joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401200
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
push 0x248
push 1
mov edi, edx
mov ebx, ecx
call fcn.0040b5f8
mov esi, eax
add esp, 8
test esi, esi
je 0x401242
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x401248
call fcn.0040bc63
push esi
mov dword [eax], 0xc
call fcn.0040b5c0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x228
lea eax, [esi + 0x20]
mov dword [esi + 8], ebx
push 0
push eax
mov dword [esi + 4], 1
mov dword [esi + 0x1c], edi
mov dword [esi + 0x10], 0
call fcn.00412c70
lea edi, [ebx + 0x18]
add esp, 0xc
test edi, edi
je 0x40128b
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401296
cmp eax, 0x80
je 0x401296
call fcn.0040bc63
mov dword [eax], 0x16
mov eax, dword [ebx + 0x14]
lea edx, [ebx + 0x10]
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x14]
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [eax], ecx
mov dword [edx + 4], ecx
test edi, edi
jne 0x4012c1
call fcn.0040bc63
pop edi
mov dword [eax], 0x16
mov eax, esi
pop esi
pop ebx
ret
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x4012d8
call fcn.0040bc63
mov dword [eax], 1
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x4018d0
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0x198
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
call fcn.0040b638
mov edi, eax
add esp, 4
test edi, edi
jne 0x4018f8
lea eax, [edi - 0xb]
pop edi
pop esi
ret 8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
jne 0x401928
call fcn.0040bc63
push edi
mov dword [eax], 0xc
call fcn.0040b5c0
add esp, 4
mov eax, 0xffffff9d
pop edi
pop esi
ret 8
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [esi]
call ebp
test eax, eax
je 0x40194b
cmp eax, 0x80
je 0x40194b
call fcn.0040bc63
mov dword [eax], 0x16
inc dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x401965
call fcn.0040bc63
mov dword [eax], 1
push ebx
push 0x184
lea eax, [edi + 0x14]
mov dword [edi + 0x10], esi
push 0
push eax
mov dword [edi + 4], 0
call fcn.00412c70
push edi
call dword [0x479448]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jns 0x4019d7
push esi
call fcn.00401640
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4019ba
push edi
mov dword [edi], 0
call fcn.0040b5c0
add esp, 4
mov eax, ebx
pop ebx
pop ebp
pop edi
pop esi
ret 8
call fcn.0040bc63
push edi
mov dword [eax], 0x16
call fcn.0040b5c0
add esp, 4
mov eax, ebx
pop ebx
pop ebp
pop edi
pop esi
ret 8
mov ebx, dword [esp + 0x14]
add ebx, 0x24
je 0x4019f1
push 0xffffffffffffffff
push dword [ebx]
call ebp
test eax, eax
je 0x4019fc
cmp eax, 0x80
je 0x4019fc
call fcn.0040bc63
mov dword [eax], 0x16
mov ebp, dword [esp + 0x14]
lea edx, [edi + 8]
mov eax, dword [ebp + 0x20]
lea esi, [ebp + 0x1c]
mov dword [edx + 4], eax
mov ecx, ebx
mov dword [edx], esi
mov eax, dword [esi + 4]
mov dword [eax], edx
mov dword [esi + 4], edx
call fcn.004047e0
mov eax, dword [esp + 0x18]
mov ecx, ebp
mov dword [eax], edi
call fcn.00401740
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
ret 8
Function at 0x41372e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00410bed
mov dword [ebp - 0x14], eax
cmp dword [0x47ef98], esi
jne 0x413821
push 0x800
push esi
push 0x476848
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4137ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x413901
push esi
push esi
push 0x476848
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x413901
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x413901
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x47ef98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x47ef9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x47efa0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47efa8], eax
test eax, eax
je 0x41381e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47efa4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x413846
