joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10069620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100b800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10069650
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f569
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10069680
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10069680
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f569
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10069756
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100696a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100696b5
movsx eax, bl
jmp 0x100696ed
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10069717
sub eax, 1
je 0x10069717
sub eax, 2
jne 0x10069756
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f569
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10069735
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10069756
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10069756
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f569
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007f569
mov esp, ebp
pop ebp
ret 4
Function at 0x10079210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100b800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100792cc
cmp byte [esi + 0x3d], 0
je 0x100792cc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100792ba
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10079281
sub eax, 1
je 0x10079285
sub eax, 2
jne 0x100792ba
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f569
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100792a3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100792ba
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f569
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f569
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1007f569
mov esp, ebp
pop ebp
ret

Function at 0x1007c8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 3
xor eax, eax
mov dl, byte [edi + eax - 0x2dde7edd]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007c8ce
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1007c8b1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007c8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xb5
xor eax, eax
mov dl, byte [edi + eax - 0x39e8c79c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007c90e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1007c8f1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007c920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x7e
xor eax, eax
mov dl, byte [edi + eax + 0x47b30cfa]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007c94e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1007c931
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1007c960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x90
xor eax, eax
mov dl, byte [edi + eax + 0x2c0f6166]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007c98e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1007c971
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007f300
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008f9cd
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100b800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.1007f190
cmp byte [ebp - 0x84], 0
jne 0x1007f451
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x1007f395
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x100b9a98
call fcn.1007f190
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.1007f190
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x1007f404
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.1007f240
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x1007f493
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1007f489
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1007f489
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007fe8f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f569
mov esp, ebp
pop ebp
ret
Function at 0x10024ee
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0x1000
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1002566
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x10014d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002566
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10014ac
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100255d
cmp dword [ebp - 0xc], 4
jne 0x100255d
cmp dword [ebp - 0x10], eax
je 0x100255d
