joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe321a4
Capabilities:
Check for peb beingdebugged flag
Parse pe header

Disassembly:
mov byte [esp + 1], bl
mov dword [esp + 0x34], ebp
pushal
jmp 0xe323af
mov eax, dword [eax + 8]
push eax
jmp 0xe31032
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0xe321d6
lea esp, [esp + 2]
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
mov eax, dword fs:[0x30]
jmp 0xe32229
push word [esp + 0x1a]
mov word [esp + 0x15], di
lea esp, [esp + 2]
mov dword [esp + 0x50], esi
push di
mov word [esp], sp
jmp 0xe322ef
Function at 0x401041
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00402610
push edi
lea eax, [ebp - 0x800]
push 0x800
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x800]
push 0x40b070
push eax
call fcn.00402530
lea eax, [ebp - 0x800]
push str.browser_agent.exe
push eax
call fcn.00402530
mov ax, word [0x40b058]
mov ecx, 0x1ff
mov word [ebp - 0x1000], ax
xor eax, eax
lea edi, [ebp - 0xffe]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1000]
push eax
call fcn.00402530
add esp, 0x18
lea eax, [ebp - 0x1000]
push 0
push 0
push eax
lea eax, [ebp - 0x800]
push eax
push 0x40b050
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
leave
ret
Function at 0x401451
Capabilities:
Create process on windows

Disassembly:
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push 1
push eax
push eax
push dword [esp + 0x10]
push 0x40b050
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x401477
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push edi
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x128]
push eax
push ebx
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.dll_Process32First
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4014f7
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.00402640
pop ecx
test eax, eax
pop ecx
jne 0x4014e5
push dword [ebp - 0x120]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4014e5
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
lea eax, [ebp - 0x128]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4014af
pop esi
push ebx
call edi
pop edi
pop ebx
leave
ret

Function at 0x40165e
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp + 0x10]
push edi
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call fcn.00402c8f
lea eax, [ebp - 0x104]
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x1a8], esi
je 0x4016c5
add eax, 0x84
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edi, eax
cmp edi, esi
je 0x4016d2
lea eax, [ebp - 4]
push esi
push eax
push esi
push 1
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x4016d2
lea eax, [ebp - 0x104]
push eax
call fcn.00402c17
pop ecx
pop edi
pop esi
leave
ret
Function at 0x4017ca
Capabilities:
Create thread