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x413839
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41385b
push 4
pop eax
jmp 0x413903
cmp dword [ebp - 0x14], esi
je 0x41385b
push dword [0x47ef98]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x413840
mov eax, dword [0x47efa4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4138b9
cmp dword [0x47efa8], edi
je 0x4138b9
push eax
call ebx
push dword [0x47efa8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4138b9
test eax, eax
je 0x4138b9
call ecx
test eax, eax
je 0x4138ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4138ae
test byte [ebp - 8], 1
jne 0x4138b9
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4138e9
mov eax, dword [0x47ef9c]
cmp eax, edi
je 0x4138e6
push eax
call ebx
test eax, eax
je 0x4138e6
call eax
mov esi, eax
test esi, esi
je 0x4138e6
mov eax, dword [0x47efa0]
cmp eax, edi
je 0x4138e6
push eax
call ebx
test eax, eax
je 0x4138e6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x47ef98]
call ebx
test eax, eax
je 0x413901
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x413903
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b3ff
mov esp, ebp
pop ebp
ret
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x59087920
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x27a37b2a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001140
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x10008c38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
lea ecx, [esp + 8]
call fcn.10002dc0
mov eax, dword [ebx]
movzx edx, word [eax + 0x14]
xor ecx, ecx
cmp word [eax + 6], cx
mov dword [esp + 0x18], ecx
lea esi, [edx + eax + 0x18]
mov dword [esp + 0xc], ecx
jbe 0x10001229
push ebp
add esi, 0x10
push edi
mov eax, dword [esi]
test eax, eax
jne 0x100011cc
mov eax, dword [esp + 0x2c]
mov ebp, dword [eax + 0x38]
test ebp, ebp
jle 0x1000120d
mov ecx, dword [esi - 4]
mov edx, dword [ebx + 4]
push 4
push 0x1000
add ecx, edx
push ebp
push ecx
lea ecx, [esp + 0x20]
call fcn.10002e20
mov ecx, ebp
mov edx, ecx
mov edi, eax
shr ecx, 2
xor eax, eax
mov dword [esi - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x1000120d
mov ecx, dword [ebx + 4]
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, ecx
push eax
lea ecx, [esp + 0x20]
call fcn.10002e20
mov edi, dword [esp + 0x28]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add ecx, edi
add edx, ecx
cmp ecx, edx
mov ebp, eax
mov edi, ebp
je 0x1000120a
jmp 0x10001200
mov al, byte [ecx]
mov byte [edi], al
inc edi
inc ecx
cmp ecx, edx
jne 0x10001200
mov dword [esi - 8], ebp
mov ecx, dword [ebx]
mov eax, dword [esp + 0x14]
movzx edx, word [ecx + 6]
inc eax
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x10001188
pop edi
pop ebp
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.10002ee0
mov ecx, dword [esp + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x10001250
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push 0xffffffffffffffff
push 0x10008c58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], esi
call fcn.10002dc0
mov edi, dword [esi]
movzx eax, word [edi + 0x14]
xor ebp, ebp
cmp word [edi + 6], bp
mov dword [esp + 0x20], ebp
lea eax, [eax + edi + 0x18]
jbe 0x10001366
push ebx
lea ebx, [eax + 0x24]
jmp 0x100012a0
mov ecx, dword [ebx]
test ecx, 0x2000000
je 0x100012c5
mov ecx, dword [ebx - 0x14]
mov edx, dword [ebx - 0x1c]
push 0x4000
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.10002e50
jmp 0x1000134f
mov eax, ecx
and eax, 0x80000000
test ecx, 0x20000000
je 0x100012f4
test ecx, 0x40000000
je 0x100012e8
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
jmp 0x10001310
neg eax
sbb eax, eax
and eax, 0x70
add eax, 0x10
jmp 0x10001310
test ecx, 0x40000000
je 0x10001308
neg eax
sbb eax, eax
and eax, 2
add eax, 2
jmp 0x10001310
neg eax
sbb eax, eax
and eax, 7
inc eax
test ecx, 0x4000000
je 0x1000131d
or eax, 0x200
