joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4ee3
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xcf24ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
push 0xffffffffffffffff
lea ecx, [ecx + 4]
call fcn.004a5b9b
mov edx, dword [ebp - 0x14]
mov dword [edx], 0xf448b4
xor eax, eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [ebp - 4], 3
xor eax, eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x40], eax
mov dword [ebp - 4], 4
xor eax, eax
mov dword [edx + 0x44], eax
mov dword [edx + 0x48], eax
mov dword [edx + 0x4c], eax
mov dword [ebp - 4], 5
xor eax, eax
mov dword [edx + 0x50], eax
mov dword [edx + 0x54], eax
mov dword [edx + 0x58], eax
mov dword [ebp - 4], 6
mov ecx, edx
mov dword [ecx + 0x5c], 0
call fcn.004a5043
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4a502d
test ebx, ebx
jl 0x4a4fd1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
push 0x104
lea ecx, [eax + 0x60]
push edx
push ecx
call 0xd5b347
add esp, 0xc
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4a4ff2
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [eax + 0x164]
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4a4fe4
push ebx
push 0x92
push 0xd272dc
push 0xd26b80
push 6
call fcn.004a69b3
add esp, 0x14
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov dword [edx], ebx
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0xd272ec
push 1
call fcn.004a69b3
add esp, 8
mov ebx, 0x80070057
jmp 0x4a4fd1
Function at 0x440063
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x440087
cmp dword [edi + 0x54], 0
jne 0x440087
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00438e9f
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call main
push ebx
mov esi, eax
call dword [sym.imp.kernel32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x445157
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x497d50]
jne 0x445161
repz ret
jmp fcn.0044cc7d

Function at 0x457a34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x457a43
pop dword [ebp - 0x30]
mov eax, 0x2de8e28
sub eax, 0x29913e5
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x42b8b
push 0
mov eax, 0x867a9c18
add eax, 0x79cb877c
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x62784899
add ecx, 0x9d87f469
xor edi, edi
add edi, eax
mov edx, 0x4ff800
add edx, dword [ebp - 0x30]
mov esi, 0xecd37c86
mov ebx, dword [edx]
sub dword [ebp - 0x20], edi
xor ebx, esi
add dword [ebp - 0x20], 0xf8fd8b52
mov dword [edi], ebx
xor dword [ebp - 0x14], esi
add edi, 4
add edx, 0xcb6475ca
sub edx, 0xcb6475c6
loop 0x457a98
add eax, 0x37809534
add eax, 0xc88051a7
xor ebx, ebx
add ebx, eax
add eax, 0xa87531e0
sub eax, 0xa87531db
mov ecx, 0x64a0d27b
sub ecx, 0x6460d27b
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xb990de5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3a0b54e2
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x7c2b60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x27b000]
push edi
or ebp, 0xffffffff
jmp 0x7c2b82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7c2b89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7c2b78
mov eax, 1
add ebx, ebx
jne 0x7c2b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7c2bac
jne 0x7c2bcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7c2bcb
dec eax
add ebx, ebx
jne 0x7c2bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7c2b90
add ebx, ebx
jne 0x7c2bc7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7c2c1d
xor ecx, ecx
sub eax, 3
jb 0x7c2be3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7c2c52
sar eax, 1
mov ebp, eax
jmp 0x7c2bee
add ebx, ebx
jne 0x7c2bee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7c2bbc
inc ecx
add ebx, ebx
jne 0x7c2bfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7c2bbc
add ebx, ebx
jne 0x7c2c09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7c2bfe
jne 0x7c2c1a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7c2bfe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7c2c3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7c2c2e
jmp 0x7c2b7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7c2c3c
add edi, ecx
jmp 0x7c2b7e
pop esi
mov edi, esi
mov ecx, 0x9ff0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7c2c5a
cmp byte [edi], 0x38
jne 0x7c2c5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7c2c5f
lea edi, [esi + 0x3be000]
mov eax, dword [edi]
or eax, eax
je 0x7c2cce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3f5238]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3f5370]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7c2c8c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3f5378]
