joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052d4
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100b2d0]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
je 0x100537f
mov edi, 0x104
push edi
lea ecx, [ebp - 0x108]
push ecx
push eax
call int.0100342e
test eax, eax
je 0x10053e4
lea eax, [ebp - 0x108]
push eax
mov esi, 0x100bc44
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100c494], 0x20
je 0x1005371
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x12c]
sub eax, ebx
je 0x1005365
dec eax
je 0x100535e
dec eax
je 0x1005357
dec eax
jne 0x1005371
push 0x1001420
jmp 0x100536a
push 0x1001418
jmp 0x100536a
push 0x1001410
jmp 0x100536a
push 0x1001408
push edi
push esi
call fcn.010066cf
push 0x1001271
push edi
push esi
call fcn.010066cf
jmp 0x100538c
push eax
mov esi, 0x100bc44
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.010044bd
xor edi, edi
inc edi
test eax, eax
jne 0x10053ab
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10053c3
mov dword [0x100c880], edi
push ebx
push dword [ebp + 0x10]
push esi
call fcn.0100456a
test eax, eax
je 0x10053cf
mov dword [0x100ba5c], ebx
mov eax, edi
jmp 0x10053e6
call fcn.01003aa1
mov dword [0x100ba5c], eax
jmp 0x10053e4
cmp dword [0x100c880], ebx
je 0x10053e4
push esi
mov dword [0x100c880], ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010064de
leave
ret 0xc
Function at 0x10053fa
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100b2d0]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x110], eax
mov dword [0x100c4a4], eax
xor eax, eax
mov ecx, 0x23f
mov edi, 0x100bba0
rep stosd dword es:[edi], eax
push 0x41
mov ecx, 0xcb
mov edi, 0x100c880
rep stosd dword es:[edi], eax
pop ecx
mov edi, 0x100ba80
rep stosd dword es:[edi], eax
push 0x7f
mov esi, 0x100bbb4
xor edi, edi
push esi
xor ebx, ebx
inc edi
push 0x100144c
mov dword [ebp - 0x10c], ebx
mov dword [0x100be4c], edi
call fcn.01002e55
cmp eax, ebx
je 0x100564a
cmp eax, 0x80
ja 0x100564a
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push eax
mov dword [0x100ba50], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 4
push 0x100c494
push 0x1001440
call fcn.01002e55
test eax, eax
je 0x10054d3
test byte [0x100c494], 0xc0
je 0x1005563
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x1001430
call fcn.01002e55
test eax, eax
jne 0x10054f2
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003ebe
mov dword [0x100ba5c], 0x80070714
jmp 0x100565a
lea eax, [ebp - 0x108]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [0x100ba54], eax
je 0x1005563
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1005563
test byte [0x100c494], 0x80
je 0x1005532
push ebx
push 0x10
push ebx
push esi
push 0x54b
push ebx
call fcn.01003ebe
jmp 0x1005548
push 4
push 0x20
push ebx
push esi
push 0x524
push ebx
call fcn.01003ebe
cmp eax, 6
je 0x1005563
push dword [0x100ba54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100ba5c], 0x800700b7
jmp 0x100565a
push dword [ebp - 0x114]
mov dword [0x100ba60], ebx
call fcn.0100359c
test eax, eax
jne 0x1005587
push ebx
push 0x10
push ebx
push ebx
push 0x520
jmp 0x1005654
cmp byte [0x100c89a], bl
je 0x100559e
push 0x100c89a
call fcn.01002a96
jmp 0x100565a
push 0xa
push 0x1001424
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x10055c8
push eax
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10c], eax
cmp dword [0x100b2c4], ebx
je 0x10055d6
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x100c884], ebx
jne 0x1005646
push dword [ebp - 0x10c]
call fcn.0100488c
test eax, eax
je 0x100565a
mov ax, word [0x100ba64]
cmp ax, di
je 0x1005604
cmp ax, 2
je 0x1005604
cmp ax, 3
jne 0x1005646
