joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1094e
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, 0x504c
mov ecx, eax
push section..cdata
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edi, 0x2259
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push 0x12
push edi
push 0xc
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ecx, eax
mov eax, 0x11e4
mov edx, eax
cmp ecx, edi
jge 0x1099f
mov eax, ecx
jmp 0x10a61
mov eax, dword [ebp - 4]
and dword [eax + 0x1c], 0xffffff7f
mov eax, dword [ebp - 4]
or dword [eax + 0x1c], 0x10
mov eax, 0x68a6
push eax
pop ebx
shl ebx, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov esi, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, 0x3fa2
push eax
pop edx
push 0xc
push edi
push dword [esi]
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov eax, 0xe07
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax + 8], 2
mov eax, dword [esi]
add eax, 4
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoAttachDevice]
mov dword [ebp + 8], eax
cmp eax, edi
mov eax, dword [esi]
jge 0x10a2d
mov dword [eax], edi
shl ebx, 8
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, 0x29b9
push eax
pop ebx
mov dword [esi], edi
mov eax, 0x5e70
push eax
pop edx
mov eax, dword [ebp + 8]
jmp 0x10a61
mov ecx, dword [eax + 4]
call dword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
shl ecx, 8
push 4
call fcn.0001ea68
cmp eax, edi
je 0x10a4d
mov ecx, eax
call fcn.0001cdfc
jmp 0x10a4f
xor eax, eax
push eax
mov dword [0x20b20], eax
call fcn.000107fc
mov edx, 0x6be5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x11786
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push 0x134
push 0x20018
call fcn.0001fbbc
mov esi, ecx
mov dword [ebp - 0x144], esi
shl ebx, 8
mov ebx, 0x2193
shl ebx, 8
mov edi, 0x120
push edi
push 0
lea eax, [ebp - 0x13c]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
shl ebx, 8
and dword [ebp - 4], 0
lea eax, [ebp - 0x140]
push eax
push edi
lea eax, [ebp - 0x13c]
push eax
push 0xb
call dword [sym.imp.ntoskrnl.exe_NtQuerySystemInformation]
xor ecx, ecx
mov cl, 0x91
mov ch, 0x8f
cmp eax, 0xc0000004
je 0x11801
test eax, eax
je 0x11801
mov ecx, 0x27f0
mov dword [ebp - 4], 0xfffffffe
xor al, al
jmp 0x11884
mov eax, dword [ebp - 0x130]
mov dword [esi + 0x100], eax
shl edx, 8
mov eax, dword [ebp - 0x12c]
mov dword [esi + 0x104], eax
mov eax, 0x38e8
mov edx, eax
push 0x21778
push esi
call fcn.0001f3b0
movzx eax, word [ebp - 0x11e]
mov ecx, 0xe0
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x11c]
push eax
push esi
call sub.ntoskrnl.exe_strncat
add esp, 0xc
mov eax, 0x62c6
push eax
pop ecx
mov eax, 0x7d97
push eax
pop edx
mov dword [ebp - 4], 0xfffffffe
jmp 0x11879
xor eax, eax
cmp dword [esi + 0x100], eax
setne al
call fcn.0001fc04
ret
Function at 0x11890
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0xc], esi
mov eax, 0x63fa
push eax
pop edx
mov eax, 0x48ac
mov edi, eax
shr eax, 8
call fcn.00011786
test al, al
jne 0x118c1
xor al, al
jmp 0x11ab9
push esi
call fcn.0001f696
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, 0x36f2
mov edi, eax
push 0x100
xor edi, edi
push edi
push edi
push edi
push edi
push 0x60
push 1
push 1
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], eax
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x80100000
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x30], 0x240
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov ecx, eax
mov eax, 0x9ce
mov edx, eax
cmp ecx, edi
jne 0x118ba
lea eax, [ebp - 0x14]
push eax
push 0x40
lea ebx, [esi + 0x112]
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.0001aa7e
mov edx, 0x3e4c