mov byte [ebx + 0x28], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret
Function at 0x10062bc
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1010060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x1001678
xor ebx, ebx
push 1
push ebx
mov byte [ebp - 0x205], bl
mov dword [0x10100c4], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x20c], edi
cmp edi, ebx
je 0x1006365
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1006365
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0x66
push dword [0x10100c4]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1006337
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10064e4
lea eax, [ebp - 0x204]
push eax
push 0x1001658
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
cmp esi, ebx
je 0x1006365
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
inc eax
jmp 0x10064e4
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x1006379
mov byte [ebp - 0x205], 1
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x214], 8
mov dword [ebp - 0x210], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x1010088
push 0x1010090
push 0x1006208
push 0x1001400
call fcn.0100625f
cmp dword [0x10100b4], ebx
je 0x100641c
mov al, byte [0x10100b8]
cmp al, 4
jae 0x10063c8
cmp al, bl
jne 0x100641c
mov eax, dword [0x10100a0]
mov ecx, dword [0x10100a4]
mov edx, 0x10000
mov esi, 0x80000000
and eax, edx
and ecx, esi
or eax, ecx
je 0x100641c
mov eax, dword [0x10100a8]
mov edi, dword [0x10100ac]
mov ecx, eax
and ecx, edx
mov edx, edi
and edx, esi
cmp ecx, eax
jne 0x1006416
cmp edx, edi
jne 0x1006416
push 0x1001410
push dword [0x101008c]
push dword [0x1010088]
call fcn.01002799
mov edi, dword [ebp - 0x20c]
call fcn.0100618a
test eax, eax
jge 0x100643a
cmp edi, ebx
je 0x1006430
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.01006110
jmp 0x1006330
xor esi, esi
inc esi
push esi
call dword [sym.imp.GDI32.dll_GdiSetBatchLimit]
push 0x10100cc
push 0x1001648
push ebx
call dword [sym.imp.DWrite.dll_DWriteCreateFactory]
test eax, eax
jl 0x1006425
push 0x28
call fcn.0100e1be
pop ecx
cmp eax, ebx
je 0x100646e
mov ecx, eax
call fcn.0100256e
jmp 0x1006470
xor eax, eax
mov dword [0x10100c8], eax
cmp eax, ebx
je 0x1006425
push esi
push 0xe65
push ebx
call sub.ntdll.dll_WinSqmIncrementDWORD
mov ecx, dword [0x10100c8]
call fcn.01003134
test al, al
je 0x10064a4
push dword [0x10100c8]
push ebx
call fcn.0100cfe9
test al, al
jne 0x10064a9
call fcn.01006110
mov ecx, dword [0x10100c8]
cmp ecx, ebx
je 0x10064bf
push esi
call fcn.010061e2
mov dword [0x10100c8], ebx
push 0x1010088
call fcn.0100628b
cmp byte [ebp - 0x205], bl
je 0x10064d7
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp edi, ebx
je 0x10064e2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e5c6
leave
ret 0x10
Function at 0x1007132
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1010060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.01006df9
test al, al
je 0x10071ed
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 0x205]
push eax
call fcn.01002606
test al, al
jne 0x1007173
xor al, al
jmp 0x1007219
cmp byte [ebp - 0x205], 0
je 0x10071da
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x10]
cmp byte [eax + 0x20], 0
je 0x10071da
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0x68
push dword [0x10100c4]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x100716c
lea eax, [ebp - 0x204]
push eax
push 0x404
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x43a
push dword [esi + 8]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
jmp 0x100720a
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0x81
jmp 0x1007196
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x43a
push dword [esi + 8]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 5
push 0x41e
push dword [esi + 8]
call edi
push eax
call ebx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e5c6
leave
ret

Function at 0x100d5ae
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov edi, edi
push ebx
push esi
xor esi, esi
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
mov ebx, ecx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jge 0x100d5cf
xor al, al
jmp 0x100d638
push edi
lea edi, [ebx + 4]
push edi
push 0x1001e30
push 1
push esi
push 0x1001f00
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x100d631
mov eax, dword [edi]
mov ecx, dword [eax]
add ebx, 8
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x1001a58
