joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1046d50
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 0x24]
push ebx
push esi
push edi
push 7
pop ecx
add eax, 5
xor edx, edx
div ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edi, edi
push edi
push edi
mov dword [ebp - 4], edi
mov esi, edx
add esi, 0x2a
push esi
push 0x400
call ebx
mov edi, eax
lea eax, [edi - 1]
cmp eax, 0x7ffffffd
ja 0x1046dda
push 0x1080960
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0100d7ed
pop ecx
pop ecx
mov dword [ebp - 4], eax
test eax, eax
jne 0x1046db8
mov esi, 0x8007000e
jmp 0x1046de1
push edi
push eax
push esi
push 0x400
call ebx
test eax, eax
jle 0x1046dda
mov eax, dword [ebp - 4]
push eax
push dword [ebp + 8]
xor ecx, ecx
mov word [eax + edi*2], cx
call fcn.01011fe0
jmp 0x1046ddf
call fcn.01056967
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.0102860d
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x1049af9
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x107d044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
je 0x1049c05
cmp word [esi], di
je 0x1049c05
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
jne 0x1049bfe
mov ax, word [esi]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
dec eax
je 0x1049c0a
dec eax
je 0x1049b79
dec eax
dec eax
je 0x1049c0a
dec eax
je 0x1049c0a
jmp 0x1049bfe
xor eax, eax
push 0x206
mov word [ebp - 8], ax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1049be3
call fcn.01056967
mov edi, eax
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x1049c0a
test byte [eax + 0x1c], 1
je 0x1049c0a
push edi
push 0x100479c
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01035c59
jmp 0x1049c0a
push 4
lea eax, [ebp - 0x214]
push 0x10047ac
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1049c0a
mov edi, 0x800704b0
jmp 0x1049c0a
mov edi, 0x80070057
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0100db8f
leave
ret 4

Function at 0x104c2b8
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call fcn.01049af9
mov esi, eax
test esi, esi
jl 0x104c2eb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x104c2e6
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
jne 0x104c2eb
mov esi, 0x80070032
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1053565
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x1053597
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x1053592
cmp eax, 3
je 0x1053592
cmp eax, 4
je 0x1053592
cmp eax, 5
je 0x1053592
cmp eax, 6
jne 0x1053597
xor eax, eax
inc eax
jmp 0x1053599
xor eax, eax
pop ebp
ret 4

Function at 0x10539d1
Capabilities:
Get file system object information

Disassembly:
push 0x30c
mov eax, 0x10711f1
call fcn.0100dc17
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x2d4], ecx
xor ebx, ebx
push 0x108086c
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x2d0], ebx
call fcn.0100edf3
mov esi, 0x2b4
push esi
lea eax, [ebp - 0x2c4]
push ebx
push eax
mov dword [ebp - 4], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 8], ebx
je 0x1053b1e
cmp dword [ebp - 0x2cc], ebx
je 0x1053b1e
test edi, edi
je 0x1053a53
push edi
lea eax, [ebp - 0x2c8]
push eax
call fcn.01011fe0
mov ebx, eax
test ebx, ebx
jl 0x1053b1e
push dword [ebp - 0x2cc]
lea eax, [ebp - 0x2c8]
push eax
call fcn.01011f9f
mov ebx, eax
test ebx, ebx
jl 0x1053b1e
push 0x210
push esi
lea eax, [ebp - 0x2c4]
push eax
push 0x10
push dword [ebp - 0x2c8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x1053b19
push 0x1080960
push 4
call fcn.0100d7ab
pop ecx
pop ecx
test eax, eax
je 0x1053aaf
mov ecx, eax
call fcn.0100f07e
mov esi, eax
jmp 0x1053ab1
xor esi, esi
test esi, esi
jne 0x1053abc
mov ebx, 0x8007000e
jmp 0x1053b1e
push dword [ebp - 0x2cc]
push esi
call fcn.01011fe0
mov ebx, eax
test ebx, ebx
jl 0x1053b1e
push dword [ebp + 8]
mov edi, dword [ebp - 0x2d4]
lea eax, [ebp - 0x318]
push eax
mov ecx, edi
call fcn.010532f0
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x308], eax
lea eax, [ebp - 0x318]
push eax
lea ecx, [edi + 0x2c]
mov dword [ebp - 0x2ec], esi
call fcn.01053352
mov dword [ebp - 0x2d0], eax
test eax, eax
jne 0x1053b1e
mov ebx, 0x80004005
cmp dword [ebp - 0x2c4], 0
je 0x1053b33
push dword [ebp - 0x2c4]
call dword [sym.imp.USER32.dll_DestroyIcon]
test ebx, ebx
jge 0x1053b4d
push 0x10
push 0
push 0x8e
push ebx
call fcn.0100e44f
mov ecx, eax
call fcn.010169f3
mov ecx, dword [ebp - 0x2c8]
add ecx, 0xfffffff0
call fcn.0100e7d0
mov eax, dword [ebp - 0x2d0]
call fcn.0100dca9
ret 0x10
Function at 0x10555a7
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x107d044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.010554e8
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x105561a
cmp dword [ebp - 0x94], 5
jb 0x105563b
jmp 0x1055637
cmp dword [ebp - 0x88], 1
jne 0x105563b
cmp dword [ebp - 0x94], 4
ja 0x1055637
jne 0x105563b
cmp dword [ebp - 0x90], 0
jbe 0x105563b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x1005cf0
call fcn.0100e5e9
test eax, eax
jge 0x105565c
mov byte [0x10801ac], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0100db8f
leave
ret