test byte [0x100c495], 1
je 0x1005646
test byte [0x100c898], 1
jne 0x1005646
call fcn.01001760
test eax, eax
jne 0x1005646
push 0x83e
push 0x547
push 0x100189d
push ebx
push 0x7d6
push dword [0x100c4a4]
call fcn.01004819
cmp eax, 0x83d
jne 0x100565a
mov eax, edi
jmp 0x100565c
push ebx
push 0x10
push ebx
push ebx
push 0x4b1
push ebx
call fcn.01003ebe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010064de
leave
ret 0xc
Function at 0x1006205
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b2d0]
push edi
xor edi, edi
cmp word [0x100c898], di
mov dword [ebp - 4], eax
jne 0x1006247
cmp dword [0x100c884], edi
jne 0x100623e
call fcn.010043ec
test eax, eax
je 0x1006259
cmp word [0x100c898], di
jne 0x1006247
call fcn.01004bc8
test eax, eax
je 0x1006259
call fcn.0100435e
test eax, eax
je 0x1006259
call fcn.01005f21
test eax, eax
jne 0x1006260
xor eax, eax
jmp 0x100636a
push ebx
push esi
mov esi, 0x105
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1001264
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.010066cf
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
mov ebx, 0x100bc44
je 0x10062b3
push 0x10014a8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10062b3
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x100c884], edi
jne 0x10062da
cmp dword [0x100c490], edi
jne 0x10062da
call 0x10047b3
test eax, eax
jne 0x10062da
xor eax, eax
jmp 0x1006368
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x1006301
push edi
push 0x10
push edi
push edi
push 0x4bc
push edi
call fcn.01003ebe
call fcn.01003aa1
mov dword [0x100ba5c], eax
jmp 0x10062d3
cmp dword [0x100c88c], edi
jne 0x1006312
call fcn.01005a36
test eax, eax
je 0x10062d3
test byte [0x100cba8], 0xc0
jne 0x1006330
xor eax, eax
mov ax, word [0x100ba64]
push eax
call fcn.01001f93
mov dword [0x100bb84], eax
jmp 0x1006336
mov dword [0x100bb84], edi
cmp dword [0x100c884], edi
jne 0x100634f
cmp dword [0x100c490], edi
jne 0x100634f
call fcn.01005abc
test eax, eax
je 0x10062d3
cmp word [0x100c898], di
jne 0x1006365
cmp dword [0x100c884], edi
jne 0x1006365
call fcn.01004de5
xor eax, eax
inc eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.010064de
leave
ret

Function at 0x100672a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006741
xor eax, eax
jmp 0x1006749
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4

Function at 0x10069ea
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
je 0x1006a22
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1006a26
xor eax, eax
jmp 0x1006a3c
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
push 0x400
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
leave
ret 4
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401bd7
pop dword [ebp - 0x44]
mov eax, 0xc85d533c
sub eax, 0xc81d3765
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xeff6f50d
add dword [ebp - 0x54], 0x5e5b503e
mov dword [ebp - 0x50], 0x59d03aa0
sub dword [ebp - 0x50], 0x279cee5b
mov dword [ebp - 0x4c], 0xc5c0ac30
sub dword [ebp - 0x4c], 0x79746802
mov dword [ebp - 0x48], 0x55ef97e7
add dword [ebp - 0x48], 0xaa106819
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xfbb806f1
sub dword [ebp - 0x54], 0x87459d9b
mov dword [ebp - 0x50], 0xfeabbfc6
add dword [ebp - 0x50], 0x42c0a1af
mov dword [ebp - 0x4c], 0x9589f8d1
sub dword [ebp - 0x4c], 0x321a8c65
mov dword [ebp - 0x48], 0x1e8e4fcc
add dword [ebp - 0x48], 0xe171b034
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x34a83
push 0
call eax
mov ecx, 0x4054
xor edx, edx
add edx, eax
mov esi, 0xc7312bf1
add esi, 0x390fd40f
add esi, dword [ebp - 0x44]
mov ebx, 0x9d86dc7e
add dword [ebp - 0x14], esi
mov edi, dword [esi]