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x100d627
push esi
push esi
push 3
push 3
push 0xffffffffffffffff
push esi
push 0xffffffffffffffff
push dword [ebx]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jge 0x100d635
mov eax, dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebx], esi
mov eax, dword [edi]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], esi
xor al, al
jmp 0x100d637
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x100d8a1
Capabilities:
Reference sql statements

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 8], ebx
je 0x100da4b
cmp dword [ebp + 0xc], ebx
je 0x100da4b
cmp dword [ebp + 0x10], ebx
je 0x100da4b
cmp dword [ebp + 0x14], ebx
je 0x100da4b
lea eax, [ebp - 0xc]
push eax
mov esi, 0x7fffffff
push esi
push 0x1001ad0
call fcn.01003a6b
cmp eax, ebx
jl 0x100da50
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x14]
call fcn.01003a6b
cmp eax, ebx
jl 0x100da50
mov edi, dword [ebp - 0xc]
add edi, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
call fcn.01003a6b
cmp eax, ebx
jl 0x100da50
mov eax, dword [ebp - 8]
lea esi, [edi + eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0100e23e
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
cmp edi, ebx
jne 0x100d968
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x100d95e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x8007000e
jmp 0x100da50
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x1001a78
push esi
push edi
call fcn.0100cc28
mov esi, eax
add esp, 0x14
cmp esi, ebx
jge 0x100d997
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x100d990
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x100da50
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push edi
call esi
mov ebx, eax
test ebx, ebx
jne 0x100d9af
mov dword [ebp + 0x14], 0x8007000e
jmp 0x100da1e
push 0x1001a6c
call esi
mov edi, eax
test edi, edi
je 0x100d9a6
mov eax, dword [ebp + 8]
mov esi, dword [eax]
lea ecx, [ebp - 4]
call fcn.0100d884
push eax
push 0
push 0x30
push ebx
push edi
push dword [ebp + 8]
call dword [esi + 0x50]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
mov dword [ebp + 0x14], eax
call esi
push ebx
call esi
cmp dword [ebp + 0x14], 0
jl 0x100da1e
lea ecx, [ebp - 4]
call fcn.0100d70e
mov esi, dword [ebp + 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
mov dword [ebp + 0x14], eax
test eax, eax
jl 0x100da1e
cmp dword [esi], 0
jne 0x100da18
mov dword [ebp + 0x14], 0x80004005
cmp dword [ebp + 0x14], 0
jge 0x100da30
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x100da30
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi], 0
push dword [ebp - 0xc]
call fcn.0100e22d
mov eax, dword [ebp - 4]
pop ecx
test eax, eax
je 0x100da46
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x14]
jmp 0x100da50
mov eax, 0x80070057
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100e5b7
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x100ed48
call fcn.0100e944
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1010448
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100e36e
cmp eax, esi
jne 0x100e361
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100e371
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100e348
xor esi, esi
inc esi
mov eax, dword [0x1010444]
cmp eax, esi
jne 0x100e384
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100e3b3
mov eax, dword [0x1010444]
test eax, eax
jne 0x100e3ad
mov dword [0x1010444], esi
push 0x1001338
push 0x100132c
call fcn.0100e2ad
pop ecx
pop ecx
test eax, eax
je 0x100e3b3
jmp 0x100e4db
mov dword [0x1010114], esi
mov eax, dword [0x1010444]
cmp eax, esi
jne 0x100e3d7
push 0x1001328
push 0x100131c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1010444], 2
test ebx, ebx
jne 0x100e3e3
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1010454], 0
je 0x100e407
push 0x1010454
call fcn.0100e8b9
pop ecx
test eax, eax
je 0x100e407
push 0
push 2
push 0
call dword [0x1010454]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x100e463
test al, al
je 0x100e421
cmp dword [ebp - 0x1c], 0
jne 0x100e463
mov al, byte [esi]
test al, al
je 0x100e431
cmp al, 0x20
ja 0x100e431
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100e421
test byte [ebp - 0x3c], 1
je 0x100e43d
movzx eax, word [ebp - 0x38]
jmp 0x100e440
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1010110], eax
cmp dword [0x1010104], 0
jne 0x100e4b7
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x100e472
