joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008cc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x10008e33
cmp dword [edx + 0x1c], 0x10
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jb 0x10008cfb
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x10008d24
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x10008d10
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10009060
push 0x38
push edi
call fcn.1001a1f6
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10008d8d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10008d40
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10008e28
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x10008d9f
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x10008da2
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x10008e28
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x10008dbe
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10008de1
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10008dd0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10009060
push 0x38
push edi
call fcn.1001a1f6
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [ecx + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10008e39
cmp esi, eax
jne 0x10008df8
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x10008db0
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000a7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x1000a9fd
cmp eax, 3
jb 0x1000a856
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x1000a893
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x1000a893
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x1000a87d
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.1000a510
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x1000a97e
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.1000a090
mov ecx, dword [esi + 0x6af90]
add esp, 4
sub ecx, edi
mov dword [ebp - 4], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x1000a948
cmp ecx, 3
jb 0x1000a948
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x1000a8e0
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [ebp - 4]
jmp 0x1000a9a5
mov edx, dword [esi + 0x6af84]
add edx, edi
xor edi, edi
mov dword [esi + 0x6af84], edx
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x1000a9a5
movzx eax, byte [ecx + esi + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.1000a090
dec dword [esi + 0x6af90]
add esp, 4
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
test eax, eax
je 0x1000a9db
mov eax, dword [esi + 0x6af74]
sub edx, eax
test eax, eax
js 0x1000a9be
add eax, 0x1af70
add eax, esi
jmp 0x1000a9c0
xor eax, eax
push 0
push edx
mov edx, eax
mov ecx, esi
call fcn.10009c50
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
mov eax, dword [esi + 0x6af90]
cmp eax, 0x106
jae 0x1000a9f5
mov ecx, esi
call fcn.1000a690
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x1000a805
mov eax, dword [esi + 0x6af74]
mov ecx, dword [esi + 0x6af84]
sub ecx, eax
test eax, eax
js 0x1000aa2b
push 1
lea edx, [esi + 0x1af70]
push ecx
add edx, eax
mov ecx, esi
call fcn.10009c50
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push ecx
xor edx, edx
mov ecx, esi
call fcn.10009c50
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b5f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1000b5fb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1000b6b7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004c600]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004c600]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004c600]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004c600]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004c600]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004c600]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004c600]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004c600]
sub edi, 1
jne 0x1000b610
pop edi
test esi, esi
je 0x1000b6da
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004c600]
sub esi, 1
jne 0x1000b6c0
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x1000b9a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x1000ba77
mov ecx, dword [esi + 0x3c]
mov eax, ecx
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x1000b9d8
cmp dword [esi + 0x40], ebx
jae 0x1000b9d8
push ecx
call fcn.1001a74a
add esp, 4
mov dword [esi + 0x3c], 0
jmp 0x1000b9dc
test eax, eax
jne 0x1000b9ee
lea eax, [ebx + ebx]
push eax
call fcn.1001a74f
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push eax
call fcn.1001d110
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x1000ba74
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x1004c600]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x1004c600]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x1000ba02
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1000bab5
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x1000ba9c
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.1001d110
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x1000bad7
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1000bb80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x84]
test edx, edx
je 0x1000bbe3
mov ecx, dword [edi + 0x8c]
mov ebx, dword [edi + 0x88]
cmp ecx, ebx
jae 0x1000bc2b
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.1001d110
mov ecx, dword [edi + 0x78]
mov edx, esi
add dword [edi + 0x8c], ebx
add dword [edi + 0x74], ebx
push ebx
call fcn.1000b5f0
add esp, 0x10
mov dword [edi + 0x78], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x1000bc24
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000bc2b
mov esi, dword [ebp - 4]
mov edx, ebx
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
call fcn.1000b5f0
add esp, 4
mov dword [edi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000cda0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c190
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
cmp dword [esi + 4], 0
je 0x1000cde0
mov dword [esi + 4], 0
jmp 0x1000cdf2
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
jb 0x1000cdeb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, dword [esi]
test ebx, ebx
je 0x1000ce98
cmp dword [ebx], 2
je 0x1000ce10
mov dword [0x10053eb8], 0x80000
jmp 0x1000ce98
mov edi, dword [ebx + 4]
mov dword [ebp - 0x14], 0
cmp byte [edi + 0x2c], 0
jne 0x1000ce2a
mov ecx, edi
call fcn.1000c920
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x20]
mov byte [edi + 0x2c], 1
test eax, eax
je 0x1000ce42
cmp dword [edi + 0xc], 0
je 0x1000ce42
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [edi + 0xc]
mov dword [edi + 0x20], 0
test eax, eax
je 0x1000ce57
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 4]
mov dword [edi + 0xc], 0
test eax, eax
je 0x1000ce72
cmp byte [edi + 8], 0