sub dword [ebp - 0x3c], edx
xor edi, ebx
add dword [ebp - 0x1c], 0x3973852d
mov dword [edx], edi
sub dword [ebp - 0x24], edx
add edx, 0x11f146cf
sub edx, 0x11f146cb
add esi, 0x54b3d188
sub esi, 0x54b3d184
loop 0x401ce5
add eax, 0xa7f02e0e
sub eax, 0xa7ef39eb
mov ebx, eax
add eax, 0xaa29d750
add eax, 0x55d628b5
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x2e00157c
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x2e001a08
call fcn.2e00192c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x2e00236c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x2e00131c
cmp eax, esi
jne 0x2e00130f
xor esi, esi
inc esi
mov ebx, esi
jmp 0x2e00131f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x2e0012f6
xor esi, esi
inc esi
mov eax, dword [0x2e002368]
cmp eax, esi
jne 0x2e001332
push 0x1f
call sub.MSVCR90.dll__amsg_exit
pop ecx
jmp 0x2e001361
mov eax, dword [0x2e002368]
test eax, eax
jne 0x2e00135b
mov dword [0x2e002368], esi
push 0x2e0010e0
push 0x2e0010d4
call sub.MSVCR90.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x2e001361
jmp 0x2e001489
mov dword [0x2e002028], esi
mov eax, dword [0x2e002368]
cmp eax, esi
jne 0x2e001385
push 0x2e0010d0
push 0x2e0010c8
call sub.MSVCR90.dll__initterm
pop ecx
pop ecx
mov dword [0x2e002368], 2
test ebx, ebx
jne 0x2e001391
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MZ]
cmp dword [0x2e002378], 0
je 0x2e0013b5
push 0x2e002378
call fcn.2e001863
pop ecx
test eax, eax
je 0x2e0013b5
push 0
push 2
push 0
call dword [0x2e002378]
mov eax, dword [sym.imp.MSVCR90.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x2e001411
test al, al
je 0x2e0013cf
cmp dword [ebp - 0x1c], 0
jne 0x2e001411
mov al, byte [esi]
test al, al
je 0x2e0013df
cmp al, 0x20
ja 0x2e0013df
inc esi
mov dword [ebp - 0x20], esi
jmp 0x2e0013cf
test byte [ebp - 0x3c], 1
je 0x2e0013eb
movzx eax, word [ebp - 0x38]
jmp 0x2e0013ee
push 0xa
pop eax
push eax
push esi
push 0
push 0x2e000000
call main
mov dword [0x2e002024], eax
cmp dword [0x2e002018], 0
jne 0x2e001465
push eax
call dword [sym.imp.MSVCR90.dll_exit]
cmp al, 0x22
jne 0x2e001420
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR90.dll__ismbblead]
pop ecx
test eax, eax
je 0x2e001433
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x2e0013bc
cmp dword [0x2e002028], 0
jne 0x2e001474
call dword [sym.imp.MSVCR90.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x2e002024]
jmp 0x2e001495
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.2e001971
ret
call fcn.2e0011b0
jmp 0x2e0012bc
Function at 0x40324c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40325b
pop dword [ebp - 0x3c]
mov eax, 0x40325b
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xa8d2f8f1
add dword [ebp - 0x4c], 0xa57f4c5a
mov dword [ebp - 0x48], 0x1f56270d
add dword [ebp - 0x48], 0x12dd2538
mov dword [ebp - 0x44], 0xf4876a93
add dword [ebp - 0x44], 0x57c4d99b
mov dword [ebp - 0x40], 0x98f5983c
add dword [ebp - 0x40], 0x670a67c4
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x3a4ccb3c
sub eax, 0x3a0c4ac4
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x1f009126
sub dword [ebp - 0x4c], 0xaa8e27d0
mov dword [ebp - 0x48], 0xe876a5a2
add dword [ebp - 0x48], 0x58f5bbd3
mov dword [ebp - 0x44], 0x9dec7767
sub dword [ebp - 0x44], 0x3a7d0afb
mov dword [ebp - 0x40], 0xa3b4bed
sub dword [ebp - 0x40], 0xa3b4bed
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x512e2f5e
add eax, 0xaf12511e
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x377ec
push 0
call eax
mov ecx, 0x49db
xor edi, edi
add edi, eax
mov ebx, 0x451400
add ebx, dword [ebp - 0x3c]
mov esi, 0xd43a63eb
sub esi, 0xd70e63fd
add dword [ebp - 0x38], 0xcad1c5b7