mov esi, dword [ebx - 0x14]
mov edx, esi
test edx, edx
jne 0x10001339
test cl, 0x40
je 0x10001330
mov edx, dword [edi + 0x20]
jmp 0x10001337
test cl, cl
jns 0x1000134f
mov edx, dword [edi + 0x24]
test edx, edx
jbe 0x1000134f
mov edx, dword [ebx - 0x1c]
lea ecx, [esp + 0x18]
push ecx
push eax
push esi
push edx
lea ecx, [esp + 0x20]
call fcn.10002e80
mov eax, dword [esp + 0x14]
mov edi, dword [eax]
movzx ecx, word [edi + 6]
inc ebp
add ebx, 0x28
cmp ebp, ecx
jl 0x100012a0
pop ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.10002ee0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x10001730
Capabilities:
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x10008cc3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi + 4], ebx
push 0x40
mov dword [esp + 0x10], esi
mov dword [esi + 0x10], 0x10
call fcn.100033da
add esp, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
lea ecx, [esp + 8]
mov dword [esp + 0x18], ebx
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
call fcn.10002dc0
mov eax, dword [esp + 0x20]
cmp word [eax], 0x5a4d
mov byte [esp + 0x18], 1
je 0x100017bc
mov ecx, esi
call fcn.10001490
lea ecx, [esp + 8]
mov byte [esi + 0x19], 1
mov byte [esp + 0x18], bl
call fcn.10002ee0
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
push edi
mov edi, dword [eax + 0x3c]
add edi, eax
cmp dword [edi], 0x4550
jne 0x100017ff
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
push 4
push 0x2000
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.10002e20
cmp eax, ebx
jne 0x1000180c
mov edx, dword [edi + 0x50]
push 4
push 0x2000
push edx
push ebx
lea ecx, [esp + 0x1c]
call fcn.10002e20
cmp eax, ebx
jne 0x1000180c
mov ecx, esi
call fcn.10001490
mov byte [esi + 0x19], 1
jmp 0x10001828
push 4
mov dword [esi + 4], eax
mov ecx, dword [edi + 0x50]
push 0x1000
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.10002e20
mov byte [esi + 0x18], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], bl
call fcn.10002ee0
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x10001850
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
push 0x100
mov ebx, eax
call fcn.100033da
add esp, 4
mov esi, eax
xor edi, edi
xor eax, eax
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x10001870
mov eax, 1
sub eax, esi
mov dword [esp + 0x14], eax
mov eax, 2
sub eax, esi
mov dword [esp + 0x18], eax
mov eax, 3
sub eax, esi
mov dword [esp + 0x10], edi
mov ecx, esi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
cdq
idiv ebp
xor eax, eax
mov al, byte [edx + ebx]
xor edx, edx
mov dl, byte [ecx]
add edx, edi
add eax, edx
and eax, 0xff
mov edi, eax
mov al, byte [edi + esi]
mov dl, byte [ecx]
add al, 0x10
mov byte [edi + esi], dl
sub al, 0x10
mov byte [ecx], al
mov eax, dword [esp + 0x14]
add eax, ecx
cdq
idiv ebp
xor eax, eax
mov al, byte [ecx + 1]
add eax, edi
movzx edx, byte [edx + ebx]
add edx, eax
and edx, 0xff
mov edi, edx
mov al, byte [edi + esi]
mov dl, byte [ecx + 1]
add al, 0x10
mov byte [edi + esi], dl
mov edx, dword [esp + 0x18]
sub al, 0x10
mov byte [ecx + 1], al
lea eax, [edx + ecx]
cdq
idiv ebp
xor eax, eax
mov al, byte [edx + ebx]
xor edx, edx
mov dl, byte [ecx + 2]
add edx, edi
add eax, edx
mov dl, byte [ecx + 2]
and eax, 0xff
mov edi, eax
mov al, byte [edi + esi]
add al, 0x10
sub al, 0x10
mov byte [edi + esi], dl
mov byte [ecx + 2], al
mov eax, dword [esp + 0x1c]
add eax, ecx
cdq
idiv ebp
xor eax, eax
mov al, byte [ecx + 3]
add ecx, 4
add eax, edi
movzx edx, byte [edx + ebx]
add edx, eax
and edx, 0xff
mov edi, edx
mov al, byte [edi + esi]
mov dl, byte [ecx - 1]
add al, 0x10
sub al, 0x10
mov byte [edi + esi], dl
mov byte [ecx - 1], al
mov eax, dword [esp + 0x10]
add eax, 4
cmp eax, 0x100
mov dword [esp + 0x10], eax
jl 0x100018a2
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
add edx, ebp
xor ecx, ecx
xor edi, edi
cmp ebp, edx
je 0x100019c4
xor eax, eax
inc ecx
and ecx, 0xff
