joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401230
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x44], 0
xor ecx, ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
push 0x24
lea edx, [ebp - 0x44]
push edx
call section..text
add esp, 8
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x40], 0x1000
jb 0x4012ad
call fcn.00401190
mov dword [ebp - 8], eax
cmp dword [ebp - 0x30], 0
je 0x4012e1
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
call dword [ebp - 8]
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
and edx, 0
je 0x4012dd
mov dword [ebp - 8], 0
jmp 0x4012df
jmp 0x4012e1
jmp 0x4012ad
mov esp, ebp
pop ebp
ret

Function at 0x4012f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop ebp
ret

Function at 0x4014d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
and eax, 0xfffff000
mov dword [ebp - 0xc], eax
mov byte [ebp - 5], 0
push 1
push 1
push 0
push 0x4030cc
call dword [sym.imp.USER32.dll_OpenDesktopW]
test eax, eax
je 0x4014ff
or eax, 0xffffffff
jmp 0x40156c
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x40155c
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x3c], 0xff
jle 0x401520
jmp 0x4014ff
push 1
push 1
push 0
push str.SEVMTE8
call dword [sym.imp.USER32.dll_OpenDesktopW]
test eax, eax
je 0x40153a
or eax, 0xffffffff
jmp 0x40156c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x401553
jmp 0x401569
mov dl, byte [ebp - 5]
add dl, 1
mov byte [ebp - 5], dl
mov eax, dword [ebp - 0xc]
sub eax, 0x1000
mov dword [ebp - 0xc], eax
jmp 0x4014ff
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x401eec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x404e30]
jne 0x401ef6
repz ret
jmp fcn.0040219d
Function at 0x40266d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor eax, eax
xor ebx, ebx
xor ecx, ecx
xor edx, edx
inc bl
mov dl, byte [edi + ebx]
add al, dl
mov cl, byte [edi + eax]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
add cl, dl
mov cl, byte [edi + ecx]
xor byte [esi], cl
inc esi
dec dword [ebp + 0x10]
jne 0x40267e
leave
ret 0xc

