joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46abfb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x46ac42
call fcn.00471eac
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x46ac42
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x46ac5e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0046a773
mov esi, eax
test edi, edi
je 0x46ac5c
test ebx, ebx
je 0x46ac5c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x46bd96
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4bb49a
call fcn.00498842
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x46bdbb
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x46be01
lea ecx, [ebp - 0x10]
call fcn.00401600
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0047dc54
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401220
mov eax, esi
call fcn.0049891a
ret 8

Function at 0x46e179
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x46e191
mov edi, dword [esi + 0xc]
jmp 0x46e1d1
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x46e1aa
call fcn.00470123
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x46e1bf
call fcn.00470123
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x46e1d1
call fcn.00470123
call fcn.00471eac
cmp dword [eax + 0x3c], 0
je 0x46e1e6
push edi
mov ecx, ebx
call fcn.0046d074
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0046e09f
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x46e204
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x46e210
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x475491
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.00471eac
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x4754be
xor eax, eax
jmp 0x475564
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x4754b7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4754b7
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046433c
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x475515
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x475504
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.0047413f
push edi
mov ebx, eax
call fcn.0046436b
pop ecx
test ebx, ebx
je 0x475557
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.00474819
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.004748cd
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x47b334
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x47b37c
call fcn.00471eac
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x47b37c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x47b3bf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x47b3a8
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x47b3a8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x47b3bc
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x47bea6
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 1
mov ecx, esi
test al, 1
je 0x47beca
mov eax, dword [esi]
push 0
call dword [eax + 0x98]
test eax, eax
jne 0x47bed8
pop esi
ret
mov eax, dword [esi + 0x24]
mov edx, dword [esi]
push eax
call dword [edx + 0x98]
jmp 0x47bec4
xor eax, eax
inc eax
pop esi
ret
Function at 0x4826d7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.00471eac
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x4826f1
xor eax, eax
jmp 0x48273a
push ebx
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x482739
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00482675
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x483ab6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x4bc33b
call fcn.00498842
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00402560
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x483b18
call fcn.0047175d
cmp eax, 1
jne 0x483b18
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x4ee248
push eax
call fcn.004187e0
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00401bf0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401220
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401220
mov eax, esi
call fcn.0049891a
ret 0x10

Function at 0x483b41
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x4bc33b
call fcn.00498842
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00402560
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x483ba3
call fcn.0047175d
cmp eax, 1
jne 0x483ba3
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x4ee248
push eax
call fcn.004187e0
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00401bf0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401220
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401220
mov eax, esi
call fcn.0049891a
ret 0x14

