joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x4051bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4087b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004042aa
and dword [ebp - 0x14], 0
cmp dword [0x40c7d0], 0
mov dword [ebp - 0x18], eax
jne 0x40526e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405316
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405316
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40c7d0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40c7d4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40c7d8], eax
call edi
push eax
call esi
mov dword [0x40c7e0], eax
test eax, eax
je 0x40526e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40c7dc], eax
mov eax, dword [0x40c7dc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4052c7
cmp dword [0x40c7e0], ecx
je 0x4052c7
push eax
call esi
push dword [0x40c7e0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4052c7
test ebx, ebx
je 0x4052c7
call edi
test eax, eax
je 0x4052be
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4052be
test byte [ebp - 8], 1
jne 0x4052c7
or dword [ebp + 0x10], 0x200000
jmp 0x4052fa
mov eax, dword [0x40c7d4]
cmp eax, dword [ebp - 0x18]
je 0x4052fa
push eax
call esi
test eax, eax
je 0x4052fa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4052fa
mov eax, dword [0x40c7d8]
cmp eax, dword [ebp - 0x18]
je 0x4052fa
push eax
call esi
test eax, eax
je 0x4052fa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40c7d0]
call esi
test eax, eax
je 0x405316
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405318
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405526
leave
ret

Function at 0x405526
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4087b0]
jne 0x405530
repz ret
jmp fcn.00406693
Function at 0x4010b0
Capabilities:
Access peb ldr_data
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov edx, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
cmp word [eax], 0
je 0x401220
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4010c8
sub eax, edx
sar eax, 1
mov ebx, eax
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 8], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
sub esp, 0x20
mov esi, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
sub esp, 0xc
mov edi, eax
mov dword [esp + 8], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
sub esp, 0x20
mov dword [esp], 0xfffffff5
call dword [sym.imp.kernel32.dll_GetStdHandle]
lea edx, [ebp - 0x1c]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
cmp dword [ebp - 0x1c], esi
jae 0x4011c2
test byte [section..data], 2
jne 0x4011f0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], str.Failed_to_write_output_n
mov dword [esp + 8], str.write_to_stdout
mov dword [esp + 4], 0x403000
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x4011c2
xor ebx, ebx
jmp 0x4010d7
Function at 0x401350
Capabilities:
Access peb ldr_data
Get process heap flags
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x24], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x28], eax
call eax
mov ecx, 0x1000
mov ebx, eax
sub esp, 0xc
mov eax, dword [0x407004]
mov edx, ebx
jmp 0x4013c6
mov ebx, eax
add eax, 1
movzx ebx, byte [ebx + section..bss]
mov dword [0x407004], eax
cmp bl, 0xa
je 0x401580
lea edi, [esi + 1]
cmp edi, ecx
jge 0x401420
mov byte [edx + esi], bl
mov esi, edi
cmp dword [0x407000], eax
ja 0x4013a0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x407000
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x406000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReadFile]
mov edx, dword [ebp - 0x1c]
sub esp, 0x14
test eax, eax
je 0x401468
mov eax, dword [0x407000]
test eax, eax
je 0x401468
mov ecx, dword [ebp - 0x20]
mov eax, 1
xor ebx, ebx
jmp 0x4013a5
add ecx, ecx
mov eax, dword fs:[0x18]
test edx, edx
je 0x401548
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov ecx, dword [ebp - 0x1c]
mov edx, eax
sub esp, 0x10
mov eax, dword [0x407004]
jmp 0x4013c1
mov ebx, edx
test esi, esi
je 0x401593
mov byte [edx + esi], 0
lea eax, [ebx + esi - 1]
cmp byte [eax], 0xd
jne 0x401488
mov byte [eax], 0
lea esi, [esi]
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [ebp - 0x20], edx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x18
mov esi, eax
lea eax, [eax + eax]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x28]
call eax
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call edx
sub esp, 0x18
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x28]
call eax
mov ecx, dword [ebp - 0x1c]
mov edx, eax
sub esp, 0xc
mov eax, dword [0x407004]
jmp 0x4013c1
mov byte [edx + esi], 0
mov ebx, edx
test esi, esi
je 0x401488
jmp 0x401476
xor ecx, ecx
jmp 0x401539
Function at 0x401ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d3b
cmp byte [esi + ebx - 1], 0xa
je 0x401d0f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4070c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4026e0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