mov edx, dword [ebx]
xor dword [ebp - 0x38], edx
xor edx, esi
sub dword [ebp - 0x30], 0x7d912cab
mov dword [edi], edx
add dword [ebp - 0x2c], edx
add edi, 0xef84c9bc
add edi, 0x107b3648
add ebx, 4
loop 0x40336e
add eax, 0x11a3f
mov ebx, eax
add eax, 5
mov ecx, 0x71ce9736
add ecx, 0x8e7168ca
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x408fea
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409029
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409029
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409029
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409029
cmp dword [ecx + 0x74], 0xe
jbe 0x409029
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40eee6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c0ca8
push 0x4c0ca0
push str.FlsAlloc
push 0x1f
call fcn.0040eda5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ef1a
push dword [ebp + 8]
mov ecx, esi
call dword [0x427130]
call esi
jmp 0x40ef20
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ef64
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c0cb8
push 0x4c0cb0
push str.FlsGetValue
push 0x21
call fcn.0040eda5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ef9b
push dword [ebp + 8]
mov ecx, esi
call dword [0x427130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40efa3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c0cc0
push 0x4c0cb8
push str.FlsSetValue
push 0x22
call fcn.0040eda5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40efdd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x427130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1003bf50
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0xbc
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc8]
add eax, 7
cdq
push ebx
push ebp
mov ebp, dword [esp + 0xcc]
and edx, 7
push esi
add eax, edx
mov esi, eax
push edi
lea eax, [ebp + 1]
mov edi, ecx
push eax
mov dword [esp + 0x18], edi
mov byte [esp + 0x17], 0
sar esi, 3
call fcn.10087e65
add esp, 4
mov ebx, eax
add edi, esi
lea ebx, [ebx]
mov ecx, dword [esp + 0x18]
push ebp
push ecx
push ebx
call fcn.1008d020
mov dl, byte [esp + 0x1f]
add esp, 0xc
mov byte [ebx + ebp], dl
call sym.inicrypto_v5.4.1.dll_ISC_Crypto_Initialize
test eax, eax
jne 0x1003c005
mov dword [esp + 0x6c], 0x67452301
mov dword [esp + 0x70], 0xefcdab89
mov dword [esp + 0x74], 0x98badcfe
mov dword [esp + 0x78], 0x10325476
mov dword [esp + 0x7c], 0xc3d2e1f0
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
lea eax, [ebp + 1]
push eax
lea eax, [esp + 0x70]
push ebx
push eax
call fcn.10022ac0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x7c]
push edx
call fcn.10022ba0
add esp, 0x14
cmp esi, 0x14
jl 0x1003c060
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub edi, 0x14
mov dword [edi], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x2c]
sub esi, 0x14
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ecx
test esi, esi
je 0x1003c077
inc byte [esp + 0x13]
jmp 0x1003bfb0
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x30]
push esi
sub edx, esi
push edx
push edi
call fcn.1008d020
add esp, 0xc
jmp 0x1003c07b
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0xd8]
and esi, 7
je 0x1003c091
mov al, 1
mov ecx, esi
shl al, cl
dec al
and byte [edi], al
test ebx, ebx
je 0x1003c09e
push ebx
call fcn.10087d88
add esp, 4
mov ecx, dword [esp + 0xc8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10087a66
add esp, 0xbc
ret
Function at 0x10087a66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10087a70
repz ret
jmp fcn.10089222

Function at 0x1009118d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1008939a
and dword [ebp - 4], 0