Function at 0x40269f
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov dword [esp + 0x1c], 0
lodsd eax, dword [esi]
cmp eax, 0x32335041
jne 0x402751
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040272e
jae 0x4026b9
xor ecx, ecx
call fcn.0040272e
jae 0x4026e8
xor eax, eax
call fcn.0040272e
jae 0x4026f8
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040272e
adc al, al
jae 0x4026da
jne 0x402724
stosb byte es:[edi], al
jmp 0x4026bc
call fcn.0040273a
sub ecx, ebx
jne 0x402701
call fcn.00402738
jmp 0x402720
lodsb al, byte [esi]
shr eax, 1
je 0x40274a
adc ecx, ecx
jmp 0x40271d
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00402738
cmp eax, 0x7d00
jae 0x40271d
cmp ah, 5
jae 0x40271e
cmp eax, 0x7f
ja 0x40271f
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4026bc
sub edi, dword [esp]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x4031eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x704
push edi
push 0
push 1
push 2
call dword [ebx + fcn.00403f26]
test eax, eax
js 0x4033a6
mov dword [ebp - 0x704], eax
push 0x10
push dword [ebp + 8]
push dword [ebp - 0x704]
call dword [ebx + fcn.00403f35]
test eax, eax
js 0x403396
push 5
push eax
lea eax, [ebp - 0x300]
push eax
xchg dword [esp + 4], eax
push 5
call 0x403242
cmp edi, ebp
clc
pushal
dec ecx
call fcn.00403a14
push eax
lea eax, [ebp - 0x700]
xchg dword [esp], eax
call fcn.00403cb0
mov edi, eax
lea esi, [ebx + 0x406ed0]
push esi
call dword [ebx + fcn.00401572]
push eax
push esi
push edi
call fcn.00403cb0
push 0x11
push eax
lea eax, [ebp - 0x200]
push eax
xchg dword [esp + 4], eax
push 0x11
call 0x403293
dec ecx
call 0x8f799387
lcall 0x67c, 0xa1ad591a
rcr edi, cl
push cs
dec ecx
call fcn.00403a14
push eax
call fcn.00403cb0
mov edi, eax
lea esi, [ebx + 0x403f77]
push esi
call dword [ebx + fcn.00401572]
push eax
push esi
push edi
call fcn.00403cb0
push 0x12
push eax
lea eax, [ebp - 0x100]
push eax
xchg dword [esp + 4], eax
push 0x12
call fcn.004032dc
stosb byte es:[edi], al
call 0xcf143a2c
pop edx
sbb eax, 0x751e78d
invalid
mov esi, eax
push dword [ebp - 0x704]
call dword [ebx + fcn.00403f5f]
mov eax, esi
pop edi
leave
ret 0xc
Function at 0x403242
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x704
push edi
push 0
push 1
push 2
call dword [ebx + fcn.00403f26]
test eax, eax
js 0x4033a6
mov dword [ebp - 0x704], eax
push 0x10
push dword [ebp + 8]
push dword [ebp - 0x704]
call dword [ebx + fcn.00403f35]
test eax, eax
js 0x403396
push 5
push eax
lea eax, [ebp - 0x300]
push eax
xchg dword [esp + 4], eax
push 5
call 0x403242
cmp edi, ebp
clc
pushal
dec ecx
call fcn.00403a14
push eax
lea eax, [ebp - 0x700]
xchg dword [esp], eax
call fcn.00403cb0
mov edi, eax
lea esi, [ebx + 0x406ed0]
push esi
call dword [ebx + fcn.00401572]
push eax
push esi
push edi
call fcn.00403cb0
push 0x11
push eax
lea eax, [ebp - 0x200]
push eax
xchg dword [esp + 4], eax
push 0x11
call 0x403293
dec ecx
call 0x8f799387
lcall 0x67c, 0xa1ad591a
rcr edi, cl
push cs