or eax, eax
je 0x7c2cc8
mov dword [ebx], eax
add ebx, 4
jmp 0x7c2ca9
call dword [esi + 0x3f5374]
mov ebp, dword [esi + 0x3f537c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7c2d02
sub esp, 0xffffff80
jmp 0x60372c
Function at 0x40997c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a68
push ebx
push 0x409a74
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099fc
mov al, 0x62
call fcn.00409620
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409950
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a05
call fcn.00409950
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a56
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b08
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bbc
jmp 0x409bb1
cmp dword [esi + 0x10], 0x1000
jne 0x409b9d
test byte [esi + 0x15], 1
jne 0x409b9d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b5c
cmp eax, 2
je 0x409b5c
cmp eax, 0x10
je 0x409b5c
cmp eax, 0x20
jne 0x409b71
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b71
mov bl, 1
xor ebp, ebp
jmp 0x409b82
mov eax, dword [esi]
add eax, ebp
call fcn.00409b00
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b75
test bl, bl
je 0x409b9d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bbc
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b34
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10019400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1001940f
pop dword [ebp - 0x2c]
mov eax, 0x277890b1
add eax, 0xe889035e
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x346778d5
sub dword [ebp - 0x3c], 0xe615338a
mov dword [ebp - 0x38], 0xdb54beac
sub dword [ebp - 0x38], 0xa9217267
mov dword [ebp - 0x34], 0xcf9409c5
add dword [ebp - 0x34], 0x7cb83a69
mov dword [ebp - 0x30], 0x57e52394
sub dword [ebp - 0x30], 0x57e52394
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x7ce58210
add dword [ebp - 0x3c], 0xf78ce746
mov dword [ebp - 0x38], 0x6a9fa283
add dword [ebp - 0x38], 0xd6ccbef2
mov dword [ebp - 0x34], 0x3f5817cc
sub dword [ebp - 0x34], 0xdbe8ab60
mov dword [ebp - 0x30], 0xe04401df
add dword [ebp - 0x30], 0x1fbbfe21
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x97e50096
sub eax, 0x87e10066
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x4a10a
push 0
call eax
mov ecx, 0x4a6dede3
add ecx, 0xb59266af
xor ebx, ebx
add ebx, eax
mov edi, 0x6390bbca
add edi, 0xac74b236
add edi, dword [ebp - 0x2c]
mov edx, 0xd6df5e4f
add edx, 0x5318f6c5
xor dword [ebp - 0x14], 0xa55d8630
mov esi, dword [edi]
sub dword [ebp - 0x20], 0x9d2c31f8
sub esi, edx
add dword [ebp - 0x20], ebx
mov dword [ebx], esi
xor dword [ebp - 0x14], 0x9e8a6c2a
add ebx, 0x4087c8b8
sub ebx, 0x4087c8b4
add edi, 0x172ea72d
add edi, 0xe8d158d7
loop 0x1001952e
add eax, 0x1451b
mov ebx, eax
add eax, 0x69f43d75
sub eax, 0x69f43d70
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10031820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1004f37c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10031850
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10031880
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10031880
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1003197a
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100318a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100318dd
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x1003197a
cmp eax, 1
jle 0x1003193b
cmp eax, 3
jne 0x1003197a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10019400
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031959
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003197a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1003197a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038620
mov esp, ebp
pop ebp
ret 4
Function at 0x10036f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ecf8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004f37c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1004f338]
cmp eax, 0xffffffff
jne 0x10036fb6
xor ebx, ebx
jmp 0x10036fbf
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10036fff
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003703e
test esi, esi
jne 0x10037042
push 0x10035760
push 0x10050e58
call fcn.10019400
mov eax, dword [0x1004f338]
add esp, 8
cmp eax, 0xffffffff
je 0x10036fff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003702c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003702c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10037084