mov al, byte [ecx + esi]
mov bl, byte [ecx + esi]
add eax, edi
and eax, 0xff
mov edi, eax
xor eax, eax
mov al, byte [edi + esi]
add al, 0x10
mov byte [edi + esi], bl
sub al, 0x10
mov byte [ecx + esi], al
xor ebx, ebx
mov bl, byte [edi + esi]
add eax, ebx
mov bl, byte [ebp]
and eax, 0xff
mov al, byte [eax + esi]
xor bl, al
mov byte [ebp], bl
inc ebp
cmp ebp, edx
jne 0x10001981
push esi
call fcn.100033e8
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100033ed
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x100034dd
mov eax, 0x94
call fcn.10004e30
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10003552
mov ecx, dword [esi + 0x10]
mov dword [0x10089d38], ecx
mov eax, dword [esi + 4]
mov dword [0x10089d44], eax
mov edx, dword [esi + 8]
mov dword [0x10089d48], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x10089d3c], esi
je 0x10003458
or esi, 0x8000
mov dword [0x10089d3c], esi
shl eax, 8
add eax, edx
push 1
mov dword [0x10089d40], eax
call fcn.10004d5b
test eax, eax
pop ecx
je 0x10003552
call fcn.1000414f
test eax, eax
jne 0x10003485
call fcn.10004dac
jmp 0x10003552
call fcn.10004cb9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1008a554], eax
call fcn.10004b97
mov dword [0x10089d14], eax
call fcn.10004678
test eax, eax
jl 0x100034d6
call fcn.10004af5
test eax, eax
jl 0x100034d1
call fcn.100048c2
test eax, eax
jl 0x100034d1
push 0
call fcn.10004470
test eax, eax
pop ecx
jne 0x100034d1
inc dword [0x10089d10]
jmp 0x10003563
call fcn.10004876
call fcn.10003f38
jmp 0x1000347b
test eax, eax
jne 0x1000350d
cmp dword [0x10089d10], eax
jle 0x10003552
dec dword [0x10089d10]
cmp dword [0x10089d74], eax
jne 0x100034fc
call fcn.100045ae
call fcn.10004876
call fcn.10003f38
call fcn.10004dac
jmp 0x10003563
cmp eax, 2
jne 0x10003556
push 0x8c
push 1
call fcn.100045bd
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x10003552
push esi
push dword [0x10089064]
call dword [0x10089d2c]
test eax, eax
push esi
je 0x1000354c
call fcn.10003f55
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x10003563
call fcn.100043a5
pop ecx
xor eax, eax
jmp 0x10003566
cmp eax, 3
jne 0x10003563
push 0
call fcn.10004120
pop ecx
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc

Function at 0x100044da
Capabilities:
Terminate process

Disassembly:
push 8
push 0x10009388
call fcn.10004fec
push 8
call fcn.100058d0
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x10089d78], esi
jne 0x1000450e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x10089d74], esi
mov al, byte [ebp + 0x10]
mov byte [0x10089d70], al
cmp dword [ebp + 0xc], edi
jne 0x10004558
cmp dword [0x1008a548], edi
je 0x10004548
mov eax, dword [0x1008a544]
sub eax, 4
mov dword [0x1008a544], eax
cmp eax, dword [0x1008a548]
jb 0x10004548
mov eax, dword [eax]
cmp eax, edi
je 0x10004529
call eax
jmp 0x10004529
push 0x1000b024
mov eax, 0x1000b020
call fcn.10004458
pop ecx
push 0x1000b030
mov eax, 0x1000b028
call fcn.10004458
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x10004589
cmp dword [ebp + 0x10], edi
jne 0x10004597
mov dword [0x10089d78], esi
push dword [ebp + 8]
call fcn.10004416
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x10004596
push 8
call fcn.1000581b
pop ecx
ret
call fcn.10005027
ret
Function at 0x10005141
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x10089060]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x10089128]
je 0x10005176
inc eax
cmp eax, 0x13
jb 0x10005167
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x10089128]
jne 0x1000529c
mov eax, dword [0x10089d1c]
cmp eax, 1
je 0x10005274
cmp eax, edx
jne 0x100051a6
cmp dword [0x10089d20], 1
je 0x10005274
cmp ecx, 0xfc
je 0x1000529c
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100051dc
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.10006d00
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.10006e00
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10005210