Function at 0x105585d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x1080950], 0
push esi
jne 0x10557cb
call fcn.010556c2
test eax, eax
je 0x105580e
mov eax, dword [0x1080950]
cmp eax, 1
jne 0x10557ec
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x105580e
pop esi
ret
push eax
call dword [0x1080958]
test eax, eax
jne 0x1055856
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1055812
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x1080950]
call dword [0x1080958]
mov edi, eax
test edi, edi
je 0x1055837
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1055853
mov edi, esi
add esi, 0xff0
push edi
push dword [0x1080950]
call dword [0x1080954]
add edi, 0x10
cmp edi, esi
jb 0x105583f
mov eax, edi
pop edi
pop esi
ret
jmp 0x10557b8
Function at 0x10562e3
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x1056346
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x1056336
test byte [eax + 0x1c], 4
je 0x1056336
push 0x1005ea8
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101099b
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x1056342
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
jmp 0x10563a7
push esi
mov esi, 0x80004005
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
sub eax, 0xb
je 0x1056372
dec eax
je 0x1056364
dec eax
je 0x105636b
sub eax, 9
jne 0x1056377
mov esi, 0x8007000e
jmp 0x1056377
mov esi, 0x80070005
jmp 0x1056377
mov esi, 0x8007009b
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x105639c
test byte [eax + 0x1c], 1
je 0x105639c
push esi
push 0x1005ea8
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01035c59
test esi, esi
jge 0x10563a4
mov eax, esi
jmp 0x10563a6
xor eax, eax
pop esi
leave
ret 0x1c

Function at 0x105642d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x105647d
push esi
call fcn.01056967
mov esi, eax
cmp esi, 0x80070002
je 0x1056478
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x1056478
test byte [eax + 0x1c], 1
je 0x1056478
push esi
push dword [ebp + 8]
push 0x1005ea8
push 0x35
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101d10a
mov eax, esi
pop esi
jmp 0x10564b1
test al, 0x10
je 0x10564af
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x10564a8
test byte [eax + 0x1c], 1
je 0x10564a8
push dword [ebp + 8]
push 0x1005ea8
push 0x36
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100e27d
mov eax, 0x800700b7
jmp 0x10564b1
xor eax, eax
pop ebp
ret 4
Function at 0x1056625
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.010568c1
mov esi, eax
cmp esi, ebx
jge 0x105665b
cmp dword [ebp - 4], ebx
je 0x1056654
push dword [ebp - 4]
call fcn.0100d695
pop ecx
mov eax, esi
jmp 0x1056716
push edi
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x14]
add esp, 0xc
mov dword [ebp - 0x58], 0x44
pop edi
cmp eax, ebx
jne 0x1056688
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp + 0x2c]
xor eax, eax
push dword [ebp + 0x28]
cmp byte [ebp + 0x24], bl
push dword [ebp + 0x10]
setne al
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp - 4]
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10566f1
call fcn.01056967
mov esi, eax
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x1056646
test byte [eax + 0x1c], 1
je 0x1056646
push esi
push dword [ebp - 4]
push 0x1005ea8
push 0x2e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101d10a
jmp 0x1056646
cmp dword [ebp - 0x10], ebx
je 0x10566fe
push dword [ebp - 0x10]
call fcn.01055eda
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
cmp dword [ebp - 4], ebx
je 0x1056714
push dword [ebp - 4]
call fcn.0100d695
pop ecx
xor eax, eax
pop esi
pop ebx
leave
ret 0x28

