joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56c740
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x56c75f
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x56c774
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x56c7cb
mov cl, byte [esp + 0xc]
test cl, cl
je 0x56c7d7
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x56c7a8
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x56c7c0
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x56c7ec
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
mov byte [edi + 0x44], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop esi
ret

Function at 0x56c800
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x56c81f
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x56c834
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x56c88b
mov cl, byte [esp + 0xc]
test cl, cl
je 0x56c897
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x44]
mov dword [edx], eax
mov byte [eax], cl
mov eax, dword [esi + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x56c868
movzx eax, byte [esp + 0xc]
push eax
mov eax, dword [edx]
inc eax
push eax
push esi
call ecx
add esp, 0xc
jmp 0x56c880
push dword [eax + 0x38]
movzx eax, byte [esp + 0x10]
push eax
mov eax, dword [edx]
inc eax
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov ecx, eax
movzx eax, byte [esp + 0xc]
cmp ecx, eax
je 0x56c8a1
pop edi
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x10]
mov dword [eax], 0
pop edi
mov eax, 1
pop esi
ret
Function at 0x56cbf0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x56cc08
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x56cc1e
push 1
lea eax, [esp + 0xc]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x56cc33
push dword [eax + 0x38]
lea eax, [esp + 0xc]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x56cc43
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov al, byte [esp + 8]
cmp al, 0x21
je 0x56cc86
cmp al, 0x2c
je 0x56cc75
cmp al, 0x3b
mov eax, dword [esp + 0xc]
je 0x56cc68
mov dword [eax], 0
xor eax, eax
mov dword [esi + 0x40], 0x6b
pop esi
ret
mov dword [eax], 4
mov eax, 1
pop esi
ret
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], 2
mov eax, 1
ret
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], 3
mov eax, 1
ret
Function at 0x56cca0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x48]
test byte [eax], 8
jne 0x56ccb8
mov dword [esi + 0x40], 0x6f
xor eax, eax
pop esi
ret
push esi
push esi
call fcn.0056ce50
add esp, 8
test eax, eax
je 0x56ccb4
lea eax, [esi + 4]
push eax
push esi
call fcn.0056ce50
add esp, 8
test eax, eax
je 0x56ccb4
mov ecx, dword [esi + 0x48]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x56ccf7
push 3
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x56cd08
push dword [ecx + 0x38]
lea eax, [esp + 0x10]
push 3
push 1
push eax
call ebp
add esp, 0x10
cmp eax, 3
je 0x56cd2b
push dword [esi + 0x14]
mov dword [esi + 0x40], 0x66
call fcn.0056d700
add esp, 4
mov dword [esi + 0x14], 0
xor eax, eax
pop ebp
pop esi
ret
mov dl, byte [esp + 0xc]
movzx ecx, dl
mov eax, ecx
and ecx, 7
shr eax, 4
inc ecx
and eax, 7
inc eax
push ebx
mov dword [esi + 8], eax
mov bl, dl
movzx eax, byte [esp + 0x11]
shr bl, 3
mov dword [esi + 0xc], eax
and bl, 1
mov al, byte [esp + 0x12]
mov byte [esi + 0x10], al
push edi
test dl, dl
jns 0x56ce30
mov eax, 1
shl eax, cl
push 0
push eax
call fcn.0056d7b0
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
jne 0x56cd88
pop edi
pop ebx
pop ebp
mov dword [esi + 0x40], 0x6d
pop esi
ret
mov byte [eax + 8], bl
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp dword [eax], ebx
jle 0x56ce37
xor edi, edi
lea ebx, [ebx]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x56cdb9
push 3
lea ecx, [esp + 0x18]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x56cdca
push dword [ecx + 0x38]
lea eax, [esp + 0x18]
push 3
push 1
push eax
call ebp
add esp, 0x10
cmp eax, 3
jne 0x56ce10
mov eax, dword [esi + 0x14]
inc ebx
mov ecx, dword [eax + 0xc]
movzx eax, byte [esp + 0x14]
mov byte [edi + ecx], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [esp + 0x15]
mov byte [ecx + edi + 1], al
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xc]