mov eax, edi
push eax
call fcn.10006e00
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x100097b0
push edi
call fcn.100074f0
add esp, 0x10
push edi
call fcn.10006e00
push dword [esi + 0x1008912c]
mov ebx, eax
call fcn.10006e00
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10004e30
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.10006d00
push edi
push ebx
call fcn.10006d10
push 0x10009790
push ebx
call fcn.10006d10
push dword [esi + 0x1008912c]
push ebx
call fcn.10006d10
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.100073f6
add esp, 0x2c
jmp 0x1000529c
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x1008912c]
push dword [esi]
call fcn.10006e00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.10007645
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x100073f6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1008a054], ebx
push esi
push edi
jne 0x10007476
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100074b1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x1008a054], eax
je 0x100074b1
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x1008a058], eax
call esi
cmp dword [0x10089d38], 2
mov dword [0x1008a05c], eax
jne 0x10007476
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x1008a064], eax
je 0x10007476
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x1008a060], eax
mov eax, dword [0x1008a060]
test eax, eax
je 0x100074bb
call eax
test eax, eax
je 0x100074a2
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1008a064]
test eax, eax
je 0x100074a2
test byte [ebp - 8], 1
jne 0x100074bb
cmp dword [0x10089d44], 4
jb 0x100074b5
or byte [ebp + 0x12], 0x20
jmp 0x100074da
xor eax, eax
jmp 0x100074ea
or byte [ebp + 0x12], 4
jmp 0x100074da
mov eax, dword [0x1008a058]
test eax, eax
je 0x100074da
call eax
mov ebx, eax
test ebx, ebx
je 0x100074da
mov eax, dword [0x1008a05c]
test eax, eax
je 0x100074da
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1008a054]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000860e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10004e30
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100086a9
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x10089d38]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x100086a9
cmp eax, 1
je 0x100086ca
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100086a9
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x10008676
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x100086a5
xor eax, eax
inc eax
jmp 0x100086e9
cmp edi, eax
jae 0x100086ad
xor eax, eax
jmp 0x100086e9
cmp eax, esi
jae 0x100086b4
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x10089d38]
jmp 0x100086cd
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10206973
Capabilities:
Authenticate hmac

Disassembly:
lea esp, [esp + 0xc]
jbe 0x101be3f9
shr di, 3
bswap esi
sub ecx, 1
sbb si, bx
bsf di, di
sub edi, eax
mov dword [ebp - 4], ecx
mov cx, sp
clc
mov ecx, dword [ebp - 8]
or esi, ecx
xchg si, di
sub di, ax
clc
add ecx, dword [ebp - 4]
btr di, 1
clc
inc di
bt bp, 1
shr ecx, 1
btr edi, eax
pushfd
lea edi, [ecx + 0x1a39e2eb]
or si, 0xb674
mov edi, dword [ebx + ecx*4]
stc
shl si, 3
ror si, cl
or si, bp
add edi, eax
call fcn.10205426
sub bh, 0x90
push 0x5323611
add edi, eax
adc ecx, eax
mov ebx, dword [edx + 0x20]
cmp bh, cl
add ebx, eax
mov ch, 0xfc
rcl ch, cl
add ch, bl
stc
mov dword [ebp - 8], 0
add cl, 0x5c
sar ecx, 0xd
clc
rol cl, cl
mov ecx, dword [edx + 0x18]
clc
cmp bh, dh
cmp ecx, dword [ebp - 8]
push dword [esp]
pushfd
jmp 0x101ba878
bt eax, 7
call fcn.10205094
lea esp, [esp + 0x2c]
jbe 0x101fc7c2
clc
mov edi, ecx
mov edi, dword [edx + 0x24]
jge 0x101bad96
add edi, eax
test dl, 0x92
or ch, ch
mov ebx, dword [edx + 0x20]
test edi, 0x39f7c61c
or cl, bh
shl ch, cl
add ebx, eax
bts cx, bx
mov dword [ebp - 8], 0
btc cx, si
mov ecx, dword [edx + 0x18]