Disassembly:
mov eax, 0x408d70
call fcn.0040312c
sub esp, 0x30
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, esi
mov dword [0x40e3ac], eax
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
push 1
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], esi
call fcn.00401f91
push esi
push esi
push esi
push 3
push 4
push esi
push esi
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
push 1
mov ebx, 0x40e208
push 0x14
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleRegisterClassObjects]
cmp dword [edi + 0x1a8], esi
je 0x401842
push 4
mov ecx, edi
call fcn.004017aa
push esi
push esi
push esi
push 0x4014fe
push esi
push esi
call fcn.00402ce0
add esp, 0x18
test eax, eax
jne 0x401865
push str.Process_Check_Thread_Start_Error
push edi
call fcn.0040165e
pop ecx
pop ecx
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push esi
push esi
lea eax, [ebp - 0x3c]
push esi
push eax
call edi
test eax, eax
je 0x40188b
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push esi
lea eax, [ebp - 0x3c]
push esi
push eax
jmp 0x401872
push ebx
call dword [sym.imp.ATL.DLL_AtlModuleRevokeClassObjects]
call dword [sym.imp.ole32.dll_CoUninitialize]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401f47
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4018b3
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x4091f8
push 0x64
push dword [ebp + 8]
mov ebx, 0x40e208
mov ecx, ebx
mov dword [ebp + 0x10], eax
push 0x40e3b8
call fcn.00401bf4
mov esi, 0x40b240
lea edi, [ebp - 0xc]
lea eax, [ebp - 0xc]
mov dword [0x40e3b0], 1
movsw word es:[edi], word [esi]
push eax
push dword [ebp + 0x10]
movsb byte es:[edi], byte [esi]
call section..text
mov esi, eax
xor edi, edi
pop ecx
cmp esi, edi
pop ecx
je 0x401963
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.UnregServer
push esi
call edi
test eax, eax
je 0x40197e
push str.RegServer
push esi
call edi
test eax, eax
je 0x40198a
push str.Service
push esi
call edi
test eax, eax
je 0x40196e
push str.install
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jle 0x40194f
push esi
call fcn.00401041
pop ecx
lea eax, [ebp - 0xc]
push eax
push esi
call section..text
mov esi, eax
pop ecx
test esi, esi
pop ecx
jne 0x401914
xor edi, edi
mov ecx, ebx
call fcn.0040161b
test eax, eax
jne 0x40198e
push 1
push 1
mov ecx, ebx
call fcn.00401a6c
jmp 0x401a65
mov ecx, ebx
call fcn.00401bbb
jmp 0x401a65
push 0
jmp 0x401970
mov esi, 0x20019
lea ecx, [ebp - 4]
push esi
push str.AppID
push 0x80000000
mov dword [ebp - 4], edi
call fcn.00401f09
cmp eax, edi
mov dword [ebp + 0x10], eax
je 0x4019c0
cmp dword [ebp - 4], edi
je 0x4019f8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4019f8
push esi
push str.FD532C54_FC82_4C97_9E7C_FB4397203A44
push dword [ebp - 4]
lea ecx, [ebp - 8]
mov dword [ebp - 8], edi
call fcn.00401f09
cmp eax, edi
mov dword [ebp + 0x10], eax
je 0x4019fd
cmp dword [ebp - 8], edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4019ee
push dword [ebp - 8]
call esi
mov dword [ebp - 8], edi
cmp dword [ebp - 4], edi
je 0x4019f8
push dword [ebp - 4]
call esi
mov eax, dword [ebp + 0x10]
jmp 0x401a65
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp + 0x10]
push eax
push edi
push str.LocalService
mov dword [ebp + 0x10], edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
mov dword [0x40e3b0], edi
jne 0x401a39
mov dword [0x40e3b0], 1
mov ecx, ebx
call fcn.00401ea3
cmp dword [ebp - 8], edi
mov ebx, dword [0x40e39c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x401a59
push dword [ebp - 8]
call esi
mov dword [ebp - 8], edi
cmp dword [ebp - 4], edi
je 0x401a63
push dword [ebp - 4]
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x401a6c
Capabilities:
Create process on windows
Delete registry value
Set registry value

Disassembly:
mov eax, 0x408d8c
call fcn.0040312c
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x18], ecx
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, esi
jl 0x401baa
mov ecx, dword [ebp - 0x18]
call fcn.00401d50
push esi
push esi
push 1
push 0x64
push dword [ebp - 0x18]
call dword [sym.imp.ATL.DLL_AtlModuleUpdateRegistryFromResourceD]
mov dword [ebp - 0x14], esi
mov edi, 0x20006
lea ecx, [ebp - 0x14]
push edi
push str.AppID
push 0x80000000
mov dword [ebp - 4], esi
call fcn.00401f09
mov ebx, eax
cmp ebx, esi
je 0x401ae2
cmp dword [ebp - 0x14], esi
je 0x401ba8
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401ba8
mov dword [ebp - 0x10], esi
push edi
push str.FD532C54_FC82_4C97_9E7C_FB4397203A44
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401f09
mov ebx, eax
cmp ebx, esi
jne 0x401b8b
push str.LocalService
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0xc], esi
je 0x401b76
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, 0x40b284
push ebx
call edi
inc eax
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push esi
push str.LocalService
push dword [ebp - 0x10]
call ebx
push str._Service
call edi
inc eax
push eax
push str._Service
push 1
push esi
push str.ServiceParameters
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp - 0x18]
call fcn.00401c98
push esi
push esi
push str.start__browser_agents_
push str.sc.exe
push 0x40b050
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push esi
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ATL.DLL_AtlModuleRegisterServer]
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x401b9e
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x14], esi
je 0x401ba8
push dword [ebp - 0x14]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x401c98
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
mov edi, ecx
call fcn.0040161b
test eax, eax
jne 0x401d48
xor esi, esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
cmp ebx, esi
jne 0x401cd7
add edi, 0x84
push esi
push edi
push str.Couldnt_open_service_manager
jmp 0x401d26
lea eax, [ebp - 0x104]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push esi
push str.RPCSS
push esi
lea eax, [ebp - 0x104]
push esi
push eax
push 1
push 2
add edi, 0x84
push 0x10
push 0xf01ff
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, esi
jne 0x401d31
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push edi
push str.Couldnt_create_service
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x401d4b
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push ebx
call esi
push 0x40b294
call fcn.00401473
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401d50
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0040161b
test eax, eax
je 0x401dee
push 0x40e100
xor ebp, ebp
push str.browser_agent
push ebp
call fcn.00401e0d
add esp, 0xc
push 0xf003f
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebp
jne 0x401d9d
add esi, 0x84
push ebp
push esi
push str.Couldnt_open_service_manager
jmp 0x401dc4
lea ebx, [esi + 0x84]
push 0x10020
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
cmp esi, ebp
jne 0x401dc7
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
push ebx
push str.Couldnt_open_service
push ebp
jmp 0x401dfd
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, eax
call esi
push edi
call esi
test ebp, ebp
je 0x401df3
push 1
pop eax
jmp 0x401e05
push 0
push ebx
push str.Service_could_not_be_deleted
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x401e0d
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x401e5f
cmp dword [ebp + 0xc], edi
je 0x401e98
cmp dword [ebp + 0x10], edi
je 0x401e98
lea eax, [ebp + 8]
push eax
push 0x20006
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401e98
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x401e89
lea eax, [ebp + 8]
push eax
push 0xf003f
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401e98
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x401e9c
xor eax, eax
jmp 0x401e9f
push 1
pop eax
pop edi
pop esi
pop ebp
ret