cmp dword [0x10100da0], 0
mov ebx, eax
jne 0x1009123e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100912ef
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100912ef
push eax
call fcn.10089328
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10100da0], eax
call esi
push eax
call fcn.10089328
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10100da4], eax
call esi
push eax
call fcn.10089328
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10100da8], eax
call esi
push eax
call fcn.10089328
pop ecx
mov dword [0x10100db0], eax
test eax, eax
je 0x1009123e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10089328
pop ecx
mov dword [0x10100dac], eax
mov eax, dword [0x10100dac]
cmp eax, ebx
je 0x10091296
cmp dword [0x10100db0], ebx
je 0x10091296
push eax
call fcn.100893a3
push dword [0x10100db0]
mov esi, eax
call fcn.100893a3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10091296
test edi, edi
je 0x10091296
call esi
test eax, eax
je 0x1009128d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1009128d
test byte [ebp - 0xc], 1
jne 0x10091296
or dword [ebp + 0x10], 0x200000
jmp 0x100912cf
mov eax, dword [0x10100da4]
cmp eax, ebx
je 0x100912cf
push eax
call fcn.100893a3
pop ecx
test eax, eax
je 0x100912cf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100912cf
mov eax, dword [0x10100da8]
cmp eax, ebx
je 0x100912cf
push eax
call fcn.100893a3
pop ecx
test eax, eax
je 0x100912cf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10100da0]
call fcn.100893a3
pop ecx
test eax, eax
je 0x100912ef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100912f1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4016e0
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x4fe0]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [esp + 0x10]
mov ecx, dword [esi + 0x4fd8]
mov ebx, dword [esi + 0x4fdc]
shr ecx, 0x1c
mov eax, edi
and eax, 0xf
shl ebx, 4
add ecx, ebx
mov edx, edi
shr edx, 4
shl eax, 0x1c
cmp edi, ecx
sbb ecx, ecx
and ecx, 0x10000000
push ecx
push eax
push edx
mov edx, dword [esi + 0x28]
push 4
push edx
mov dword [esi + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0x4fe0], eax
je 0x401746
mov dword [esi + 0x18], edi
pop edi
pop esi
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x454178]
push 0x43d5b8
push str.Debug.txt
mov esi, eax
call fcn.004236af
push esi
push esi
push 0x43d5d0
push str._s_d__x__n
push eax
mov dword [edi], eax
call fcn.0042349c
mov eax, dword [edi]
push eax
call fcn.00423420
push 0xdf
call fcn.00416f80
push eax
call fcn.00416fd0
add esp, 0x28
pop edi
pop esi
pop ebx
ret 4
Function at 0x402640
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x402651
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esi + 0x4fe0]
push eax
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [esi + 0x10], 0
je 0x402693
cmp dword [esi + 0x2c], 0
je 0x402693
mov ecx, dword [esi + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [esi + 0x48], 0x7e
lea eax, [esi + 0x48]
mov dword [esi + 0x10], 0
jne 0x402693
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
Function at 0x40bdb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43c5b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x449238]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x40]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 0xc], ecx
push edx
mov ecx, esi
call fcn.00417040
mov ecx, dword [esp + 0x38]
xor eax, eax
mov dword [esi + 0x10cc078], ecx
mov ecx, esi
mov dword [esp + 0x14], eax
mov dword [esi], vtable.TAG_Plot.0
mov dword [esi + 0x1097a10], eax
call fcn.0040ef90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x20