Function at 0x474e69
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x474e97
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x474eb5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00474dd3
jmp 0x474eb5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x474eb5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00474dd3
test edi, edi
mov eax, edi
jne 0x474e9f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4bea44]
test ecx, ecx
je 0x474f68
jmp 0x474e68
ret 8

Function at 0x48c020
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
in eax, dx
ljmp 0x1e47
xchg esp, eax
test eax, 0xe3827663
enter 0x228e, 0x34
lcall 0x50af, 0xda59c588
scasb al, byte es:[edi]
xchg ebp, eax
adc al, byte [ecx - 0x221182c0]
jle 0x48bfbf
invalid

Function at 0x48cfc0
Capabilities:
Encode data using xor

Disassembly:
call 0x7082d20
stosb byte es:[edi], al
jnp fcn.0048cfc0
ljmp 0xe20b:0xaab9ac06
cmp eax, 0xe80d7cef
wait
pop eax
jp 0x48cf45
jl 0x48cfab
call 0xa2c3283e
wait
cmp eax, 0x9847b955
wait
push ds
jbe 0x48cf9a
xor byte [ebp + 0x47], dl
sbb al, 0x94
std
leave
test eax, 0x579ce33e
pop ds
and esi, ebp
sbb al, 0xe
push eax
repne stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
sbb dword [ebx - 0x7d85e096], ebx
xor al, 0xc2
leave
sub byte [ebp - 0x38], cl
pop es
xor bh, bh
push ecx
aaa
push ebp
jno 0x48cfc1
push ss
mov ecx, esp
xor esp, 0xc3925d0
stc
cmp dword [edx + 0x3f], ebx
cmc
aas
call 0xc4d10235
add al, 0xb3
aam 4
mov dword [0x5c1d95d7], eax
pop esp
jge 0x48cf9c
dec edi
shr ebp, 0xb8
sbb edx, esi
inc esp
add dword [esi + 0x44c55fb9], ecx
outsd dx, dword [esi]
mov word [ecx - 0x53], ss
out 0xf5, eax
pop edi
pop ds
sbb bl, byte [eax + esi*4]
push ecx
jns 0x48cff2
invalid
Function at 0x4ec3cc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50e7a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov byte [esi + 8], al
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov cl, byte [esp + 7]
mov dword [esp + 0x14], eax
mov byte [esi + 0x18], cl
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dl, byte [esp + 7]
mov dword [esi + 0x2c], eax
mov byte [esi + 0x28], dl
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov cl, byte [esp + 7]
mov dword [esi + 0x3c], eax
mov byte [esi + 0x38], cl
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dl, byte [esp + 7]
mov dword [esi + 0x4c], eax
mov byte [esi + 0x48], dl
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov ecx, esi
mov byte [esp + 0x14], 4
mov dword [esi], 0x51e8a8
call fcn.004ec810
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0xfe49a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1028e10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1042014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x10430ec
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.00ff80c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x1042a8c
push eax
call fcn.00ff80c0
mov esi, dword [0x10430fc]
xor ebx, ebx
mov edi, dword [0x1043100]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x1046390], bl
mov eax, ebx
mov ecx, 0x10430ec
cmovae ecx, dword [0x10430ec]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x10464a0], al
inc ebx
cmp ebx, 0x100
jl 0xfe4a20
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x1046390]
movzx eax, byte [esi + 0x10464a0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0xfe4a74
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x1046390]
mov byte [esi + 0x1046390], al
inc esi
mov byte [edi + 0x1046390], dl
cmp esi, 0x100
jl 0xfe4a50
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00fe4690
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0xfe4ac9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xfe4abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xfe4b1f
push edx
push ecx
call fcn.00ffd663
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0xfe4b0b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xfe4b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xfe4b1f
push edx
push ecx
call fcn.00ffd663
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.01016c6a
int3
Function at 0xfe70a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x1042014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x5f06d6
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0xfe7289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0xfe7289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.010140f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x5f07a0
nop
test eax, eax
je 0xfe7289
push 4
push 0x1000
push 4
push 0
call 0x5f0000
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x4500ad
nop
test eax, eax
je 0xfe7289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x1038df8
push dword [esp + 0x30]
call 0x450500
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0xfe71ac
push 0x1038dfc
push 0x1038e14
call 0x5e0b7a
nop
push eax
call 0x45027e
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x45038a