Function at 0x402bd1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402bf1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004044db
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x402c14
test byte [esp + 8], 2
je 0x402c14
call fcn.0040454e
mov dword [eax], 0xd
call fcn.00404557
mov dword [eax], 5
jmp 0x402bed
xor eax, eax
ret

Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret
Function at 0x102c275
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0102a3d1
test al, al
je 0x102c2a4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x102c398
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jne 0x102c2b6
and dword [ebp - 4], 0
jmp 0x102c2e4
push dword [ebp + 0xc]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov ebx, esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push ebx
call fcn.01028afc
neg eax
sbb eax, eax
and eax, ebx
mov dword [ebp - 4], eax
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x102c318
push dword [ebp + 0x10]
call esi
lea ebx, [eax + eax + 2]
lea eax, [ebx + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov edi, esp
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x10]
push edi
call fcn.01028afc
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, edi
xor edi, edi
cmp dword [ebp + 0x14], edi
je 0x102c350
push dword [ebp + 0x14]
call esi
lea edi, [eax + eax + 2]
lea eax, [edi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 0xc], esp
push 0xffffffffffffffff
push edi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.01028afc
mov edi, eax
neg edi
sbb edi, edi
and edi, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 0x18], eax
je 0x102c386
push dword [ebp + 0x18]
call esi
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01016610
mov dword [ebp + 0xc], esp
push 0xffffffffffffffff
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call fcn.01028afc
neg eax
sbb eax, eax
and eax, dword [ebp + 0xc]
push dword [ebp + 0x1c]
push eax
push edi
push ebx
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100062fa
pop dword [ebp - 0x44]
mov eax, 0xa5de10fb
sub eax, 0x95ddae01
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x32c64
push 0
mov eax, 0xa5a58cb5
sub eax, 0x95a44c51
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x42690291
sub ecx, 0x4268d38f
mov ebx, eax
mov edi, 0xa4f95170
sub edi, 0x94f7cb70
add edi, dword [ebp - 0x44]
mov edx, 0x20d71195
add edx, 0xdcd11d49
add dword [ebp - 0xc], esi
mov esi, dword [edi]
xor dword [ebp - 0x2c], 0x1755047e
sub esi, edx
mov dword [ebp - 0x2c], 0x78feca0f
mov dword [ebx], esi
sub dword [ebp - 0x20], 0xf4a162a4
add ebx, 4
add edi, 0x1d170e3d
add edi, 0xe2e8f1c7
loop 0x10006359
add eax, 0xe64f0724
sub eax, 0xe64e5849
mov ebx, eax
add eax, 0x80258af
add eax, 0xf7fda756
mov ecx, 0xfa7cbd8
add ecx, 0x583428
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x100369d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10123fc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10036a8c
cmp byte [esi + 0x3d], 0
je 0x10036a8c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10036a7a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10036a41
sub eax, 1
je 0x10036a45
sub eax, 2
jne 0x10036a7a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bb5fe
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10036a63
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10036a7a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bb5fe
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bb5fe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100bb5fe
mov esp, ebp
pop ebp
ret