joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004593
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmc
fcmovb st(0), st(6)
inc ebp
neg dl
mov byte [ebp - 9], 0xbf
call fcn.10004205
push eax
push esi
push dword [ebp + 8]
call fcn.100041ba
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
invalid
inc ebp
lahf

Function at 0x1000462d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec edx
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10004205
push eax
push esi

Function at 0x1000465d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.100041ba
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100041f5
sub ch, bh
bswap ecx
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
inc ebp
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x1000468b
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x10004693
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
nop
push ss
call fcn.100041f5
iretd
Function at 0x100048cd
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100048cc
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100048ea
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
clc
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10004948
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000492f
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10004938
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10004942
add ecx, eax
or byte [ecx], 4
invalid
invalid
or dword [eax + eax*2], eax
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10004924
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100048ae
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10004995
dec eax
je 0x1000498c
sub eax, 3
je 0x10004983
mov dword [ebp - 4], 0x40
jmp 0x100049b2
mov dword [ebp - 4], 4
jmp 0x10004998
mov dword [ebp - 4], 0x20
jmp 0x10004998
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100049e4
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10004964
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100041f5
rcl byte [edi + 0x32], cl
push dword fs:[ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x100049f0
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100048e3
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100048cc
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100048ea
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
clc
add byte [eax], al
invalid
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10004948
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000492f
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10004938
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10004942
add ecx, eax
or byte [ecx], 4
invalid
invalid
or dword [eax + eax*2], eax
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10004924
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100048ae
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10004995
dec eax
je 0x1000498c
sub eax, 3
je 0x10004983
mov dword [ebp - 4], 0x40
jmp 0x100049b2
mov dword [ebp - 4], 4
jmp 0x10004998
mov dword [ebp - 4], 0x20
jmp 0x10004998
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100049e4
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10004964
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100041f5
rcl byte [edi + 0x32], cl
push dword fs:[ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x100049f0
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000587d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
clc
mov ecx, dword [ebp - 0x684]
sub ecx, eax
mov dword [ebp - 0x684], ecx
push 4
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 4]
push eax
lea eax, [ebp - 0x678]
push eax
call fcn.10004166
add esp, 0xc
movsx eax, byte [ebp - 8]
mov ecx, dword [ebp - 0x678]
sub ecx, eax
mov dword [ebp - 0x678], ecx
push 4
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x678]
push eax
lea eax, [ebp - 0x38c]
push eax
call fcn.10004166
add esp, 0xc
mov eax, dword [ebp - 0x38c]
mov ecx, dword [ebp - 0x678]
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x3ac], eax
push 4
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.10004166
add esp, 0xc
mov eax, dword [ebp - 0x678]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x748], eax
mov eax, dword [ebp - 0x3ac]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax + 4]
mov dword [ebp - 0x6f8], eax
and dword [ebp - 0x700], 0
jmp 0x10005945
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
cmp eax, dword [ebp - 0x38c]
jae 0x10005997
invalid
invalid
invalid
clc

Function at 0x10007a71
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000de58]
jne 0x10007a7b
repz ret
jmp fcn.10008c52
Function at 0x5c1db0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x522015
lea edi, [esi - 0x121015]
mov dword [edi + 0x1a35fc], 0x1f030b7f
push edi
or ebp, 0xffffffff
jmp 0x5c1dda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5c1de1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c1dd0
mov eax, 1
add ebx, ebx
jne 0x5c1df3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5c1e04
jne 0x5c1e23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c1e23
dec eax
add ebx, ebx
jne 0x5c1e10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5c1de8
add ebx, ebx
jne 0x5c1e1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5c1e75
xor ecx, ecx
sub eax, 3
jb 0x5c1e3b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5c1eaa
sar eax, 1
mov ebp, eax
jmp 0x5c1e46
add ebx, ebx
jne 0x5c1e46
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c1e14
inc ecx
add ebx, ebx
jne 0x5c1e54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c1e14
add ebx, ebx
jne 0x5c1e61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5c1e56
jne 0x5c1e72
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5c1e56
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5c1e94
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5c1e86
jmp 0x5c1dd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5c1e94
add edi, ecx
jmp 0x5c1dd6
pop esi
mov edi, esi
mov ecx, 0x5376
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5c1eb2
cmp byte [edi], 0x13
jne 0x5c1eb2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5c1eb7
lea edi, [esi + 0x1b8000]
mov eax, dword [edi]
or eax, eax
je 0x5c1f26
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c14ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c1528]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5c1ee4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c1530]
or eax, eax
je 0x5c1f20
mov dword [ebx], eax
add ebx, 4
jmp 0x5c1f01
call dword [esi + 0x1c152c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5c1f57
cmp al, 0xef
ja 0x5c1f4a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5c1f2c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5c1f39
mov ebp, dword [esi + 0x1c1534]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x1c1fb2]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5c1fa3
sub esp, 0xffffff80
jmp 0x4013f0
Function at 0x490804
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4952d8
call fcn.00490a7d
push 1
call fcn.00490bcb
pop ecx
test al, al
jne 0x4906ad
push 7
call fcn.00490e32
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00490b96
mov byte [ebp - 0x24], al
mov eax, dword [0x49dc34]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4906a6
test eax, eax
jne 0x490717
mov dword [0x49dc34], ecx
push 0x4924b8
push 0x4924a4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4906fa
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4907fe
push 0x4924a0
push 0x492498
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x49dc34], 2
jmp 0x49071c
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00490d28
pop ecx
call fcn.00490e26
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x49074c
push esi
call fcn.00490c9b
pop ecx
test al, al
je 0x49074c
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00491061
call esi
call fcn.00490e2c
mov esi, eax
cmp dword [esi], edi
je 0x49076a
push esi
call fcn.00490c9b
pop ecx
test al, al
je 0x49076a
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00490f47
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00490f7a
test al, al
jne 0x4907a3
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4907ac
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00490d45
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4907fe
call fcn.00490ac3
ret
call fcn.0049051e
jmp 0x49068e

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x69781fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov ebx, dword [ebp + 0x10]
test byte [0x69783048], 1
jne 0x69782018
mov dword [ebx], 0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x78
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], str._p__lu__p__p_n
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], str.WinStationGetAllProcesses
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x69783048
mov dword [esp + 0x10], eax
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x69781ff6

Function at 0x69782060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x30
test byte [0x69783048], 1
jne 0x69782088
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x78
xor eax, eax
leave
ret 0x14
mov eax, dword [ebp + 0x18]
mov dword [esp + 0xc], str.__p___ld___p___p___p_:_stub_n
mov dword [esp + 8], str.WinStationGetProcessSid
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], 0x69783048
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
call sym._wine_dbg_log.constprop.0
jmp 0x69782072

Function at 0x697822b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x20
test byte [0x69783048], 1
jne 0x697822d8
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x78
xor eax, eax
leave
ret 0xc
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], str._p__p__p_n
mov dword [esp + 8], str.WinStationVirtualOpen
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x69783048
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp], 0
mov dword [esp + 0x10], eax
call sym._wine_dbg_log.constprop.0
jmp 0x697822c2
Function at 0x69782d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x69782d5b
cmp byte [esi + ebx - 1], 0xa
je 0x69782d2f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x69783118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4162b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x4162ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4162d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4162c0
mov eax, 1
add ebx, ebx
jne 0x4162e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4162d8
jne 0x4162f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4162d8
xor ecx, ecx
sub eax, 3
jb 0x416308
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41637a
mov ebp, eax
add ebx, ebx
jne 0x416313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x416344
inc ecx
add ebx, ebx
jne 0x416330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x416325
jne 0x416341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416325
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x416364
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x416355
jmp 0x4162c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x416364
add edi, ecx
jmp 0x4162c6
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x4163c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1606c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416381
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16074]
or eax, eax
je 0x4163bd
mov dword [ebx], eax
add ebx, 4
jmp 0x41639e
call dword [esi + 0x16070]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4163f4
cmp al, 0xef
ja 0x4163e7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4163c9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4163d6
mov ebp, dword [esi + 0x16078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416428
sub esp, 0xffffff80
jmp 0x405dd2
Function at 0x10530000
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov al, byte [0x1051b158]
test eax, eax
je 0x1053001d
mov cl, byte [0x1051b608]
or cl, 1
mov byte [0x1051b608], cl
cmp dword [0x1051b130], 0
je 0x10530035
mov dl, byte [0x1051b608]
or dl, 8
mov byte [0x1051b608], dl
xor eax, eax
mov al, byte [0x1051b608]
test eax, eax
je 0x1053009f
cmp dword [0x1051b13c], 0
je 0x10530059
push 0x1051ddfc
push 0x1051de00
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ecx, dword [0x1052a454]
push ecx
mov dl, byte [0x1051b608]
push edx
push 0x1051b3b0
push 0x1051b158
mov eax, dword [0x1051b140]
push eax
mov ecx, dword [0x1051b13c]
push ecx
mov edx, dword [0x1051b138]
push edx
mov eax, dword [0x1051b134]
push eax
mov ecx, dword [0x1051b130]
push ecx
push 0x1051b128
call fcn.10533498
add esp, 0x28
pop ebp
ret
Function at 0x1053175f
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov word [ebp - 8], 0
call fcn.10532a78
mov word [ebp - 4], ax
cmp dword [0x1052a570], 0
je 0x10531789
mov dword [0x1052ab44], 0
jmp 0x10531793
mov dword [0x1052ab44], 1
cmp dword [0x1052ab44], 0
je 0x10531993
cmp dword [0x1051ddf8], 1
je 0x105317ba
mov eax, dword [0x1051ddf4]
cmp eax, dword [0x1051ddf0]
jne 0x1053192c
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 5
idiv ecx
add edx, 1
mov dword [0x1051ddf0], edx
mov dword [0x1051ddf4], 1
mov edx, dword [0x1052c818]
and edx, 0x1f3
mov dword [0x1052a550], edx
mov eax, dword [0x1052a550]
mov ecx, dword [eax*4 + 0x1051a010]
xor ecx, 0xfd0699d6
mov dword [0x1052a540], ecx
mov dword [0x1052a544], 0
push 4
push 0
push 0x1052a544
push 0x1052a540
movzx dx, byte [0x1051a00d]
push edx
push 0x1052a6ac
call fcn.10534480
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
and eax, 0xffff
test eax, eax
jne 0x10531876
mov ecx, dword [0x1052a544]
xor ecx, 0x7b2309a7
mov edx, dword [0x1052a550]
xor ecx, dword [edx*4 + 0x1051a7e0]
test ecx, ecx
je 0x10531920
xor eax, eax
mov al, byte [0x1051cf6a]
cmp eax, 0x31
jne 0x10531888
mov word [ebp - 4], 3
xor ecx, ecx
mov cl, byte [0x1051cf6a]
cmp ecx, 0x32
je 0x105318a2
xor edx, edx
mov dl, byte [0x1051cf6a]
cmp edx, 0x33
jne 0x105318a8
mov word [ebp - 4], 0
mov dword [0x1051ddf8], 1
cmp dword [0x1052a594], 0
jne 0x1053191e
xor eax, eax
mov al, byte [0x1051cf6a]
cmp eax, 0x32
je 0x105318d4
xor ecx, ecx
mov cl, byte [0x1051cf6a]
cmp ecx, 0x33
jne 0x1053191e
mov edx, dword [0x1052a69c]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [0x1052a54c], 0xc
push 0x2010
call fcn.105300a1
push eax
call fcn.105328db
add esp, 8
mov dword [0x1052a54c], 0
mov eax, dword [0x1052a69c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [0x1052a594], 1
jmp 0x1053192a
mov dword [0x1051ddf8], 0
jmp 0x10531991
mov ecx, dword [0x1051ddf4]
add ecx, 1
mov dword [0x1051ddf4], ecx
mov edx, dword [0x1052c818]
mov dword [0x1052a540], edx
mov dword [0x1052a544], 0
push 4
push 0
push 0x1052a544
push 0x1052a540
push 0
push 0x1052a6ac
call fcn.10534480
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
and eax, 0xffff
test eax, eax
jne 0x1053198b
mov ecx, dword [0x1052a544]
xor ecx, dword [0x1052c818]
test ecx, ecx
je 0x10531991
mov word [ebp - 4], 3
jmp 0x105319f7
mov edx, dword [0x1051ddf4]
add edx, 1
mov dword [0x1051ddf4], edx
mov eax, dword [0x1052c818]
mov dword [0x1052a540], eax
mov dword [0x1052a544], 0
push 4
push 0
push 0x1052a544
push 0x1052a540
push 0
push 0x1052a6ac
call fcn.10534480
mov word [ebp - 4], ax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
test ecx, ecx
jne 0x105319f1
mov edx, dword [0x1052a544]
xor edx, dword [0x1052c818]
test edx, edx
je 0x105319f7
mov word [ebp - 4], 3
mov ax, word [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10531ec1
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1052c800
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x64
jge 0x10531f3e
mov eax, dword [ebp - 8]
cmp dword [eax*4 + 0x1052c820], 0
je 0x10531f2d
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1052c820]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x10531f2d
cmp dword [ebp - 4], 0x103
je 0x10531f2d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*4 + 0x1052c820]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x1052c820], 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10532116
add esp, 4
mov dword [ebp - 8], eax
jmp 0x10531ed9
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x64
jge 0x10531f7a
mov edx, dword [ebp - 8]
cmp dword [edx*4 + 0x1052c820], 0
je 0x10531f69
mov eax, dword [ebp - 8]
mov ecx, dword [eax*4 + 0x1052c820]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [ebp - 8]
push edx
call fcn.10532116
add esp, 4
mov dword [ebp - 8], eax
jmp 0x10531f45
mov esp, ebp
pop ebp
ret

Function at 0x10531f7e
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0x64
jge 0x10531fbe
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x1052c820], 0
je 0x10531fad
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x1052c820]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 4]
push eax
call fcn.10532116
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10531f89
push 0x1052c800
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret

Function at 0x10533cf0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x10533d65
mov eax, dword [esp + 0x10]
mov ecx, 2
sub eax, ecx
je 0x10533d3c
mov word [0x1052ab50], cx
call fcn.105361a0
add esp, 0x94
ret
cmp dword [esp + 4], 5
jne 0x10533d29
mov edx, dword [esp + 8]
mov eax, 1
cmp edx, eax
jb 0x10533d29
mov word [0x1052ab50], ax
call fcn.10533a40
call fcn.10533bd0
call fcn.105361a0
add esp, 0x94
ret