cmp word [ebx], 0x5a4d
je 0x1195b
mov eax, 0x7e0f
push eax
pop edx
jmp 0x118ba
mov eax, dword [esi + 0x14e]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
xor ecx, ecx
mov cl, 6
mov ch, 0xa7
lea ecx, [ebp - 0x14]
push ecx
push 0xf8
lea eax, [esi + 0x152]
push eax
push dword [ebp - 4]
call fcn.0001aa7e
xor ebx, ebx
mov bl, 0xe0
mov bh, 0x17
cmp dword [esi + 0x152], 0x4550
je 0x119a1
mov ebx, 0x57da
jmp 0x118ba
mov ecx, dword [esi + 0x1a2]
mov eax, 0x1000
cmp ecx, eax
jbe 0x119b2
mov eax, ecx
shr ebx, 8
mov ecx, dword [esi + 0x1a6]
push 0x6b736966
push eax
push 1
mov dword [ebp - 8], ecx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esi + 0x108], eax
mov eax, 0x72f5
push eax
pop ecx
cmp dword [esi + 0x108], edi
je 0x118ba
mov esi, 0x2d28
shr ebx, 8
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], edi
push dword [esi + 0x108]
mov dword [ebp - 0x10], edi
push dword [ebp - 4]
call fcn.0001aa7e
mov edi, 0x68a0
push dword [esi + 0x108]
call fcn.0001aa56
mov dword [ebp - 8], eax
mov eax, 0x53d6
mov edx, eax
mov eax, 0x68db
mov edx, eax
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.000112d2
mov eax, 0x3913
push eax
pop ebx
shr eax, 8
push dword [ebp - 8]
mov ecx, esi
call fcn.00011358
mov eax, 0xf4f
mov edi, eax
xor eax, eax
mov al, 0x60
mov ah, 0x45
mov eax, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov eax, dword [eax]
mov ecx, dword [esi + 0x100]
cmp eax, ecx
jb 0x11a98
mov edx, dword [esi + 0x104]
add edx, ecx
cmp eax, edx
jae 0x11a98
mov edx, dword [esi + 0x108]
sub edx, ecx
add edx, eax
mov dword [esi + 0x10c], edx
mov eax, 0x554
push eax
pop edi
push dword [ebp - 8]
mov ecx, esi
call fcn.00011482
push 0
push dword [esi + 0x108]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
shl ecx, 8
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, 0xbbd
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x12c72
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, 0x4a7a
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push 0x12
push edi
push 0xc
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov esi, 0x24d1
cmp eax, edi
jl 0x12cea
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov esi, dword [ebp + 0xc]
push 0xc
push edi
push eax
mov dword [esi], eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov eax, 0x699e
push eax
pop edx
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov ebx, 0x3a2f
mov eax, dword [esi]
mov dword [eax + 8], 3
mov eax, 0x624f
mov edi, eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoRegisterShutdownNotification]
mov edi, 0x41f3
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x12e88
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, 0x7e3b
push eax
pop esi
mov edi, 0x5799
shr eax, 8
mov ebx, dword [ebp + 8]
xor esi, esi
push esi
push 1
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov eax, 0x32cc
mov edx, eax
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov eax, 0x4dc
push eax
pop edx
push ebx
push 0x1eb1c
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
mov edi, 0x1f03ff
push edi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov ecx, 0x2151
cmp eax, esi
jl 0x12f32
push esi
add ebx, 0xc
push ebx
push esi
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edi, 0x23ad
push 0x1f
push dword [ebx]
call dword [sym.imp.ntoskrnl.exe_KeSetPriorityThread]
shr ecx, 8
push dword [ebp - 4]
call dword [0x21620]
shl edx, 8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x14698
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x20ab0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov eax, 0x68b3
push eax
pop edi
cmp byte [ebp + 0xc], 0