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0xfe7289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x5f0609
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0xfe7243
mov dword [esp + 0xc], eax
call fcn.00fe6ef0
push eax
call 0x5d068a
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x5f0609
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0xfe71f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x5f0609
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x450776
nop
push dword [esp + 0x24]
call 0x5e0c7b
nop
push 0x8000
push 0
push esi
call 0x5f053c
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.00ffcff1
mov esp, ebp
pop ebp
ret
Function at 0xfeaf20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1029726
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x1042014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x414], ebx
push 0
mov dword [ebp - 0x414], ebx
call fcn.01018b63
push eax
call fcn.01016660
add esp, 8
call fcn.0101663f
cdq
mov ecx, 0x3313
idiv ecx
mov edi, edx
call fcn.0101663f
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov esi, edx
shr esi, 0x1f
add esi, edx
imul esi, edi
call fcn.0101663f
imul edx, eax, 0x4d
lea ecx, [ebp - 0x444]
add edx, 0x64
add edx, esi
call fcn.00fe45b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
lea edx, [ebp - 0x410]
cmovae eax, dword [ebp - 0x444]
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0xfeafd0
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0xfeafe6
push 0x40
push 0
push 0x1048560
sub esi, ecx
call fcn.010140f0
add esp, 0xc
mov dword [0x1048554], 0
mov edx, esi
mov dword [0x1048550], 0
lea ecx, [ebp - 0x410]
mov dword [0x1048540], 0x67452301
mov dword [0x1048544], 0xefcdab89
mov dword [0x1048548], 0x98badcfe
mov dword [0x104854c], 0x10325476
call fcn.00fe5530
call fcn.00fe55f0
mov ecx, 0x10465a0
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x418], 0xf
mov byte [ebp - 0x42c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xfeb071
sub ecx, edx
push ecx
push 0x10465a0
lea ecx, [ebp - 0x42c]
call fcn.00ff80c0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0xfeb0cc
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xfeb0c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xfeb18c
push edx
push ecx
call fcn.00ffd663
add esp, 8
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x41c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
cmp eax, 1
jb 0xfeb187
dec eax
mov ecx, 0xa
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x418], 0x10
lea eax, [ebp - 0x42c]
cmovae eax, dword [ebp - 0x42c]
push ecx
inc eax
mov ecx, ebx
push eax
call fcn.00ff80c0
mov edx, dword [ebp - 0x418]
cmp edx, 0x10
jb 0xfeb169
mov ecx, dword [ebp - 0x42c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0xfeb15f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xfeb18c
push edx
push ecx
call fcn.00ffd663
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00ffcff1
mov esp, ebp
pop ebp
ret
call fcn.00ff8200
call fcn.01016c6a
int3
Function at 0xffdcc7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0x780438
nop
test eax, eax
je 0xffdd07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xffdd07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xffdd07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xffdd07
cmp dword [ecx + 0x74], 0xe
jbe 0xffdd07
cmp dword [ecx + 0xe8], 0
je 0xffdd07
mov al, 1
ret
xor al, al
ret
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x5c6ae8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x5c6ae4]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call fcn.0041da44
jmp 0x4011d3
mov eax, dword [0x5c6ae4]
test eax, eax
jne 0x4011c9
mov dword [0x5c6ae4], 1
mov dword [esp + 4], 0x5c9014
mov dword [esp], 0x5c900c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x4011d3
mov dword [0x5c601c], 1
mov eax, dword [0x5c6ae4]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x5c9008
mov dword [esp], section..CRT
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x5c6ae4], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x5c6ae8
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call fcn.0040e7b1
mov dword [esp], 0x40e8cc
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x5c6074], eax
mov dword [esp], section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.0040e150
mov eax, dword [0x5c6004]
mov dword [esp + 4], 0x5c6008
mov dword [esp], eax
call fcn.004013c8
call fcn.0040df8c
mov eax, dword [0x4c72d0]
mov edx, dword [0x5c600c]
mov dword [eax], edx
mov ecx, dword [0x5c600c]
mov edx, dword [0x5c6008]
mov eax, dword [0x5c6004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004bdd10
mov dword [0x5c6014], eax
mov eax, dword [0x5c6018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x5c6014]
mov dword [esp], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x5c601c]
test eax, eax
jne 0x4012de
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x5c6014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret