joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x128
mov eax, dword [0x1008179c]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x138]
lea ecx, [esp + 0xc]
push str.NSpeedUpTab
mov word [esp + 0x2a], 0x4552
mov word [esp + 0x27], 0x5754
mov word [esp + 0x24], 0x4f53
mov byte [esp + 0x26], 0x46
mov word [esp + 0x2c], 0x5c
mov byte [esp + 0x29], 0x41
call fcn.10011990
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10011c10
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push 0
push dword [eax]
push ShowHideMenuCtl
call fcn.100115d0
mov edx, dword [esp + 0x30]
or esi, 0xffffffff
mov ebx, eax
add esp, 0x20
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10012eed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x10012f06
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
jne 0x10012ffb
push 0x104
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.10015bf0
lea eax, [esp + 0x24]
mov dword [esp + 0x2e], 0x736c61
push eax
lea eax, [esp + 0x3c]
mov word [esp + 0x30], 0x7668
push eax
push ebx
push ebx
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x34]
call fcn.100116a0
add esp, 0x24
test eax, eax
jne 0x10012fef
cmp dword [esp + 0x18], eax
jbe 0x10012fef
lea ecx, [esp + 0x10]
call fcn.10011a90
push edi
lea eax, [esp + 0x14]
push 0x10050cf4
push eax
call fcn.10011fc0
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.10011a90
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push 0x1004fecc
push eax
call fcn.10011fc0
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x10012fdd
mov esi, dword [esp + 0xc]
cmp dword [esi - 0xc], ebx
jl 0x10012fdd
push eax
push esi
call fcn.1002a0f5
add esp, 8
test eax, eax
je 0x10012fdd
sub eax, esi
js 0x10012fdd
push dword [esp + 0x14]
call fcn.10011530
add esp, 4
lea ecx, [esp + 0xc]
call fcn.10011ad0
lea ecx, [esp + 0x10]
call fcn.10011ad0
mov eax, edi
jmp 0x10013002
lea ecx, [esp + 0xc]
call fcn.10011ad0
lea ecx, [esp + 0x10]
call fcn.10011ad0
push dword [esp + 0x14]
call fcn.10011530
add esp, 4
push edi
call dword [0x10082598]
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001435b
add esp, 0x128
ret 4
Function at 0x10013020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x128
mov eax, dword [0x1008179c]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x138]
lea ecx, [esp + 0xc]
push str.NSpeedUpTab
mov dword [esp + 0x25], 0x5754464f
mov byte [esp + 0x24], 0x53
mov word [esp + 0x2c], 0x5c
mov word [esp + 0x29], 0x5241
mov byte [esp + 0x2b], 0x45
call fcn.10011990
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10011c10
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push 0
push dword [eax]
push ShowHideMenuCtl
call fcn.100115d0
mov edx, dword [esp + 0x30]
or esi, 0xffffffff
add esp, 0x20
mov ebx, eax
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100130b7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x100130d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
jne 0x100131ce
push 0x104
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.10015bf0
lea eax, [esp + 0x24]
mov word [esp + 0x2f], 0x736c
push eax
lea eax, [esp + 0x3c]
mov byte [esp + 0x35], bl
push eax
push ebx
push ebx
lea eax, [esp + 0x3c]
mov word [esp + 0x3c], 0x7668
push eax
push dword [esp + 0x34]
mov byte [esp + 0x46], 0x61
call fcn.100116a0
add esp, 0x24
test eax, eax
jne 0x100131c2
cmp dword [esp + 0x18], eax
jbe 0x100131c2
lea ecx, [esp + 0x10]
call fcn.10011a90
push edi
lea eax, [esp + 0x14]
push 0x10050cf4
push eax
call fcn.10011fc0
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.10011a90
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x10]
push 0x1004fecc
push eax
call fcn.10011fc0
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x100131b0
mov esi, dword [esp + 0xc]
cmp dword [esi - 0xc], ebx
jl 0x100131b0
push eax
push esi
call fcn.1002a0f5
add esp, 8
test eax, eax
je 0x100131b0
sub eax, esi
js 0x100131b0
push dword [esp + 0x14]
call fcn.10011530
add esp, 4
lea ecx, [esp + 0xc]
call fcn.10011ad0
lea ecx, [esp + 0x10]
call fcn.10011ad0
lea eax, [ebx + 1]
jmp 0x100131d5
lea ecx, [esp + 0xc]
call fcn.10011ad0
lea ecx, [esp + 0x10]