dec ecx
call fcn.00403a14
push eax
call fcn.00403cb0
mov edi, eax
lea esi, [ebx + 0x403f77]
push esi
call dword [ebx + fcn.00401572]
push eax
push esi
push edi
call fcn.00403cb0
push 0x12
push eax
lea eax, [ebp - 0x100]
push eax
xchg dword [esp + 4], eax
push 0x12
call fcn.004032dc
stosb byte es:[edi], al
call 0xcf143a2c
pop edx
sbb eax, 0x751e78d
invalid
mov esi, eax
push dword [ebp - 0x704]
call dword [ebx + fcn.00403f5f]
mov eax, esi
pop edi
leave
ret 0xc

Function at 0x403293
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x704
push edi
push 0
push 1
push 2
call dword [ebx + fcn.00403f26]
test eax, eax
js 0x4033a6
mov dword [ebp - 0x704], eax
push 0x10
push dword [ebp + 8]
push dword [ebp - 0x704]
call dword [ebx + fcn.00403f35]
test eax, eax
js 0x403396
push 5
push eax
lea eax, [ebp - 0x300]
push eax
xchg dword [esp + 4], eax
push 5
call 0x403242
cmp edi, ebp
clc
pushal
dec ecx
call fcn.00403a14
push eax
lea eax, [ebp - 0x700]
xchg dword [esp], eax
call fcn.00403cb0
mov edi, eax
lea esi, [ebx + 0x406ed0]
push esi
call dword [ebx + fcn.00401572]
push eax
push esi
push edi
call fcn.00403cb0
push 0x11
push eax
lea eax, [ebp - 0x200]
push eax
xchg dword [esp + 4], eax
push 0x11
call 0x403293
dec ecx
call 0x8f799387
lcall 0x67c, 0xa1ad591a
rcr edi, cl
push cs
dec ecx
call fcn.00403a14
push eax
call fcn.00403cb0
mov edi, eax
lea esi, [ebx + 0x403f77]
push esi
call dword [ebx + fcn.00401572]
push eax
push esi
push edi
call fcn.00403cb0
push 0x12
push eax
lea eax, [ebp - 0x100]
push eax
xchg dword [esp + 4], eax
push 0x12
call fcn.004032dc
stosb byte es:[edi], al
call 0xcf143a2c
pop edx
sbb eax, 0x751e78d
invalid
mov esi, eax
push dword [ebp - 0x704]
call dword [ebx + fcn.00403f5f]
mov eax, esi
pop edi
leave
ret 0xc
Function at 0x4032dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00403a14
push eax
call fcn.00403cb0
mov ecx, dword [ebp + 0x10]
add ecx, 0x18
push eax
push ecx
call fcn.00403919
mov edi, eax
mov eax, 0xa0d0a0d
stosd dword es:[edi], eax
mov esi, edi
xor eax, eax
stosd dword es:[edi], eax
rdtsc
mov eax, edx
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x404692]
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x40468e]
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x406f00]
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x406f04]
stosd dword es:[edi], eax
lea eax, [ebp - 0x700]
sub edi, eax
rdtsc
push eax
push 0x18
push esi
call fcn.004039fc
push 0
push edi
push eax
lea eax, [ebp - 0x700]
xchg dword [esp], eax
push dword [ebp - 0x704]
call dword [ebx + fcn.00403f45]
test eax, eax
js 0x403396
mov esi, dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x704]
call dword [ebx + fcn.00403f45]
test eax, eax
js 0x403396
add esi, eax
sub dword [ebp + 0x10], eax
jne 0x403355
mov edi, 0x1400000
mov esi, dword [ebp + 0xc]
push 0
push edi
push esi
push dword [ebp - 0x704]
call dword [ebx + fcn.00403f52]
test eax, eax
js 0x403396
add esi, eax
test eax, eax
jne 0x40337a
mov eax, esi