movzx eax, byte [esp + 0x16]
mov byte [ecx + edi + 2], al
add edi, 3
mov eax, dword [esi + 0x14]
cmp ebx, dword [eax]
jl 0x56cda0
pop edi
pop ebx
pop ebp
mov eax, 1
pop esi
ret
push dword [esi + 0x14]
call fcn.0056d700
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x40], 0x66
xor eax, eax
pop edi
pop ebx
pop ebp
pop esi
ret
mov dword [esi + 0x14], 0
pop edi
pop ebx
pop ebp
mov eax, 1
pop esi
ret

Function at 0x56ce50
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x56ce6e
push 2
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x56ce83
push dword [ecx + 0x38]
lea eax, [esp + 0xc]
push 2
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 2
je 0x56ce93
mov dword [esi + 0x40], 0x66
xor eax, eax
pop esi
ret
mov ax, word [esp + 8]
movzx ecx, ah
movzx eax, al
shl ecx, 8
or ecx, eax
mov eax, dword [esp + 0xc]
pop esi
mov dword [eax], ecx
mov eax, 1
ret
Function at 0x56ceb0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push edi
push 0x4c
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x56ceda
mov eax, dword [esp + 0x18]
test eax, eax
je 0x56ced3
mov dword [eax], 0x6d
xor eax, eax
pop edi
add esp, 8
ret
push esi
push 0x4c
push 0
push edi
call sub.MSVCRT.dll_memset
push 0x614c
push 1
mov dword [edi + 0x34], 0
mov dword [edi + 0x14], 0
call dword [sym.imp.MSVCRT.dll_calloc]
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x56cf29
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x56cf17
mov dword [eax], 0x6d
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
pop esi
pop edi
add esp, 8
ret
push 0x614c
push 0
push esi
call sub.MSVCRT.dll_memset
mov eax, dword [esp + 0x24]
add esp, 0xc
mov dword [edi + 0x48], esi
mov dword [esi + 0x3c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 0x38], 0
mov dword [esi], 8
mov ecx, dword [edi + 0x48]
mov dword [edi + 0x44], eax
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x56cf77
push 6
lea ecx, [esp + 0xc]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x56cf8c
push dword [ecx + 0x38]
lea eax, [esp + 0xc]
push 6
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 6
je 0x56cfa1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x56cfcd
mov dword [eax], 0x66
jmp 0x56cfcd
push 3
lea eax, [esp + 0xc]
mov byte [esp + 0x12], 0
push eax
push str.GIFVER
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x56cfe4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x56cfcd
mov dword [eax], 0x67
push esi
mov esi, dword [sym.imp.MSVCRT.dll_free]
call esi
push edi
call esi
add esp, 8
xor eax, eax
pop esi
pop edi
add esp, 8
ret
push edi
call fcn.0056cca0
add esp, 4
test eax, eax
jne 0x56d016
push esi
mov esi, dword [sym.imp.MSVCRT.dll_free]
call esi
push edi
call esi
mov eax, dword [esp + 0x24]
add esp, 8
test eax, eax
je 0x56d00e
mov dword [eax], 0x68
pop esi
xor eax, eax
pop edi
add esp, 8
ret
mov dword [edi + 0x40], 0
cmp byte [esp + 0xb], 0x39
sete al
mov byte [esi + 0x6148], al
mov eax, edi
pop esi
pop edi
add esp, 8
ret

Function at 0x56d260
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x56d27f
push 1
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x56d294
push dword [edi + 0x38]
lea eax, [esp + 0x10]
push 1
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jb 0x56d2aa
movzx ecx, byte [esp + 0xc]
cmp ecx, 8
jle 0x56d2af
mov dword [esi + 0x40], 0x66
pop edi
xor eax, eax
pop esi
ret
mov eax, 1
mov dword [edi + 8], ecx
shl eax, cl
inc ecx
mov dword [edi + 0xc], eax
inc eax
mov dword [edi + 0x10], eax
inc eax
mov dword [edi + 0x14], eax
mov eax, 1
shl eax, cl
mov dword [edi + 0x1c], eax
mov eax, 0x1002
mov dword [edi + 0x18], ecx
mov ecx, 0x1000
mov byte [edi + 0x44], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x20], 0x1002
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
add edi, 0x2144
rep stosd dword es:[edi], eax
pop edi
mov eax, 1
pop esi
ret
Function at 0x56dec9
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x621540], 0
push ebx
push esi
mov esi, 0x621548
jne 0x56def5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x621560], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x621540], 1
push dword [0x621560]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x56df92
push 0x14
push 8