Function at 0x1057b0a
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
lea eax, [ebp - 4]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x1057b5d
call fcn.01056967
mov esi, eax
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x1057b56
test byte [eax + 0x1c], 2
je 0x1057b56
push esi
push ebx
push 0x1005ff4
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101d10a
mov eax, esi
jmp 0x1057be1
and dword [ebp + 0xc], 0
push edi
push esi
lea eax, [ebp + 0xc]
push eax
call fcn.01056824
mov edi, eax
test edi, edi
jge 0x1057b85
cmp dword [ebp + 0xc], 0
je 0x1057b81
push dword [ebp + 0xc]
call fcn.0100d695
pop ecx
mov eax, edi
jmp 0x1057be0
push dword [ebp + 0xc]
push esi
push dword [ebp - 4]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1057bd6
call fcn.01056967
mov esi, eax
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x1057bc3
test byte [eax + 0x1c], 1
je 0x1057bc3
push esi
push ebx
push 0x1005ff4
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101d10a
cmp dword [ebp + 0xc], 0
je 0x1057bd2
push dword [ebp + 0xc]
call fcn.0100d695
pop ecx
mov eax, esi
jmp 0x1057be0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1059835
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x107d044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x38]
push eax
call fcn.010592be
mov esi, eax
test esi, esi
jge 0x1059879
push esi
call fcn.01056f5f
test eax, eax
jne 0x105986a
mov eax, esi
jmp 0x10598ba
lea eax, [ebp - 0x14]
push eax
call fcn.010597a0
test eax, eax
jge 0x1059883
jmp 0x10598ba
lea esi, [ebp - 0x38]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
xor edx, edx
sub ecx, eax
lea esi, [ecx + edx*4]
mov esi, dword [ebp + esi - 0x14]
lea eax, [ebp + edx*4 - 0x14]
xor dword [eax], esi
inc edx
cmp edx, 4
jb 0x105988d
lea eax, [ebp - 0x14]
push eax
push 0x10
lea eax, [ebp - 0x24]
push eax
call fcn.0106d52c
lea esi, [ebp - 0x24]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100db8f
leave
ret 8
Function at 0x105d03e
Capabilities:
Terminate process