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x100e485
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100e40e
cmp dword [0x1010114], 0
jne 0x100e4c6
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1010110]
jmp 0x100e4e7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100e989
ret
call fcn.0100ea91
jmp 0x100e30e
Function at 0x402740
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
jmp 0x402750
jmp 0x40275c
pushal
xor edx, edx
nop
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov ebp, esp
mov edx, dword [edx + 0x14]
nop
jmp 0x40277e
nop
xor edi, edi
jmp 0x40278b
movzx ecx, word [edx + 0x26]
nop
jmp 0x40279f
mov esi, dword [edx + 0x28]
jmp 0x4027af
jmp 0x4027bd
xor eax, eax
jmp 0x4027cc
lodsb al, byte [esi]
nop
jmp 0x4027da
cmp al, 0x61
nop
jl 0x4027f3
nop
sub al, 0x20
jmp 0x4027f3
nop
jmp 0x4027fe
ror edi, 0xd
add edi, eax
jmp 0x40280e
dec ecx
nop
jne 0x4027af
nop
push edx
mov edx, dword [edx + 0x10]
jmp 0x40282b
mov eax, dword [edx + 0x3c]
nop
push edi
nop
add eax, edx
jmp 0x40283f
mov eax, dword [eax + 0x78]
jmp 0x402851
test eax, eax
nop
je 0x402a16
jmp 0x402865
jmp 0x40286f
add eax, edx
push eax
nop
jmp 0x402883
mov ecx, dword [eax + 0x18]
nop
mov ebx, dword [eax + 0x20]
jmp 0x402899
add ebx, edx
jmp 0x4028aa
test ecx, ecx
jmp 0x4028bc
je 0x402a04
jmp 0x4028d3
dec ecx
nop
jmp 0x4028e2
mov esi, dword [ebx + ecx*4]
add esi, edx
jmp 0x4028f5
xor edi, edi
jmp 0x402901
nop
jmp 0x402911
xor eax, eax
nop
lodsb al, byte [esi]
nop
ror edi, 0xd
nop
jmp 0x40292a
add edi, eax
cmp al, ah
nop
jne 0x402901
nop
jmp 0x402941
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jmp 0x402951
jne 0x40289b
jmp 0x402967
pop eax
nop
mov ebx, dword [eax + 0x24]
add ebx, edx
nop
jmp 0x402983
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
nop
add ebx, edx
nop
mov eax, dword [ebx + ecx*4]
nop
jmp 0x4029a2
add eax, edx
nop
jmp 0x4029b7
mov dword [esp + 0x24], eax
pop ebx
pop ebx
nop
jmp 0x4029d0
popal
nop
jmp 0x4029e2
pop ecx
nop
pop edx
jmp 0x4029f3
push ecx
jmp 0x402a02
jmp eax
jmp 0x402a14
pop eax
nop
nop
jmp 0x402a27
pop edi
nop
pop edx
nop
mov edx, dword [edx]
nop
jmp 0x402a42
jmp 0x40277e
Function at 0x40b63a
Capabilities:
Encode data using xor
Terminate process

Disassembly:
adc cl, dl
imul esp, dword [ebx], 0x34
shr edx, 1
rcr eax, 1
sbb al, 0xdb
jne 0x40b60c
jg 0x40b5f6
mov esi, eax
mul dword [eax + esi + 0x1c]
xor byte [ebx + ecx*4], bl
enter 0x448b, 0x24
sbb bh, dh
out 3, al
sal dword [edx + 0xe], 1
xor byte [ebx + ecx*4], bl
enter 0x448b, 0x24
sbb bh, dh
out 3, al
sal dword [edx + 0xe], 1
cmp edx, dword [esp + 0x14]
ja 0x40b625
jb 0x40b601
cmp esp, dword [edx]
and al, 0xf
jbe 0x40b67d
dec esi
xor edx, edx
mov eax, esi
dec edi
jne 0x40b634
neg edx
neg eax
sbb edx, 0
jbe 0x40b694
pop edi
insb byte es:[edi], dx
adc byte [eax], al
push ebp
mov ebp, esp
cmp al, 0xa9
push 0xf40c742
push 0x40b9bb
dec esi
mov eax, dword [pe_dos_header]
push eax
mov dword fs:[edx], ecx
add byte [eax], al
push cs
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [0xb240c0d0]
pop ecx
xor edi, 0x54
inc eax
inc ecx
add bh, bh
or dword [0x414058], 0xffffffff
invalid
inc esi
test al, 0xd4
pop esp
aam 0x5c
inc eax
add byte [ebx + 0x7a0b840d], cl
add byte [ecx + 0x5846ff08], cl
mov word [eax], es
mov eax, dword [esp + edx*4]
or eax, dword [ecx]
mov dword [eax], ecx
fsub st(2), st(0)
add byte [ecx - 0x1523c1f8], cl
inc eax
add byte [ebx + 0x4050a38e], cl
inc ecx
sub eax, ebp
lahf
add al, byte [eax]
add byte [ebx + 0x4113503d], al
add byte [eax], al
xor ecx, dword [eax + ebp*2]
inc esp
mov ecx, 0xcfff0009
loopne 0x40b67a
inc eax
add byte [ecx - 0x18], bl
jo 0x40b6c2
or eax, dword [eax]
push 0x40d00c
push 0x40d008
call 0x8b40b8fc
mov eax, dword [0x410b90]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x410b8c]
jle 0x40b72a
loopne 0x40b737
lea ecx, [0x458d50d4]
clc
push eax
inc dword [esi]
aad 0xc0
sub al, 0xc9
push 0x4091a7
push str._s:_Invalid_Concurrency__Range_0.._d__n
rol byte [eax], 1
call fcn.0040b92c
call dword [0xadc0dd]
mov ecx, dword [ebp - 0x20]
fmul dword [eax]
push dword [ebp - 0x20]
push dword [eax]
aam 0xae
jne 0x40b6fc
call 0x3fcd00
add esp, 0x30
test al, 0x45
movsb byte es:[edi], byte [esi]
cdq
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp + 0x55]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call fcn.0040b926
pop ecx
pop ecx
jmp 0x40b73a
add byte [ecx + 0x59], bl
ret