Function at 0x4945a7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x50a360]
jne 0x4945b1
repz ret
jmp fcn.0049ed0c
Function at 0x4ab8bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0049bec5
and dword [ebp - 4], 0
cmp dword [0x50efe8], 0
mov ebx, eax
jne 0x4ab96c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4aba1d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4aba1d
push eax
call fcn.0049be53
mov dword [esp], 0x4f1824
push edi
mov dword [0x50efe8], eax
call esi
push eax
call fcn.0049be53
mov dword [esp], 0x4f1810
push edi
mov dword [0x50efec], eax
call esi
push eax
call fcn.0049be53
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x50eff0], eax
call esi
push eax
call fcn.0049be53
pop ecx
mov dword [0x50eff8], eax
test eax, eax
je 0x4ab96c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0049be53
pop ecx
mov dword [0x50eff4], eax
mov eax, dword [0x50eff4]
cmp eax, ebx
je 0x4ab9c4
cmp dword [0x50eff8], ebx
je 0x4ab9c4
push eax
call fcn.0049bece
push dword [0x50eff8]
mov esi, eax
call fcn.0049bece
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4ab9c4
test edi, edi
je 0x4ab9c4
call esi
test eax, eax
je 0x4ab9bb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4ab9bb
test byte [ebp - 0xc], 1
jne 0x4ab9c4
or dword [ebp + 0x10], 0x200000
jmp 0x4ab9fd
mov eax, dword [0x50efec]
cmp eax, ebx
je 0x4ab9fd
push eax
call fcn.0049bece
pop ecx
test eax, eax
je 0x4ab9fd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4ab9fd
mov eax, dword [0x50eff0]
cmp eax, ebx
je 0x4ab9fd
push eax
call fcn.0049bece
pop ecx
test eax, eax
je 0x4ab9fd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x50efe8]
call fcn.0049bece
pop ecx
test eax, eax
je 0x4aba1d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4aba1f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002a70
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0xc3
push 0x17e27d1
mov dword [esi + 8], 0x19f78c0
mov dword [esi + 0xc], 0x19b24b0
mov dword [esi + 4], 0xa3004a4
mov dword [esi + 0x10], 0x1c32b10
mov dword [esi + 0x14], 0x1c32b14
mov dword [esi + 0x18], 0x1c32b18
mov dword [esi + 0x28], 0xa300a94
mov dword [esi + 0x2c], 0x17db926
call fcn.100149e0
push 5
push 0x90
push 0x12bcd03
call fcn.100149a0
push 0x10002f80
push 0x12bcd03
push 0xe8
call fcn.10014a20
add esp, 0x20
mov dword [esi + 0x30], 0x420c0000
mov dword [esi + 0x34], 2
push 0
push 0
push 0
push 0x10002ef0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [esi + 0x78], 1
pop esi
ret

Function at 0x10003e70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
sub esi, 1
push edi
mov edi, dword [esp + 0xc]
js 0x10003f37
movzx ecx, byte [edi]
lea edi, [edi + 1]
shl ecx, 8
xor eax, ecx
lea ecx, [eax + eax]
mov edx, ecx
xor edx, 0x10213465
and eax, 0x8000
cmove edx, ecx
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x10213465
and edx, 0x8000
cmove ecx, eax
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x10213465
and ecx, 0x8000
cmove edx, eax
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x10213465
and edx, 0x8000
cmove ecx, eax
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x10213465
and ecx, 0x8000
cmove edx, eax
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x10213465
and edx, 0x8000
cmove ecx, eax
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x10213465
and ecx, 0x8000
cmove edx, eax
lea ecx, [edx + edx]
mov eax, ecx
xor eax, 0x10213465
and edx, 0x8000
cmove eax, ecx
sub esi, 1
jns 0x10003e85
pop edi
pop esi
ret

Function at 0x10003f40
Capabilities:
Read file on windows

Disassembly:
push ebx
push 0x10068800
push ecx
call fcn.1004d39f
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10003f57
pop ebx
ret
push esi
push edi
push 2
push 0
push ebx
call fcn.1004d9b3
push ebx
call fcn.1004e012
push 0
push 0
push ebx
mov esi, eax
call fcn.1004d9b3
push esi
call fcn.100463f9
push ebx
push esi
mov edi, eax
push 1
push edi
call fcn.1004d58f
push esi
push edi
call fcn.10003e70
push ebx
mov esi, eax
call fcn.1004d2b8
push edi
call fcn.10046402
add esp, 0x40
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x100130b0
Capabilities:
Create process on windows