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x84]
je 0x146d6
push 0x21bc4
push eax
call sub.ntoskrnl.exe_swprintf
add esp, 0xc
jmp 0x146e9
push 0x21c0c
push eax
call sub.ntoskrnl.exe_swprintf
add esp, 0xc
mov ecx, 0x301f
lea eax, [ebp - 0x84]
push eax
push 0x21ac0
push 0
call dword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
mov edx, 0x72c7
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0001f2af
leave
ret 8
Function at 0x15c34
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
shr edx, 8
cmp byte [ebp + 0xc], 0
mov edi, dword [ebp + 8]
je 0x15c5a
push dword [edi + 0x2c]
mov ecx, dword [0x216b4]
call fcn.0001f01e
shl eax, 8
lea esi, [edi + 0x18]
cmp dword [esi], 0
je 0x15c8a
mov eax, 0x65a1
mov ebx, eax
push dword [esi]
call dword [sym.imp.ntoskrnl.exe_MmUnlockPages]
shl eax, 8
push dword [esi]
call dword [sym.imp.ntoskrnl.exe_IoFreeMdl]
shr edx, 8
and dword [esi], 0
mov esi, 0x105d
cmp dword [edi + 0x14], 0
je 0x15cbc
mov edx, 0xe6f
mov ecx, dword [edi + 0x14]
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
shl ebx, 8
mov eax, dword [ebp - 4]
dec dword [eax + 0x84]
mov eax, 0x5f57
mov edx, eax
and dword [edi + 0x14], 0
mov eax, 0x4319
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1a8fc
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, 0x9c7
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, 0x1ab8
mov edx, eax
mov ecx, dword [ecx]
call fcn.0001a448
mov esi, 0x6333
shl ecx, 8
mov eax, dword [ebp + 0xc]
cmp word [eax], 0x5a4d
je 0x1a93c
shl ebx, 8
jmp 0x1aa47
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1aa47
mov edx, dword [ecx + 0x50]
mov eax, 0x1000
cmp edx, eax
mov dword [ebp + 0x10], edx
ja 0x1a95f
mov dword [ebp + 0x10], eax
mov eax, 0x1293
mov edi, eax
mov esi, dword [ecx + 0x54]
push 0x696c6966
push dword [ebp + 0x10]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
mov dword [ebp - 0xc], ebx
shr ecx, 8
test ebx, ebx
jne 0x1a991
mov eax, 0x6738
mov ebx, eax
jmp 0x1aa47
mov eax, 0x5199
mov edi, eax
push esi
push dword [ebp + 0xc]
push ebx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
xor edx, edx
mov dl, 0x5d
mov dh, 0x11
push ebx
call fcn.0001aa56
mov esi, eax
mov dword [ebp - 8], esi
mov edi, 0x512a
shr edx, 8
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.0001a7ec
xor edx, edx
mov dl, 0xc5
mov dh, 0x2e
mov ecx, dword [ebp - 4]
push ebx
push esi
call fcn.0001a4f4
shr edx, 8
mov eax, 0x5209
mov edi, eax
mov ecx, dword [ebp - 4]
push ebx
push esi
call fcn.0001a5ba
mov eax, 0x1756
push eax
pop esi
mov esi, dword [ebp - 4]
push ebx
push dword [ebp - 8]
mov ecx, esi
call fcn.0001a6b6
mov eax, 0x7d50
mov ecx, eax
mov eax, dword [esi]
xor ecx, ecx
cmp dword [eax], ecx
je 0x1aa3a
cmp dword [eax + 4], ecx
je 0x1aa3a
mov dword [eax + 8], ebx
xor ebx, ebx
mov bl, 0x86
mov bh, 0xb1
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0001dea4
mov eax, 0x21f4
mov esi, eax
mov al, 1
jmp 0x1aa49
push ecx
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, 0x4382
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1aa7e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
shl edx, 8
xor edi, edi
mov eax, 0x765f
mov ebx, eax
xor eax, eax
mov ecx, edi
neg ecx
sbb ecx, ecx
not ecx
and ecx, dword [ebp + 0x14]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
sub ecx, edi
push ecx
mov ecx, dword [ebp + 0xc]
add ecx, edi
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jne 0x1aad2
add edi, dword [ebp - 4]
mov eax, 0x7fbe
mov esi, eax
cmp edi, dword [ebp + 0x10]
jne 0x1aa94
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1aae0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor esi, esi
mov eax, esi
neg eax
sbb eax, eax
not eax
and eax, dword [ebp + 0x14]
push 0
push eax
mov eax, dword [ebp + 0x10]
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
jne 0x1ab2b
add esi, dword [ebp - 4]
mov eax, 0x1d18
push eax
pop ebx
cmp esi, dword [ebp + 0x10]
jne 0x1aaeb
xor ecx, ecx
mov cl, 0xda
mov ch, 0x64
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1b6b8
Capabilities:
Decrypt data using tea

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push ebx
push esi
mov esi, dword [eax]
push edi
mov dword [ebp - 4], 0x20
xor eax, eax
mov al, 0x30
mov ah, 0xb7
mov eax, 0x15a1
push eax
pop ebx
mov edi, 0xc6ef3720
xor ecx, ecx
mov cl, 0x22
mov ch, 0x91
mov ecx, dword [ebp + 0xc]
jmp 0x1b6f0
mov edi, dword [ebp + 0xc]
dec dword [ebp - 4]
mov eax, esi
shr eax, 5
add eax, dword [ecx + 0xc]
mov ebx, esi
shl ebx, 4
add ebx, dword [ecx + 8]
xor eax, ebx
lea ebx, [edi + esi]
xor eax, ebx
sub edx, eax
xor ebx, ebx
mov bl, 0x8b
mov bh, 0x1f
mov eax, edx
shl eax, 4
add eax, dword [ecx]
mov ebx, edx
shr ebx, 5
add ebx, dword [ecx + 4]
xor eax, ebx
lea ebx, [edi + edx]
xor eax, ebx
sub esi, eax
shl eax, 8
add edi, 0x61c88647
mov dword [ebp + 0xc], edi
mov edi, 0x902
cmp dword [ebp - 4], 0
ja 0x1b6ed
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, 0x139d
push eax
pop esi
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
xor eax, eax
mov al, 0x80
mov ah, 0x7e
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1ca20
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x1c], eax
xor ebx, ebx
mov bl, 0xe1
mov bh, 0x1d
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1d3ac
Capabilities:
Parse pe header

Disassembly:
push 0x10
push 0x20078
call fcn.0001f9fc
mov byte [ebp - 0x19], 0
shr ebx, 8
and dword [ebp - 4], 0
mov edi, dword [ebp + 8]
mov eax, edi
and eax, 0xfff
mov esi, edi
sub esi, eax
mov dword [ebp - 0x20], esi
mov ebx, 0x7cb8
xor eax, eax
mov al, 0xf6
mov ah, 0x72
push esi
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1d456
mov eax, edi
sub eax, esi
cmp eax, 0x200000
ja 0x1d456
cmp word [esi], 0x5a4d
jne 0x1d43e
mov eax, dword [esi + 0x3c]
cmp eax, 0xffc
jae 0x1d43e
lea ecx, [eax + esi]
mov eax, 0x183a
cmp dword [ecx], 0x4550
jne 0x1d43e
mov eax, dword [ecx + 0x50]
xor ecx, ecx
mov cl, 0x66
mov ch, 0x53
lea ecx, [eax + esi]
cmp edi, ecx
jae 0x1d456
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
shl edx, 8
mov dword [ecx + 4], eax
mov eax, 0x5410
push eax
pop edx
mov byte [ebp - 0x19], 1
jmp 0x1d456
sub esi, 0x1000
mov dword [ebp - 0x20], esi
xor edx, edx
mov dl, 0xe6
mov dh, 5
jmp 0x1d3d9
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x19]
call fcn.0001fa41
ret 8
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x5d8e4e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x5d8b64
mov eax, 0x5b2d9e9a
dec eax
call fcn.005d8e90
or ebx, ebx
mov eax, 0x2dea681e
or eax, eax
xor dword [ecx], edx
sub ebx, eax
add ecx, 2
or eax, ebx
add eax, eax
cmp ecx, edi
jl fcn.005d8e4e
add ebx, 0xbc4a5c0b
mov eax, 0x639b623b
ret
Function at 0x1011dd78
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1016a470]
jne 0x1011dd82
repz ret
jmp fcn.1011e798

Function at 0x1012275f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1011e22c
and dword [ebp - 4], 0
cmp dword [0x1016bfdc], 0
mov ebx, eax
jne 0x10122810
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x101228c1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x101228c1
push eax
call fcn.1011e1ba
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1016bfdc], eax
call esi
push eax
call fcn.1011e1ba
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1016bfe0], eax
call esi
push eax
call fcn.1011e1ba
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1016bfe4], eax
call esi
push eax
call fcn.1011e1ba
pop ecx
mov dword [0x1016bfec], eax
test eax, eax
je 0x10122810
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1011e1ba
pop ecx
mov dword [0x1016bfe8], eax
mov eax, dword [0x1016bfe8]
cmp eax, ebx
je 0x10122868
cmp dword [0x1016bfec], ebx
je 0x10122868
push eax
call fcn.1011e235
push dword [0x1016bfec]
mov esi, eax
call fcn.1011e235
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10122868
test edi, edi
je 0x10122868
call esi
test eax, eax
je 0x1012285f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1012285f
test byte [ebp - 0xc], 1
jne 0x10122868
or dword [ebp + 0x10], 0x200000
jmp 0x101228a1
mov eax, dword [0x1016bfe0]
cmp eax, ebx
je 0x101228a1
push eax
call fcn.1011e235
pop ecx
test eax, eax
je 0x101228a1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x101228a1
mov eax, dword [0x1016bfe4]
cmp eax, ebx
je 0x101228a1
push eax
call fcn.1011e235
pop ecx
test eax, eax
je 0x101228a1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1016bfdc]
call fcn.1011e235
pop ecx
test eax, eax
je 0x101228c1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x101228c3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101238f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1016a194]
sub eax, 0x151e
mov dword [0x1016a198], eax
mov dword [ebp - 4], 0
mov eax, dword [0x1016a194]
sub eax, 0x1836
mov dword [0x1016a194], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x10], eax
mov dword [0x1016a194], 0x256b
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x104
jge 0x1012397b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dx, word [eax + ecx*2]
mov word [ebp - 0x12], dx
mov ax, word [ebp - 0x12]
movzx ecx, ax
cmp ecx, 0
jne 0x1012396c
jmp 0x1012397b
jmp 0x1012396e
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x10123944
mov eax, dword [0x1016a194]
sub eax, 0x1d85
mov dword [0x1016a194], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x10123a7b
mov dword [0x1016a194], 0xe40
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
jne 0x10123a79
mov eax, dword [0x1016a194]
add eax, 0x15ef
mov dword [0x1016a198], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x10123a77
mov eax, dword [0x1016a194]
sub eax, 0x74a
mov dword [0x1016a194], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x10123a75
mov dword [0x1016a194], 0xf06
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x10123a73
mov dword [0x1016a194], 0x2a3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2 - 0x10]
cmp eax, 0x6c
jne 0x10123a71
mov dword [0x1016a194], 0x1286
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + eax*2 - 0xe]
cmp eax, 0x6c
jne 0x10123a6f
mov dword [ebp - 0xc], 1
jmp 0x10123a91
jmp 0x10123a71
jmp 0x10123a73
jmp 0x10123a75
jmp 0x10123a77
jmp 0x10123a79
jmp 0x10123a7b
mov eax, dword [0x1016a198]
add eax, 0xa08
mov dword [0x1016a194], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
add esp, 0x1c
pop ebp
ret
Function at 0x10123ca0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.10123ca0]
mov dword [0x1016a198], 0x24b3
mov dword [ebp - 8], eax
mov dword [0x1016a194], 0xbe4
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x10123cf3
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax], 0x4550
jne 0x10123cf1
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10123d2b
jmp 0x10123cf3
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov dword [0x1016a194], 0xd54
mov al, 1
test al, 1
jne 0x10123cc3
jmp 0x10123d15
mov eax, dword [0x1016a194]
sub eax, 0x72
mov dword [0x1016a198], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebp
ret