call fcn.10011ad0
push dword [esp + 0x14]
call fcn.10011530
add esp, 4
push edi
call dword [0x10082518]
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001435b
add esp, 0x128
ret 4
Function at 0x100131f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x128
mov eax, dword [0x1008179c]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
mov ebp, dword [esp + 0x138]
lea ecx, [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x13c]
push str.NSpeedUpTab
mov dword [esp + 0x2b], 0x52415754
mov word [esp + 0x29], 0x464f
mov word [esp + 0x30], 0x5c
mov byte [esp + 0x2f], 0x45
mov byte [esp + 0x28], 0x53
call fcn.10011990
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10011c10
lea ecx, [esp + 0x24]
push ecx
push 0x20019
push 0
push dword [eax]
push ShowHideMenuCtl
call fcn.100115d0
mov edx, dword [esp + 0x34]
or esi, 0xffffffff
add esp, 0x20
mov ebx, eax
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1001328f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x100132a8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
jne 0x100133a6
push 0x104
lea eax, [esp + 0x34]
push ebx
push eax
call fcn.10015bf0
lea eax, [esp + 0x28]
mov word [esp + 0x33], 0x736c
push eax
lea eax, [esp + 0x40]
mov word [esp + 0x34], 0x7668
push eax
push ebx
push ebx
lea eax, [esp + 0x40]
mov byte [esp + 0x45], bl
push eax
push dword [esp + 0x38]
mov byte [esp + 0x4a], 0x61
call fcn.100116a0
add esp, 0x24
test eax, eax
jne 0x1001339a
cmp dword [esp + 0x1c], eax
jbe 0x1001339a
lea ecx, [esp + 0x14]
call fcn.10011a90
push edi
lea eax, [esp + 0x18]
push 0x10050cf4
push eax
call fcn.10011fc0
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.10011a90
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push 0x1004fecc
push eax
call fcn.10011fc0
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x10013388
mov esi, dword [esp + 0x10]
cmp dword [esi - 0xc], ebx
jl 0x10013388
push eax
push esi
call fcn.1002a0f5
add esp, 8
test eax, eax
je 0x10013388
sub eax, esi
js 0x10013388
push dword [esp + 0x18]
call fcn.10011530
add esp, 4
lea ecx, [esp + 0x10]
call fcn.10011ad0
lea ecx, [esp + 0x14]
call fcn.10011ad0
lea eax, [ebx + 1]
jmp 0x100133d1
lea ecx, [esp + 0x10]
call fcn.10011ad0
lea ecx, [esp + 0x14]
call fcn.10011ad0
push dword [esp + 0x18]
call fcn.10011530
add esp, 4
push dword [esp + 0x154]
push dword [esp + 0x154]
push dword [esp + 0x154]
push dword [esp + 0x154]
push dword [esp + 0x154]
push ebp
push edi
call dword [0x100825e0]
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001435b
add esp, 0x128
ret 0x1c
Function at 0x10013860
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1008262c], ebx
jne 0x10013896
push 0x10082630
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x100
push ebx
push 0x10082648
call fcn.10015bf0
add esp, 0xc
mov dword [0x1008262c], 1
push 0x10082630
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x14]
xor ecx, ecx
nop word [eax + eax]
mov esi, dword [ecx + 0x10082648]
test esi, esi
je 0x100138c1
lea eax, [esi + 0x2c]
cmp eax, dword [edi]
je 0x100138de
add ecx, 4
cmp ecx, 0x100
jb 0x100138b0
push 0x10082630
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
push ebp
push dword [esi + 4]
push dword [esi]
call fcn.10013a80
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebp, eax
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10013982
mov eax, dword [esi + 4]
xor ecx, ecx
mov edx, dword [esi]
test eax, eax
je 0x10013931
nop word [eax + eax]
mov al, byte [esi + ecx + 0x4c]
mov byte [ecx + edx], al
inc ecx
mov eax, dword [esi + 4]
cmp ecx, eax
jb 0x10013920
mov edx, dword [esi]
push eax
push edx
push ebp
call fcn.10011310
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push dword [esi + 4]
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esi]
mov ebx, 1
mov dword [edi], eax
xor eax, eax
nop dword [eax]
cmp dword [eax*4 + 0x10082648], esi
je 0x10013971
inc eax
cmp eax, 0x40
jb 0x10013960
jmp 0x10013982
dec dword [0x10082748]
mov dword [eax*4 + 0x10082648], 0
call fcn.100139a0
pop ebp
push 0x10082630
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x100139a0
Capabilities:
Resume thread

