word [esp + 0x4c], bp
mov word [esp + 0x4e], 3
mov word [esp + 0x50], bx
mov word [esp + 0x54], cx
mov word [esp + 0x56], di
mov word [esp + 0x60], di
mov word [esp + 0x62], cx
mov word [esp + 0x64], 1
mov word [esp + 0x66], bp
mov word [esp + 0x68], 3
mov word [esp + 0x6a], bx
mov word [esp + 0x6e], cx
mov word [esp + 0x70], di
mov word [esp + 0x7a], bx
mov word [esp + 0x7c], cx
mov eax, esi
je 0x1000675e
mov edi, dword [esp + 0x84]
cmp si, 0x38
jne 0x10006744
xor esi, esi
mov bl, byte [eax + edi]
mov ecx, esi
and ecx, 0xffff
mov cl, byte [esp + ecx*2 + 0x10]
xor bl, cl
inc esi
mov byte [eax + edi], bl
inc eax
cmp eax, edx
jb 0x1000673c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8