push dword [0x6201c4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x56dfbc
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x621544]
test eax, eax
je 0x56df37
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x621544], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x56dfc1
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x621560]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x6201c4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x56dfbc
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x56e3b9
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x184
push 8
push dword [0x6201c4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x621ac4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x621ac8], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00570f92
mov dword [esi + 0x58], 0x56efcc
mov eax, esi
mov dword [esi + 0x5c], 0x56f018
mov dword [esi + 0x10], fcn.0056eb6d
mov dword [esi + 0x30], 0x56ea5f
mov dword [esi + 0x64], 0x56f0a2
mov dword [esi + 0x60], 0x56f05a
mov dword [esi + 0x34], 0x56e70f
mov dword [esi + 0x24], 0x56e6e6
mov dword [esi + 0x28], 0x56e6bb
mov dword [esi + 0x2c], 0x56e60d
mov dword [esi + 0x44], 0x56edd2
pop esi
ret 4
Function at 0x574226
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xd4]
mov dword [esp + 4], eax
test edx, edx
je 0x5742dc
imul eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
neg eax
add ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
push ebp
push edi
lea edi, [ecx + eax*4]
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xcc]
mov ebp, edi
imul ecx, ebx
add ecx, dword [esi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x5742bc
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 4]
xor byte [ecx], al
add ecx, esi
dec edx
jne 0x574297
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec edx
inc ebx
cmp dword [esi + 0xe8], 0
mov dword [esp + 0x3c], edx
jne 0x5742d1
add edi, dword [esp + 0x14]
jmp 0x5742d5
add edi, dword [esp + 0x24]
test edx, edx
jne 0x574275
pop edi
pop ebp
pop ebx
pop esi
pop ecx
pop ecx
ret 0x24

Function at 0x5745e7
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ecx
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], edx
test ebx, ebx
je 0x5746c1
imul eax, dword [esp + 0x1c], 3
mov ecx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x24]
neg ecx
push esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30]
push edi
imul edi, dword [esp + 0x30], 3
mov dword [esp + 0x10], ecx
add eax, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], edi
mov esi, dword [eax + 0xcc]
imul esi, ebp
mov dword [esp + 0x34], edi
add esi, dword [eax + 0xc8]
add esi, dword [esp + 0x28]
test edx, edx
jle 0x574697
mov ebp, dword [esp + 0x34]
mov ebx, 0xff
sub ebx, dword [esp + 0x40]
mov edi, edx
movzx eax, byte [esi]
movzx ecx, byte [ebp]
imul ecx, dword [esp + 0x40]
imul eax, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
inc ebp
mov byte [esi], al
inc esi
dec edi
jne 0x57465f
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
dec ebx
inc ebp
cmp dword [eax + 0xe8], 0
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
jne 0x5746ae
add edi, ecx
jmp 0x5746b2
add edi, dword [esp + 0x24]
mov dword [esp + 0x38], edi
test ebx, ebx
jne 0x574635
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0x28
Function at 0x574ce1
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 0xd4]
mov dword [esp + 8], eax
test esi, esi
je 0x574d96
imul eax, dword [esp + 0x20]
imul edx, dword [esp + 0x28], 3
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x34]
add eax, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 0xcc]
mov ebp, edx
imul ecx, ebx
add ecx, dword [edi + 0xc8]
add ecx, eax
cmp dword [esp + 0x38], 0
jle 0x574d77
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x10]
mov al, byte [ebp + 2]
xor byte [ecx + 2], al
mov al, byte [ebp + 1]
xor byte [ecx + 1], al
mov al, byte [ebp]
lea ebp, [ebp + 3]
xor byte [ecx], al
add ecx, edi
dec esi
jne 0x574d52
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
dec esi
inc ebx
cmp dword [edi + 0xe8], 0
mov dword [esp + 0x3c], esi
jne 0x574d8c
add edx, dword [esp + 0x14]
jmp 0x574d90
add edx, dword [esp + 0x24]
test esi, esi