Disassembly:
mov ecx, 0x1009dfd8
call fcn.10019c50
call fcn.10003b20
mov ecx, 0x1009df50
call fcn.100189e0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
call fcn.10015700
mov ecx, 0x10093d90
call fcn.10003ab0
mov ecx, 0x1009b0b8
call fcn.100146d0
call fcn.10015b00
mov ecx, 0x10093c78
call fcn.10003630
call fcn.1000c350
call fcn.10013e90
call fcn.10015450
call fcn.10018e10
mov ecx, 0x10099940
call fcn.100138a0
mov ecx, 0x1009e318
call fcn.1001acd0
cmp byte [0x1009e082], 0
je 0x1001312f
call fcn.10013150
cmp byte [0x10093d90], 0
je 0x1001313d
call fcn.10013390
cmp byte [0x1009e0b8], 0
jne 0x100133b0
ret
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x8c
mov eax, dword [0x1008c880]
xor eax, esp
mov dword [esp + 0x88], eax
push esi
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.100491f0
add esp, 0xc
lea ecx, [esp + 0x74]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
push 0x1009e0bc
call fcn.10005240
cmp dword [esp + 0x88], 0x10
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x94]
cmovae eax, dword [esp + 0x94]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 0x88]
mov esi, eax
cmp edx, 0x10
jb 0x1001345f
mov ecx, dword [esp + 0x74]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10013455
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10013488
push edx
push ecx
call fcn.100460a0
add esp, 8
test esi, esi
je 0x10013475
mov eax, dword [esp + 0x10]
mov dword [0x10099924], eax
mov eax, dword [esp + 0x1c]
mov dword [0x10099928], eax
mov ecx, dword [esp + 0x8c]
pop esi
xor ecx, esp
call fcn.100463c8
mov esp, ebp
pop ebp
ret
call fcn.1004afbf
int3
Function at 0x10013150
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
sub esp, 0x34
mov eax, dword [0x1008c880]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
push esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x12]
movzx esi, word [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
imul esi, eax
movzx eax, word [esp + 0x16]
imul esi, eax
xor esi, 0x22894375
cmp byte [0x1009e082], 0
je 0x100132b9
call ebp
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call ebp
push eax
call fcn.1001bcc0
add esp, 8
mov dword [esp + 0xc], eax
cmp dword [esp + 8], 2
jge 0x100131ee
lea eax, [esp + 0x20]
mov ecx, 0x1009dfd8
push eax
call fcn.10013010
push 5
mov ecx, eax
call fcn.10013680
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x20]
call fcn.10006850
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
mov edi, dword [eax + 4]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100131f7
sub ecx, edx
xor eax, eax
push ebx
mov bl, 1
test ecx, ecx
jle 0x10013224
nop dword [eax]
mov dl, byte [edi + eax]
cmp dl, 0x30
jl 0x1001321d
cmp dl, 0x39
jle 0x1001321f
xor bl, bl
inc eax
cmp eax, ecx
jl 0x10013210
xor eax, eax
test bl, bl
pop ebx
je 0x10013234
push edi
call fcn.1004ee0c
add esp, 4
pop edi
cmp esi, eax
je 0x10013269
lea eax, [esp + 0x20]
mov ecx, 0x1009dfd8
push eax
call fcn.10013010
push 5
mov ecx, eax
call fcn.10013680
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x20]
call fcn.10006850
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [esp + 8], 5
jne 0x100132b9
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 8]
movq xmm0, qword [eax]
movq qword [0x1009df9b], xmm0
mov ax, word [eax + 8]
mov word [0x1009dfa3], ax
mov eax, dword [ecx + 0xc]
movups xmm0, xmmword [eax]
movups xmmword [0x1009dfa5], xmm0
mov eax, dword [eax + 0x10]
mov dword [0x1009dfb5], eax
push dword [ecx + 0x10]
call fcn.1004ee0c
add esp, 4
mov dword [0x10093d8c], eax
mov byte [0x10093d88], 1
cmp byte [0x1009e09c], 0
je 0x10013349
call ebp
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call ebp
push eax
call fcn.1001bcc0
add esp, 8
mov esi, eax
cmp dword [esp + 8], 2
jl 0x1001335a
push str.mnrn3r
push dword [esi + 4]
call fcn.1005608d
add esp, 8
test eax, eax
jne 0x1001335a
cmp dword [esp + 8], 5
jne 0x10013349
mov eax, dword [esi + 8]
movq xmm0, qword [eax]
movq qword [0x1009df9b], xmm0
mov ax, word [eax + 8]
mov word [0x1009dfa3], ax
mov eax, dword [esi + 0xc]
movups xmm0, xmmword [eax]
movups xmmword [0x1009dfa5], xmm0
mov eax, dword [eax + 0x10]
mov dword [0x1009dfb5], eax
push dword [esi + 0x10]
call fcn.1004ee0c
add esp, 4
mov dword [0x10093d8c], eax
mov byte [0x10093d88], 1
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
xor ecx, esp
call fcn.100463c8
add esp, 0x34
ret
lea eax, [esp + 0x20]
mov ecx, 0x1009dfd8
push eax
call fcn.10013090
push 5
mov ecx, eax
call fcn.10013680
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x20]
call fcn.10006850
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10013390
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10013490
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x100134d0
Capabilities:
Create thread

Disassembly:
push ecx
push str.MutexExample
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0
test eax, eax
jne 0x100134f7
push eax
push str.Mutex_failed
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ecx
ret
push 1
lea eax, [esp + 0xb]
push eax
push 0x1c324e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10013030
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp byte [esp + 3], 0x32
mov dword [0x10099920], eax
je 0x1001354e
push 0
push 0
push 0
push 0x10012fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ecx
ret

Function at 0x100136b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x100136df
push edi
mov edi, dword [esp + 0xc]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov al, byte [edx + 0x1008c574]
xor byte [ecx + edi], al
inc ecx
cmp ecx, esi
jl 0x100136c0
pop edi
pop esi
ret

Function at 0x100136f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x1008c880]
xor eax, esp
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x34]
sub esi, 1
mov dword [esp + 4], 0xfecd11ab
mov dword [esp + 8], 0xa3c52318
mov dword [esp + 0xc], 0xccc133ca
mov dword [esp + 0x10], 0xf3216766
mov dword [esp + 0x14], 0x35151232
mov dword [esp + 0x18], 0x1dfeff29
mov dword [esp + 0x1c], 0x41cdef44
mov dword [esp + 0x20], 0x4d4e3c26
js 0x10013780
push ebx
mov bl, byte [ecx + esi]
lea edx, [ecx + esi]
push edi
mov edi, dword [esp + 0x38]
sub edi, ecx
nop word [eax + eax]
mov cl, byte [edx - 1]
lea eax, [edi + edx]
and eax, 0x1f
lea edx, [edx - 1]
mov al, byte [esp + eax + 0xc]
xor al, cl
xor al, bl
sub esi, 1
mov byte [edx + 1], al
mov bl, cl
jns 0x10013760
pop edi
pop ebx
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.100463c8
add esp, 0x24
ret

Function at 0x10013790
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x1008c880]
xor eax, esp
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], 0xfecd11ab
mov dword [esp + 4], 0xa3c52318
mov dword [esp + 8], 0xccc133ca
mov dword [esp + 0xc], 0xf3216766
mov dword [esp + 0x10], 0x35151232
mov dword [esp + 0x14], 0x1dfeff29
mov dword [esp + 0x18], 0x41cdef44
mov dword [esp + 0x1c], 0x4d4e3c26
test edx, edx
jle 0x10013809
push esi
mov esi, dword [esp + 0x30]
sub esi, ecx
lea eax, [esi + ecx]
and eax, 0x1f
lea ecx, [ecx + 1]
mov al, byte [esp + eax + 4]
xor al, byte [ecx - 2]
xor byte [ecx - 1], al
sub edx, 1
jne 0x100137f0
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100463c8
add esp, 0x24
ret
Function at 0x10014920
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword ds:[eax], edx
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x10014960
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x10]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [esp + 0x18]
push edi
call fcn.10048a90
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret

Function at 0x100149a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x10]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [esp + 0x18]
push edi
call fcn.100491f0
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret

Function at 0x100149e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esp + 0x10]
mov byte [edi], al
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x10014a20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esp + 0xc]
cmp al, 0xff
je 0x10014a40
mov byte [esi], al
mov eax, dword [esp + 0x14]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ecx
ret

Function at 0x10014a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 4]
push eax
push dword [esp + 8]
movsd qword [edi], xmm0
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x10014ab0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x10]
mov dword [edi], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret