joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010ea80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x101422c8], 0
je 0x1010ead7
mov eax, dword [0x101441e8]
test eax, eax
je 0x1010eab0
push eax
call dword [0x10142318]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.10111c20
mov eax, dword [0x101441e8]
test eax, eax
je 0x1010ead2
push eax
call dword [0x10142320]
mov esi, dword [ebp - 4]
jmp 0x1010eae1
mov esi, dword [ebp - 4]
jmp 0x1010eae4
push 0x14
call dword [0x101422e8]
mov esi, eax
add esp, 4
test esi, esi
jne 0x1010eaf2
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x101422cc], 0
mov ebx, dword [ebp + 8]
je 0x1010eb3c
mov eax, dword [0x101423c8]
test eax, eax
je 0x1010eb15
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x1010eb3c
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x1010eb70
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.10003506
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x1010eb49
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x1010eb62
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xf1067c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf10686
pushal
call 0xf1068c
pop ebp
sub ebp, 0x10
sub ebp, 0xb1067c
jmp 0xf106a2
mov eax, 0xb1067c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d5
mov edx, 0xd76caf16
xor byte [eax], dl
inc eax
dec ecx
jne 0xf106b9
jmp 0xf106cc
popfd
fistp dword [ebp + 0x16162a9f]
push ss
xchg edi, eax
xlatb
out dx, al
push ss
push ss
push ss
adc eax, 0x1610aedb
scasb al, byte es:[edi]
adc byte [esi], dl
push ss
push ss
lodsb al, byte [esi]
push ss
push ss
push ss
loope 0xf106dc
adc eax, 0x1a979dde
push ss
push ss
push ss
adc eax, 0x32729bd3
ljmp 0x3272
Function at 0x402704
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004035a8
test esi, esi
jne 0x40273a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403628
jmp 0x402758
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402618
mov edi, eax
test esi, esi
je 0x402758
cmp dword [ebx], 0
je 0x402758
dec esi
jmp 0x402741
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402d4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402de4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402dc4
xor eax, eax
push ebp
push 0x402dbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402e00
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402dc4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40500c], ax
mov esp, ebp
pop ebp
ret

Function at 0x40342c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x40348d
cmp word [0x406208], 0xd7b2
jne 0x403455
cmp dword [0x406210], 0
jbe 0x403455
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405050
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4034b4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x405018], 0
jne 0x4034a9
push 0
push 0x405070
push 0x405050
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x4028f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x402901
pop dword [ebp - 0x2c]
mov eax, 0x402901
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x6d6a3fca
sub dword [ebp - 0x3c], 0x1f17fa7f
mov dword [ebp - 0x38], 0xcff00c09
add dword [ebp - 0x38], 0x6243403c
mov dword [ebp - 0x34], 0x54b6b927
sub dword [ebp - 0x34], 0x86a74f9
mov dword [ebp - 0x30], 0x7b39e70e
add dword [ebp - 0x30], 0x84c618f2
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x114a9a6
add dword [ebp - 0x3c], 0x735dbfb0
mov dword [ebp - 0x38], 0xd6595c10
sub dword [ebp - 0x38], 0x94ecfa9b
mov dword [ebp - 0x34], 0xdf7ff946
sub dword [ebp - 0x34], 0x7c108cda
mov dword [ebp - 0x30], 0x7f053a02
add dword [ebp - 0x30], 0x80fac5fe
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x3527ce6b
sub eax, 0x34e6fe23
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x38f37
push 0
call eax
mov ecx, 0x2d4f8813
sub ecx, 0x2d4f4214
xor esi, esi
add esi, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x2c]
mov ebx, 0x30f2f28d
add ebx, 0x89e983c7
mov edx, dword [edi]
sub dword [ebp - 0x24], edx
xor edx, ebx
add dword [ebp - 0x1c], 0x754f851b
mov dword [esi], edx
sub dword [ebp - 0xc], esi
add esi, 0xcb645b04
add esi, 0x349ba500
add edi, 0xc44b4028
add edi, 0x3bb4bfdc
loop 0x402a15
add eax, 0xf88904cc
sub eax, 0xf887f9fd
mov ebx, eax
add eax, 0x41756822
sub eax, 0x4175681d
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e0272c5
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e0272c5
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret

Function at 0x2e0149fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030292
call fcn.2e02e16c
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014b02
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e0148ed
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010b76
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014ac0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ab7
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e0272c5
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014aa9
push esi
mov ecx, edi
call fcn.2e010c49
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e0272c5
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014b02
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014af9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e0272c5
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e0272c5
pop ecx
pop ecx
mov al, bl
call fcn.2e02e14a
ret 8
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e0272c5
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e0272c5
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8
Function at 0x2e01e341
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030586
call fcn.2e02e16c
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e45f
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e456
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e0272c5
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e449
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010c49
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e0272c5
test al, al
jne 0x2e01e3fc
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e0272c5
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e3ff
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e439
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e430
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e0272c5
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e0272c5
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e0272c5
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e14a
ret
Function at 0x46e370
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 4]
push edi
xor edi, edi
mov ax, word [esi + 0xc]
mov word [esi - 0x838], di
mov word [esi - 0x844], ax
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
jne 0x46e397
mov dword [esi - 4], edi
push ebx
mov dword [esi - 0x89c], 0x3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp dword [ebx - 4], 1
jbe 0x46e3c3
mov ecx, dword [esi - 0x848]
mov ebx, dword [esi - 0x834]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi - 0x818], eax
lea eax, [esi - 0x858]
mov dword [esi - 0x88c], ebx
mov dword [esi - 0x898], 0x40
mov dword [esi - 0x824], edx
mov dword [eax], edi
mov dword [esi - 0x820], ecx
mov dword [esi - 0x854], edi
mov dword [esi - 0x850], edi
mov dword [esi - 0x84c], edi
mov dword [esi - 0x848], edi
mov ecx, dword [esi - 0x818]
mov edx, dword [esi - 0x864]
add ecx, 0x14
cmp edx, edi
mov dword [esi - 0x830], edi
mov dword [esi - 0x840], edi
mov dword [esi - 0x83c], ecx
pop ebx
je 0x46e452
lea edx, [esi - 0x828]
push eax
push edx
push ecx
mov ecx, dword [esi - 0x82c]
lea eax, [esi - 0x810]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [esi*8]
pop edi
pop esi
pop ecx
ret
Function at 0x4b6cd0
Capabilities:
Delete file
Query environment variable
Read .ini file

Disassembly:
sub esp, 0x10
mov eax, dword [0x52ce50]
push ebx
push ebp
xor ebp, ebp
push esi
mov dword [esp + 0xc], ebp
mov ebx, dword [esp + 0xc]
cmp eax, 0xbb40e64e
push edi
mov dword [esp + 0x14], ebp
je 0x4b6d32
test eax, 0xffff0000
je 0x4b6d32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, eax
push ebp
push 4
xor esi, edx
push ebp
push ebp
xor esi, ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x52ce50]
mov edi, eax
mov eax, ecx
xor edi, ebx
not eax
mov dword [0x52ce54], eax
jmp 0x4b6d91
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
xor esi, ecx
push 0x52cc42
xor esi, edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4b6d56
call fcn.0046e460
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
call sub.comdlg32.dll_GetSaveFileNameA
cmp esi, 0xbb40e64e
je 0x4b6d77
test dword [0x52ce50], 0xffff0000
jne 0x4b6d7c
mov esi, 0xbb40e64f
mov eax, esi
mov ecx, esi
mov esi, dword [esp + 0x10]
mov dword [0x52ce50], ecx
not eax
mov dword [0x52ce54], eax
cmp ecx, 0xbb40e64e
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
je 0x4b6dc1
test ecx, 0xffff0000
je 0x4b6dc1
push ebp
mov dword [0x52ce54], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
xor ebx, esi
jmp 0x4b6e15
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor esi, eax
lea eax, [esp + 0x10]
push eax
xor esi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
cmp esi, 0xbb40e64e
mov dword [0x52cd2c], eax
je 0x4b6e02
test dword [0x52ce50], 0xffff0000
jne 0x4b6e07
mov esi, 0xbb40e64f
mov dword [0x52ce50], esi
not esi
mov dword [0x52ce54], esi
mov edx, dword [0x52caf0]
push 0xd
push 0xc
push 0x32
push 0x19
push edx
mov dword [esp + 0x24], ebp
call dword [sym.imp.GDI32.dll_Ellipse]
mov ecx, dword [0x52ce50]
mov dword [esp + 0x14], ebp
cmp ecx, 0xbb40e64e
je 0x4b6e50
test ecx, 0xffff0000
je 0x4b6e50
mov eax, ecx
not eax
mov esi, eax
jmp 0x4b6e79
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
xor eax, esi
mov esi, eax
xor eax, edi
cmp eax, 0xbb40e64e
je 0x4b6e6d
test ecx, 0xffff0000
jne 0x4b6e72
mov eax, 0xbb40e64f
mov dword [0x52ce50], eax
not eax
push ebp
push ebp
push 5
push 1
push ebp
push 0xffffffffffffffff
mov dword [0x52ce54], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4dbab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x7b0
push ebx
push esi
push edi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
xor ebx, ebx
mov al, 0x61
push ebx
mov dword [0x52cc94], ebx
mov byte [esp + 0x40], al
mov byte [esp + 0x50], al
mov byte [esp + 0x90], 0x6e
mov dword [esp + 0x41], 0x65687070
call fcn.004b6cd0
mov cl, byte [esp + 0x96]
add esp, 4
mov al, 0x6c
cmp cl, 0x74
mov dword [esp + 0x4d], 0x642e6c74
mov byte [esp + 0x51], al
mov byte [esp + 0x52], al
jne 0x4dbb33
mov dword [0x52ccb0], 1
call fcn.004dbce0
push ebx
mov dword [0x52cc48], 0xffffffff
call fcn.004b6cc0
add esp, 4
jmp 0x4dbb5d
mov byte [0x52cdec], bl
mov dword [esp + 0x41], 0x642e706c
mov byte [esp + 0x45], al
mov byte [esp + 0x46], al
mov dword [0x52ce2c], 0x48777361
mov dword [0x52ce34], 0x6c6c642e
mov ecx, dword [esp + 0x7c0]
lea eax, [esp + 0x8c]
mov edx, 0x4b76a0
mov dword [esp + 0x24], fcn.004dbce0
mov dword [esp + 0x18], fcn.0046e460
mov dword [esp + 0x5c], 0x50746547
mov dword [esp + 0x6c], 0x416c7441
mov dword [esp + 0x20], 0x401000
mov dword [esp + 0x2c], 0x5000f0
mov dword [0x52cc94], eax
mov dword [esp + 0x1c], 0x4928b0
mov dword [esp + 0x28], 0x4b76a0
mov dword [esp + 0x34], 0x449820
mov dword [esp + 0x70], 0x73697664
mov dword [esp + 0xc], ecx
mov byte [esp + 0x74], 0x65
mov eax, dword [edx]
mov esi, 0x449f60
cmp eax, 0x783410
jne 0x4dbbf7
mov dword [esp + 0xc], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], 0x425410
mov dword [esp + 0x1c], esi
call fcn.004dbce0
jmp 0x4dbc19
mov dword [esp + 0x60], 0x4c6d7265
mov dword [esp + 0x64], 0x72657961
mov dword [esp + 0x14], 0x425410
mov dword [0x52ce30], 0x786b6f6f
mov ecx, dword [esp + 0x34]
mov eax, dword [0x52cc94]
mov edx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x30], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add ecx, 0x10
push 0x52cdf0
mov dword [esp + 0x3c], 0x52a030
mov dword [esp + 0x88], 0x4b72e0
mov dword [0x52cad4], ebx
mov dword [0x52cad8], ebx
mov dword [0x52d300], eax
mov byte [0x52cdec], bl
mov byte [0x52cdf9], bl
mov byte [esp + 0x6c], 0x73
mov dword [0x52d348], ecx
mov dword [esp + 0x14], edx
call esi
push 0x52cde0
mov dword [0x52ced8], eax
call esi
mov ecx, dword [0x52d348]
mov edx, dword [sym.imp.GDI32.dll_Rectangle]
mov dword [esp + 0x80], eax
mov eax, dword [sym.imp.ADVAPI32.dll_AllocateLocallyUniqueId]
push eax
mov eax, dword [0x52cc94]
push ecx
push edx
push eax
push ebx
call fcn.004b6ea0
mov ecx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x94], ecx
call dword [0x52cc94]
add esp, 0x18
call int.004b6fe0
pop edi
pop esi
pop ebx
add esp, 0x7b0
ret
Function at 0x107c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x14ff0
call dword [sym.imp.ntoskrnl.exe_KeInitializeTimer]
push 0x206b6444
xor ebx, ebx
push 0x20
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edx, eax
cmp edx, ebx
jne 0x107ec
xor al, al
jmp 0x10824
push 8
xor eax, eax
pop ecx
mov edi, edx
rep stosd dword es:[edi], eax
push 8
mov esi, 0x107b0
pop ecx
mov edi, edx
push 0x1282e
push edx
push ebx
push ebx
push ebx
lea eax, [ebp - 4]
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push eax
push ebx
pop ebx
pop eax
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10897
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x108f9
cmp dword [ebp + 0xc], 0
je 0x108f9
mov eax, dword [esi + 0x3c]
and dword [ebp + 8], 0
mov eax, dword [eax + esi + 0x78]
add eax, esi
mov ecx, dword [eax + 0x20]
mov edi, dword [eax + 0x24]
mov ebx, dword [eax + 0x1c]
mov edx, dword [eax + 0x18]
add ecx, esi
add edi, esi
add ebx, esi
mov dword [ebp - 8], edx
test edx, edx
jbe 0x108f9
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov eax, dword [eax]
add eax, esi
push eax
call fcn.00010854
cmp eax, 1
je 0x10902
inc dword [ebp + 8]
add dword [ebp - 4], 4
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 8]
jb 0x108d5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 8]
movzx eax, word [edi + eax*2]
mov eax, dword [ebx + eax*4]
jmp 0x108fb

Function at 0x14074
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and byte [ebp - 0x10c], 0
push esi
push edi
lea eax, [ebp - 4]
push 0x40
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push 4
push eax
push 0xb
call esi
cmp eax, 0xc0000004
jne 0x140e7
push 0x206b6444
push dword [ebp - 8]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push 0
mov dword [ebp - 4], eax
push dword [ebp - 8]
push eax
push 0xb
call esi
test eax, eax
jge 0x140ef
cmp dword [ebp - 4], 0
je 0x140e7
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ExFreePool]
xor eax, eax
pop edi
pop esi
leave
ret 8
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x1e]
mov esi, dword [eax + 0xc]
lea eax, [ecx + eax + 0x20]
push eax
push 0x14c9c
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.ntoskrnl.exe__snprintf]
add esp, 0x10
lea eax, [ebp - 0x10c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00010376
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ExFreePool]
mov eax, esi
jmp 0x140e9
Function at 0x14137
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, 0x15300
push 0x208
push edi
call fcn.00014074
xor esi, esi
mov dword [0x152fc], eax
cmp eax, esi
je 0x1422a
lea eax, [ebp - 0xc]
push edi
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x18
lea eax, [ebp - 0xc]
pop ebx
mov dword [ebp - 0x24], eax
push 0x40
lea eax, [ebp - 0x14]
pop edi
mov dword [ebp - 0x2c], ebx
push esi
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x21
push 0x15508
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jl 0x1422a
push dword [0x15508]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
push 0x1000000
push 0x10
push esi
push eax
push 0xf001f
push 0x1550c
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwClose]
test eax, eax
jl 0x14222
push 4
push 0x100000
lea eax, [ebp - 4]
push 1
push eax
push esi
push 0x1000
push esi
push 0x152f8
push 0xffffffffffffffff
push dword [0x1550c]
mov dword [ebp - 4], esi
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
jl 0x14214
mov al, 1
jmp 0x1422c
push dword [0x1550c]
mov dword [0x152f8], esi
call edi
push dword [0x15508]
call edi
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x14232
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
jmp 0x14247
call 0x142bf
mov eax, dword [ebp + 8]
cmp word [eax], 0x5a4d
jne 0x142b6
mov ecx, dword [eax + 0x3c]
mov edx, 0x4550
cmp dword [ecx + eax], edx
jne 0x142b6
push ecx
mov ecx, 3
inc ecx
dec ecx
pop ecx
mov ecx, dword [eax + 0x3c]
add eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [eax], edx
jne 0x142b6
add eax, 4
mov dword [ecx], eax
push esi
push ebx
push edi
push edx
pop edx
pop edi
pop ebx
pop esi
call fcn.00014329
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov eax, dword [eax]
add eax, 0x14
mov dword [esi], eax
cmp word [eax], 0x10b
jne 0x142b6
call fcn.0001438d
mov eax, dword [esi]
mov ecx, dword [ebp + 0x14]
add eax, 0xe0
push 1
mov dword [ecx], eax
pop eax
jmp 0x142b8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10