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003706d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10037042
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10036fd0
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100370a9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100370a9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10019400
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x10037090
jmp 0x10036fd0

Function at 0x100370d0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x10037130
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x100370fa
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi]
push edi
add eax, 4
lock inc dword [eax]
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x10037118
cmp eax, 0xffffffff
je 0x10037118
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x40cb51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40cb60
pop dword [ebp - 0x44]
mov eax, 0x40cb60
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x42429
push 0
mov eax, 0x60d39c83
add eax, 0x9f6f25a1
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x4a9a
xor edi, edi
add edi, eax
mov edx, 0x440800
add edx, dword [ebp - 0x44]
mov esi, 0xf63e27da
add dword [ebp - 0x1c], ecx
mov ebx, dword [edx]
xor dword [ebp - 0x1c], 0x16b73022
xor ebx, esi
mov dword [edi], ebx
add edi, 0x812a5461
add edi, 0x7ed5aba3
add edx, 4
loop 0x40cbaa
add eax, 0x559f85e0
sub eax, 0x559e68a5
mov ebx, eax
add eax, 0x6c228915
sub eax, 0x6c228910
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40fb5b
Capabilities:
Get common file path
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
call main
lea eax, [ebp - 0xc]
push eax
call main
xor edi, edi
pop ecx
pop ecx
mov byte [ebp - 0x210], 0
cmp eax, edi
je 0x40fba8
push eax
call main
pop ecx
cmp eax, edi
je 0x40fba8
push eax
lea eax, [ebp - 0x210]
push str._n_s::
push eax
call main
add esp, 0xc
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x110]
push eax
push str.TMPDIR
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.kernel32.dll_lstrcatA]
test eax, eax
lea eax, [ebp - 0x110]
jne 0x40fbda
push eax
push ebx
call dword [sym.imp.kernel32.dll_GetTempPathA]
jmp 0x40fbe2
push 0x431a28
push eax
call esi
push str.jusched.log
lea eax, [ebp - 0x110]
push eax
call esi
push edi
push 0x80
push 4
push edi
push 2
push 0x40000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40fc5d
push 2
push edi
push edi
push ebx
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov esi, dword [sym.imp.kernel32.dll_lstrlenA]
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x210]
push eax
call esi
mov edi, dword [sym.imp.kernel32.dll_WriteFile]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call esi
push eax
push dword [ebp + 8]
push ebx
call edi
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40feb9
Capabilities:
Check os version

Disassembly:
push 0xa4
push 0x437020
call fcn.00413470
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xb4], 0x94
push 0x90
push esi
lea eax, [ebp - 0xb0]
push eax
call fcn.00412420
add esp, 0xc
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 2
jne 0x40ff43
cmp dword [ebp - 0xb0], 5
jb 0x40ff43
mov dword [ebp - 4], esi
push 0x431b4c
call main
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x40ff3a
push 0x431b58
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x40ff3a
mov dword [ebp - 0x20], 1
or dword [ebp - 4], 0xffffffff
call fcn.0040ff4e
mov eax, dword [ebp - 0x20]
call fcn.004134ab
ret
Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll__mbscat_s_l
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret

Function at 0x7816707b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x7816708a
pop dword [ebp - 0x24]
mov eax, 0x50ea8ac4
add eax, 0x272be5c6
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x44146
push 0
mov eax, 0xeede5a79
add eax, 0x893ae647
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x8e45dfb0
sub ecx, 0x8e459081
xor edi, edi
add edi, eax
mov edx, 0x4d44b905
add edx, 0x2ad7f6fb
add edx, dword [ebp - 0x24]
mov esi, 0xbf517285
sub esi, 0x69608bce
mov dword [ebp - 0x1c], 0x267ee1f0
mov ebx, dword [edx]
xor dword [ebp - 0x18], ecx
xor ebx, esi
add dword [ebp - 0xc], edx
mov dword [edi], ebx
xor dword [ebp - 0x18], 0x9ff66f9e
add edi, 4
add edx, 0xb0e42e48
sub edx, 0xb0e42e44
loop 0x781670eb
add eax, 0x12f8f
mov ebx, eax
add eax, 0x1344f4a8
add eax, 0xecbb0b5d
mov ecx, 0x9e01c232
sub ecx, 0x25eec232
add ecx, dword [ebp - 0x24]
call ebx
leave
ret