Disassembly:
push ecx
push esi
call fcn.100113d0
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [esp + 8], eax
call fcn.100113d0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x10082750], esi
jbe 0x100139ff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop dword [eax + eax]
mov eax, dword [0x1008274c]
push dword [eax + esi*4]
call edi
mov eax, dword [0x1008274c]
push dword [eax + esi*4]
call ebx
inc esi
cmp esi, dword [0x10082750]
jb 0x100139e0
pop edi
pop ebx
push dword [0x1008274c]
call fcn.10029f77
add esp, 4
mov dword [0x1008274c], 0
mov dword [0x10082750], 0
push dword [esp + 4]
call fcn.100113d0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop esi
pop ecx
ret
Function at 0x100306c5
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100305d9

Function at 0x1003b1d4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003ac64
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x4011205
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7d8a0276
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x403104
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x417008], 0x8088405
inc edx
mov dword [ebx + 0x417008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40da63
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404ac0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.00406a9c
mov edi, eax
cmp edi, 0x104
jbe 0x40da86
mov eax, edi
add eax, eax
call fcn.00402e24
mov esi, eax
jmp 0x40da88
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.00406a9c
push edi
push esi
call fcn.00406b34
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40dac1
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40daab
mov eax, esp
cmp esi, eax
je 0x40dace
mov eax, esi
call fcn.00402e40
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40db08
cmp bl, 0
je 0x40db04
cmp bl, 0x41
jl 0x40daff
cmp bl, 0x5a
jg 0x40daff
or bl, 0x20
xor al, bl
inc esi
jmp 0x40dae3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40da48

Function at 0x40f6e4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x41cd98
mov eax, esi
mov edx, 8
test al, 1
je 0x40f700
shr eax, 1
xor eax, 0xedb88320
jmp 0x40f702
shr eax, 1
dec edx
jne 0x40f6f3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40f6ec
pop esi
ret

Function at 0x40f72f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x41cd94], 0
jne 0x40f73b
call fcn.0040f6e4
push 1
push 0x41cd94
call fcn.00406948
mov eax, edi
test esi, esi
je 0x40f766
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x41cd98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40f741
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4015c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x218], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea ecx, [ebp - 0x108]
push ecx
call fcn.0041c718
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x40168d
mov edx, dword [ebp - 0x10c]
mov byte [edx], 0
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041c620
add esp, 8
push str._rsdebug.ini
lea edx, [ebp - 0x218]
push edx
call fcn.0041c630
add esp, 8
lea eax, [ebp - 0x218]
push eax
push 0
push str.IsDebug
push str.Debug
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x43c19c], eax
cmp dword [0x43c19c], 0
setne al
jmp 0x40168f
xor al, al
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x401920
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push 0x43349c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40193f
jmp 0x401a16
push str.OpenThread
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push str.Thread32First
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
push str.Thread32Next
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
push 0x433454
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0xc], 0
je 0x40199f
cmp dword [ebp - 4], 0
je 0x40199f
cmp dword [ebp - 0x40], 0
je 0x40199f
cmp dword [ebp - 0x1c], 0
jne 0x4019a1
jmp 0x401a16
push 0
push 4
call dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0x1c
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [ebp - 4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401a16
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 8]
jne 0x401a06
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x3c]
je 0x401a06
mov edx, dword [ebp - 0x30]
push edx
push 0
push 2
call dword [ebp - 0xc]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x401a06
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
jmp 0x4019d2
mov esp, ebp
pop ebp
ret
Function at 0x402b6f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
xor esi, esi
lea edi, [esi + 0x43c1a8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x402bd4
push dword [esi + 0x43c1b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esi + 0x43c1cc], eax
je 0x402bd4
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0x10
push eax
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x20
lea eax, [esi + 0x43c1f0]
push eax
call ebx
push 0
push 0
push edi
call fcn.004168c0
add esp, 0xc
add esi, 0x68
cmp esi, 0x138
jb 0x402b82
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x402c50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push edi
push 0x40
pop ecx
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x104], bl
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x208], bl
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.0041c718
cmp eax, ebx
pop ecx
pop ecx
je 0x402cfd
mov byte [eax], bl
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0041c620
lea eax, [ebp - 0x208]
push str._rsdebug.ini
push eax
call fcn.0041c630
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
push ebx
push str.IsDebug
push str.Debug
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, ebx
mov dword [0x43c2e0], eax
setne al
jmp 0x402cff
xor al, al
pop edi
pop ebx
leave
ret

Function at 0x402d9e
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
mov eax, dword [esp + 4]
jle 0x402db4
mov dl, byte [esp + 0xc]
xor byte [eax], dl
inc eax
dec ecx
jne 0x402daa
ret
Function at 0x402db5
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x430ddc
call fcn.0041d9a8
sub esp, 0x14
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push 0x10000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, esi
jne 0x402df3
push str.CreateFile_failed._n
call fcn.0041dc83
pop ecx
jmp 0x402eab
push edi
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x402e2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x4336a4
call fcn.0041dc83
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402eaa
push dword [ebp - 0x20]
call fcn.0041d9a0
push dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
push esi
push eax
call fcn.0041c540
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0x10
push esi
push esi
push esi
push ebx
mov dword [ebp - 0x14], esi
call edi
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x43c2ec]
push dword [ebp - 0x20]
push dword [ebp - 0x10]
call fcn.00402d9e
add esp, 0xc
push esi
push esi
push esi
push ebx
call edi
push esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call fcn.0041c1b2
xor esi, esi
pop ecx
inc esi
pop edi
lea ecx, [ebp + 8]
call fcn.004023b4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x402ec3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402edb
test al, 0x10
je 0x402edb
xor eax, eax
inc eax
jmp 0x402edd
xor eax, eax
ret 4