Disassembly:
push 0x14
mov eax, 0x1071c6c
call fcn.0100dba4
mov esi, dword [ebp + 8]
xor edi, edi
cmp esi, edi
jne 0x105d05d
mov eax, 0x80070057
jmp 0x105d23e
push esi
call fcn.0105cd4e
cmp eax, edi
jl 0x105d23e
mov dword [ebp - 0x18], edi
mov dword [ebp + 8], edi
lea eax, [ebp + 8]
push eax
push esi
mov dword [ebp - 4], edi
call fcn.0105c809
mov ebx, eax
cmp ebx, edi
jge 0x105d099
cmp dword [ebp + 8], edi
je 0x105d092
push dword [ebp + 8]
call fcn.0100d695
pop ecx
mov eax, ebx
jmp 0x105d23e
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.01056625
mov ebx, eax
cmp ebx, edi
jge 0x105d0ce
cmp dword [ebp - 0x10], edi
je 0x105d084
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x105d084
mov eax, dword [ebp - 0x10]
mov ecx, esi
mov dword [ebp - 0x20], eax
call fcn.0105c770
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
push 0x1b7740
lea eax, [ebp - 0x20]
push eax
push 2
call fcn.010560b3
mov ebx, eax
mov esi, 0x107d1a4
mov edi, 0x10064bc
cmp ebx, 0x80070102
jne 0x105d136
mov eax, dword [0x107d1a4]
cmp eax, esi
je 0x105d123
test byte [eax + 0x1c], 1
je 0x105d123
push edi
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101099b
push 0x5b4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, 0x800705b4
test ebx, ebx
jge 0x105d152
cmp dword [ebp - 0x10], 0
je 0x105d149
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], 0
jmp 0x105d087
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x105d1a8
dec eax
je 0x105d184
mov eax, dword [0x107d1a4]
cmp eax, esi
je 0x105d17d
test byte [eax + 0x1c], 1
je 0x105d17d
push dword [ebp - 0x14]
push edi
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01035c59
mov ebx, 0x8000ffff
jmp 0x105d13a
mov ebx, 0x800704c7
mov eax, dword [0x107d1a4]
cmp eax, esi
je 0x105d13a
test byte [eax + 0x1c], 1
je 0x105d13a
push edi
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101099b
jmp 0x105d13a
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x105d1e0
call fcn.01056967
mov ebx, eax
mov eax, dword [0x107d1a4]
cmp eax, esi
je 0x105d216
test byte [eax + 0x1c], 1
je 0x105d216
push ebx
push edi
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01035c59
jmp 0x105d216
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x105d216
jle 0x105d1f3
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [0x107d1a4]
cmp eax, esi
je 0x105d216
test byte [eax + 0x1c], 1
je 0x105d216
push ebx
push dword [ebp + 8]
push edi
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101d10a
test ebx, ebx
jl 0x105d13a
cmp dword [ebp - 0x10], 0
je 0x105d22d
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], 0
je 0x105d23c
push dword [ebp + 8]
call fcn.0100d695
pop ecx
xor eax, eax
call fcn.0100dc90
ret 4
Function at 0x106d903
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
push edi
xor edi, edi
test eax, eax
jne 0x106d9f6
push 0x1080960
push 0xc
call fcn.0100d7ab
pop ecx
pop ecx
test eax, eax
je 0x106d930
and dword [eax], edi
jmp 0x106d932
xor eax, eax
mov dword [ebp - 4], eax
test eax, eax
je 0x106d9c2
push esi
mov ecx, eax
call fcn.01015bad
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 8], ecx
mov ecx, esi
call fcn.0106d74d
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
push 0x106d816
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x106d9b4
mov ecx, esi
call fcn.0106d76c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x107d1a4]
cmp ecx, 0x107d1a4
je 0x106d9ee
test byte [ecx + 0x1c], 1
je 0x106d9ee
push eax
push 0x1007940
push 0xb
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01035c59
jmp 0x106d9ee
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x106d9ee
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x106d9e6
test byte [eax + 0x1c], 1
je 0x106d9e6
push 0x1007940
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101099b
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 4]
call fcn.0106d8e6
mov eax, edi
pop edi
pop esi
leave
ret 0x18

Function at 0x10a90a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
lea edi, [edx]
push 0xffffffffffffffff
dec cl
add esi, dword [edx + 0x20]
pop ecx
jmp 0x10a8e2d
xor dword [esp], 0x1661e7a4
pop eax
nop
xor eax, dword [esp + 4]
jne 0x10a8e2d
jmp 0x10a8ffe
inc ecx
lodsd eax, dword [esi]
cmp ecx, dword [edx + 0x18]
mov esp, esp
lea edi, [eax + ebx]
je 0x10a8ed6
jmp 0x10a8f39
movzx eax, byte [edi]
dec edi
nop
sub dword [esp], eax
mov ebx, ebx
add edi, 2
pop eax
jmp 0x10a905c
ret
push 0
pop eax
or dl, 0
clc
lea eax, [eax + eax*4]
imul eax, eax, 3
xor edx, esp
xor edx, esp
sub dl, ch
add dl, ch
push eax
jmp 0x10a8e8b
or eax, 0xbe78261e
mov esi, dword [edx + 0x24]
mov edi, dword [edx + 0x1c]
shl ecx, 1
xor eax, 0x62
mov al, 0x67
lea eax, [esi - 0x39008221]
add edi, ebx
add esi, ebx
jmp 0x10a90e1
cld
cmp byte [edi], 1
lea ebx, [ebx]
ja 0x10a8f40
push eax
jmp 0x10a8d25
mov edx, ebx
mov esi, ebx
mov eax, ebx
jmp 0x10a4220
movzx esi, word [ecx + esi]
mov esi, dword [edi + esi*4]
add esi, ebx
ret 4
Function at 0x421560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42158d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42158d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219