je 0x1000ce72
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
push ecx
mov ecx, edi
mov dword [edi + 4], 0
mov byte [edi + 8], 0
mov dword [0x10053eb8], eax
call fcn.1000cc60
push 8
push ebx
call fcn.1001a1f6
add esp, 8
mov ecx, dword [esi + 0x1c]
cmp ecx, 0x10
jb 0x1000cec8
mov eax, dword [esi + 8]
inc ecx
cmp ecx, 0x1000
jb 0x1000cebe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000cef6
mov eax, edx
push ecx
push eax
call fcn.1001a1f6
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0xf
mov byte [esi + 8], 0
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10020517
int3

Function at 0x1000df60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c279
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0x1004cc18
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
call fcn.10001d00
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0xf
mov byte [edi + 0x38], 0
mov byte [ebp - 4], 2
lea esi, [edi + 0x50]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x38
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1001a1c6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push ecx
call fcn.10008e60
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000e190
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
mov dword [ebp - 0x11], 0x524a6124
mov dl, 0x24
mov dword [ebp - 0xd], 0x4a4b564d
mov dword [ebp - 9], 0x504a4149
xor eax, eax
mov byte [ebp - 5], 0
xor byte [ebp + eax - 0x10], dl
inc eax
cmp eax, 0xb
jae 0x1000e1c5
mov dl, byte [ebp - 0x11]
jmp 0x1000e1b6
lea eax, [ebp - 4]
mov byte [ebp - 5], 0
push eax
push 0x20006
push 0
lea eax, [ebp - 0x10]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000e252
mov edx, dword [ebp - 4]
test edx, edx
je 0x1000e252
cmp dword [esi + 0x14], 0x10
push edi
mov edi, dword [esi + 0x10]
jb 0x1000e1fa
mov esi, dword [esi]
movaps xmm0, xmmword [0x1004db00]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x796a5a75
mov dword [ebp - 8], 0x7b7770
movsx eax, byte [ebp - 0x1c]
and eax, 0x8000000f
jns 0x1000e225
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x16
jb 0x1000e215
push edi
push esi
push 1
push 0
lea eax, [ebp - 0x1b]
mov byte [ebp - 5], 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
test eax, eax
jne 0x1000e252
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10013190
Capabilities:
Create thread
Get common file path
Link many functions at runtime
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x208
cmp eax, 1
jne 0x10013379
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1002878f
add esp, 4
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push str.version.dll
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str._s_s
push eax
call fcn.10017260
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10054370], eax
test eax, eax
jne 0x10013205
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1004d5e0
push eax
call esi
push 0x1004d5f4
push dword [0x10054370]
mov dword [0x10053ec0], eax
call esi
push 0x1004d610
push dword [0x10054370]
mov dword [0x10053ec4], eax
call esi
push 0x1004d628
push dword [0x10054370]
mov dword [0x10053ec8], eax
call esi
push 0x1004d640
push dword [0x10054370]
mov dword [0x10053ecc], eax
call esi
push 0x1004d658
push dword [0x10054370]
mov dword [0x10053ed0], eax
call esi
push 0x1004d674
push dword [0x10054370]
mov dword [0x10053ed4], eax
call esi
push 0x1004d690
push dword [0x10054370]
mov dword [0x10053ed8], eax
call esi
push 0x1004d6a8
push dword [0x10054370]
mov dword [0x10053edc], eax
call esi
push 0x1004d6bc
push dword [0x10054370]
mov dword [0x10053ee0], eax
call esi
push 0x1004d6cc
push dword [0x10054370]
mov dword [0x10053ee4], eax
call esi
push 0x1004d6dc
push dword [0x10054370]
mov dword [0x10053ee8], eax
call esi
push 0x1004d6ec
push dword [0x10054370]
mov dword [0x10053eec], eax
call esi
push 0x1004d6fc
push dword [0x10054370]
mov dword [0x10053ef0], eax
call esi
push 0x1004d710
push dword [0x10054370]
mov dword [0x10053ef4], eax
call esi
push 0x1004d724
push dword [0x10054370]
mov dword [0x10053ef8], eax
call esi
push 0x1004d734
push dword [0x10054370]
mov dword [0x10053efc], eax
call esi
mov dword [0x10053f00], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x10054390
push 0
push dword [ebp + 8]
mov dword [0x10054388], eax
push 0x100116e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1005438c], eax
pop esi
test eax, eax
je 0x100133c6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 2
jne 0x100133b2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x10054390]
jne 0x100133c6
push dword [0x10054388]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x100133c6
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x100133c6
mov eax, dword [0x10054370]
test eax, eax
je 0x100133c6
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002f10e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002ef8b
Function at 0x1003411e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10033dc0
Function at 0x403fa5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x403fec
cmp ebx, 0x20
je 0x403fec
cmp ebx, 0xffffffe0
je 0x403fec
jne 0x403ff5
add eax, 1
cmp esi, eax
je 0x404002
jne 0x403fd1
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x404006
jne 0x403fcd
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x40401a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x4040db
test ecx, ecx
je 0x4040db
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x4040db
test ebx, ebx
je 0x4040db
mov ebx, eax
add ebx, edx
je 0x4040db
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x4040db
cmp dword [edx + eax + 0x14], 0
je 0x4040db
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x4040db
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4040cb
test dl, dl
je 0x4040c7
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4040cb
add edi, 2
add esi, 2
test dl, dl
jne 0x4040ab
xor eax, eax
jmp 0x4040d0
sbb eax, eax
or eax, 1
test eax, eax
je 0x4040e7
inc ebp
cmp ebp, dword [esp + 4]
jb 0x404098
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x404ef7
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x404f25
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x404f1c
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x404f14
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x404f46
mov esp, ebp
pop ebp
ret

Function at 0x404f4a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x404fb6
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x404fe3
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x404fd2
xor ecx, eax
xor edx, ebx
dec edi
jne 0x404fc3
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x405009
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x404faa
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x405035
mov esp, ebp
pop ebp
ret 0xc