Function at 0x4039fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
xor byte [edx], al
ror eax, 8
inc edx
loop 0x403a08
leave
ret 0xc

Function at 0x403a14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov edx, 0x34aba069
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
ror edx, 8
loop 0x403a26
popal
leave
ret 0xc

Function at 0x404497
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
cmp dword [ebx + fcn.0040526c], 0
jne 0x404566
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov edi, dword [edi + 0x1c]
mov esi, edi
mov esi, dword [esi]
cmp esi, edi
je 0x404566
mov ecx, dword [esi + 0x10]
cmp ecx, 0xa00000
jb 0x4044bc
mov eax, dword [esi + 8]
push eax
lea eax, [ebp - 0x200]
push eax
xchg dword [esp + 4], eax
push 0x30
call fcn.00404517
cmp eax, ebp
invalid
leave
ret
Function at 0x10002b40
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x1000e2e3
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x1001509c]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [0x1001509c]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
mov ecx, esi
mov dword [esp + 8], esi
mov dword [esp + 4], 0
call dword [0x10010284]
push 0x104
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x228], 0
push edi
mov dword [esp + 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10002bd5
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
jmp 0x10002bda
push 0x10011510
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
mov eax, esi
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1000d2b5
add esp, 0x220
ret

Function at 0x10003a00
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
cmp dword [0x10015740], 0
jne 0x10003a14
xor eax, eax
add esp, 0x1c
ret 4
cmp dword [0x10015680], 0
jne 0x10003a0c
mov eax, dword [esp + 0x20]
push 0
push 0
push 0x10015608
push 0x10003ad0
push 0
push 0
mov dword [0x10015670], eax
mov dword [0x10015674], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10015680], eax
test eax, eax
je 0x10003ac5
push esi
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0x4ff
push 0xffffffffffffffff
push 0
push 0x10015680
push 1
call esi
test eax, eax
je 0x10003aae
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
lea esp, [esp]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call edi
lea edx, [esp + 0xc]
push edx
call ebx
push 0x4ff
push 0xffffffffffffffff
push 0
push 0x10015680
push 1
call esi
test eax, eax
jne 0x10003a80
pop edi
pop ebx
mov eax, dword [0x10015680]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10015680], 0
pop esi
mov eax, dword [0x10015674]
add esp, 0x1c
ret 4
Function at 0x100072b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
idiv dword [edi - 0x39c18]
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.10006ed0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
cmpsb byte [esi], byte es:[edi]
inc ecx
call fcn.10006f1b
push eax
push esi
push dword [ebp + 8]
call fcn.10006ed0
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10006f1b
push eax
push esi
push dword [ebp + 8]
call fcn.10006ed0
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10006f0b
sti
js 0x100073da
cli
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
Function at 0x10007310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
idiv dword [edi - 0x39c18]
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.10006ed0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
cmpsb byte [esi], byte es:[edi]
inc ecx
call fcn.10006f1b
push eax
push esi
push dword [ebp + 8]
call fcn.10006ed0
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10006f1b
push eax
push esi
push dword [ebp + 8]
call fcn.10006ed0
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10006f0b
sti
js 0x100073da
cli
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
Function at 0x100073a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.10006f0b
mov byte [ebx - 2], ch
aas
lea eax, [ebp - 0x84]
push eax
call fcn.10006f1b
push eax
push esi
push dword [ebp + 8]
call fcn.10006ed0
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x10007704
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.10006e7c
add esp, 0xc
cmp word [edi + 6], bx
cmp dword [edi + 6], ebx
mov dword [ebp + 0xc], ebx
jbe 0x1000747b
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.10006e7c
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x10007448
call fcn.10006f0b
dec ebp
mov ebx, 0x7e8b3ccd
cmp al, 3
dec byte [ecx - 0x8743]
dec dword [ebx + 0x8087]
add byte [ebx], bh
ret
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10007650
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100075e2
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10007600
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
xchg esp, eax
invalid
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1000765e
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10007645
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000764e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10007658
adc byte [ebp + eax + 3], dh
enter 0x980, 4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000763a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100075c4
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100076ab
dec eax
je 0x100076a2
sub eax, 3
je 0x10007699
mov dword [ebp - 4], 0x40
jmp 0x100076c8
mov dword [ebp - 4], 4
jmp 0x100076ae
mov dword [ebp - 4], 0x20
jmp 0x100076ae
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100076fa
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
or byte [edi + 0x3b], al
mov ebp, 0xffffff74
jbe 0x1000767a
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10006f0b
daa
mov dh, 0xdc
push esi
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x10007706
push 0x8000
push ebx
push esi
call dword [ebp - 8]
Function at 0x1000a090
Capabilities:
Check if file exists
Create thread

Disassembly:
sub esp, 0x20
push edi
mov edi, eax
test edi, edi
je 0x1000a0bc
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000a0a0
sub eax, edx
sar eax, 1
je 0x1000a0bc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000a0c5
xor eax, eax
pop edi
add esp, 0x20
ret 4
push ebx
mov ebx, dword [esp + 0x2c]
cmp dword [ebx + 0x14], 0
push esi
lea esi, [ebx + 0x14]
je 0x1000a0df
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0x20
ret 4
push edi
lea ecx, [ebx + 0xc]
mov dword [ebx + 0x10], 0
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
push 0
push 0
push ebx
push 0x1000a070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x1000a16c
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0x4ff
push 0xffffffffffffffff
push 0
push esi
push 1
call edi
test eax, eax
je 0x1000a15d
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageW]
nop
push 1
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
call ebp
push 0x4ff
push 0xffffffffffffffff
push 0
push esi
push 1
call edi
test eax, eax
jne 0x1000a130
mov ebx, dword [esp + 0x34]
pop ebp
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov eax, dword [ebx + 0x10]
pop esi
pop ebx
pop edi
add esp, 0x20
ret 4

Function at 0x1000a800
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1000ee09
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1001509c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, edx
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000a830
sub eax, edx
sar eax, 1
mov edi, eax
je 0x1000a893
push esi
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x3c], 0
call 0x10007550
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea esi, [esi + edi*2 + 2]
mov eax, esi
lea edx, [eax + 2]
jmp 0x1000a880
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000a880
sub eax, edx
sar eax, 1
mov edi, eax
jne 0x1000a843
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x40a518
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push 0x20
mov eax, 0x5e170b
call fcn.0059bbd7
mov edi, ecx
cmp dword [0x6deccc], 0
mov ebx, dword [ebp + 8]
je 0x40a5f0
call fcn.0040a5f8
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
push 0x200
call fcn.0040b022
lea esi, [edi + 4]
push esi
call fcn.005c2f90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
mov esi, 0x633384
push esi
call fcn.005c2f90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
push ebx
call fcn.005c2f90
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040b220
mov esi, 0x633298
push esi
call fcn.005c2f90
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.0040b220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [edi], 0xffffffff
je 0x40a5e8
and dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
add eax, eax
push eax
push ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x28]
call fcn.0040b67e
call fcn.0059bb81
ret 4