jne 0x574d30
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 0x24
Function at 0x401571
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [0x41d040]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x471448]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x4015d8
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.00401803
lea ecx, [esp + 0x1c]
call fcn.0040133b
cmp eax, dword [esp + 0x14]
je 0x4015f0
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.00401834
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x4015a8
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004025da
add esp, 0x2c
ret
mov eax, dword [ebp + 0x24]
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.00401834
jmp 0x4015da

Function at 0x401673
Capabilities:
Access peb ldr_data
Create thread
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
sub cx, 0x1f9
mul edi
dec cx
mul di
mul ebx
sub ax, 0x22b
or edi, ebx
shr cx, 2
rcl eax, 0x6e
rol ax, 0x19
rcl cx, 0xcb
mul si
mov si, 0x1b0
rcr esi, 0xed
inc si
dec dx
movsx ebx, si
movsx ecx, si
rcl cx, 0x33
mov edx, esi
shr ax, 0xb9
dec cx
ja 0x4016cf
test edx, 0x43
ja 0x4016f0
dec bx
imul eax
jmp 0x4016df
rol bx, 0x64
sub di, cx
ror esi, 0x18
ror ecx, 0xef
movsx ebx, bx
rcl eax, 0x5b
mul esi
jae 0x4016f0
inc ax
movsx ecx, si
rcr ebx, 0x8e
jmp 0x40170b
and ecx, 0x33b
ror edx, 0x56
rcr di, 0xc6
or esi, 0x389
movzx edi, ax
movsx edi, si
imul edx
mul cx
ror ax, 0x4e
sub ebx, 0xb9
rcl cx, 0x60
jb 0x40172a
imul si
mul eax
inc esi
xor bx, dx
inc ebx
jmp 0x40173c
mul eax
add eax, edi
mov ax, 0x2a4
mul ebx
ror edi, 0xfc
xor di, 0xdb
movsx ecx, di
dec bx
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x471448], eax
push 0x27
mov esi, 0x470180
mov edx, 0x547
push 0x41d950
mov ecx, esi
call fcn.00401134
pop ecx
pop ecx
mov edx, 0x8aafdc01
call fcn.00401571
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0x4e4
push esi
call eax
test eax, eax
je 0x4017ed
push 4
call fcn.004025e8
pop ecx
lea ecx, [ebp - 8]
xor esi, esi
push ecx
push esi
push eax
push 0x401a9a
push esi
push esi
mov dword [eax], 0x40160e
call fcn.004059fb
add esp, 0x18
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4017e6
cmp dword [ebp - 8], esi
je 0x4017f6
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [ebp - 8], eax
jne 0x4017cf
push 5
jmp 0x4017f8
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.004022f8
add esp, 0xc
test eax, eax
je 0x4017ed
push 2
jmp 0x4017f8
mov dword [ebp - 8], esi
push 6
jmp 0x4017f8
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
push 1
call fcn.00402015
int3
Function at 0x10002030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10059669
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006e020]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
mov edx, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edx
mov dword [esp + 0x1c], edi
mov dword [esi], vtable.CAddFilesTreeCtrl.0
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], eax
call fcn.1000c820
mov dword [esi + 0x38], eax
mov bl, 1
mov byte [eax + 0x15], bl
mov eax, dword [esi + 0x38]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x38]
mov dword [eax], eax
mov eax, dword [esi + 0x38]
mov dword [eax + 8], eax
mov dword [esi + 0x3c], edi
mov byte [esp + 0x1c], bl
call fcn.1000c820
mov dword [esi + 0x44], eax
mov byte [eax + 0x15], bl
mov eax, dword [esi + 0x44]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x44]
mov dword [eax], eax
mov eax, dword [esi + 0x44]
mov dword [eax + 8], eax
mov dword [esi + 0x48], edi
mov byte [esp + 0x1c], 2
mov eax, dword [0x1006eb44]
mov ecx, 0x1005e048
shr ecx, 0x10
lea ebp, [esi + 0x4c]
mov dword [ebp], eax
jne 0x100020f9
mov edx, 0x1005e048
movzx eax, dx
push eax
mov ecx, ebp
call fcn.10013a10
jmp 0x10002132
push 0x1005e048
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
mov dword [esp + 0x2c], eax
je 0x10002132
mov ecx, eax
mov edx, ebp
call fcn.10011c80
test eax, eax
je 0x10002132
mov eax, dword [esp + 0x2c]
mov edx, dword [ebp]
lea ecx, [eax + eax]
push ecx
push 0x1005e048
push edx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov byte [esp + 0x1c], 3
mov dword [esi + 0x50], edi
call fcn.1000c820
mov dword [esi + 0x70], eax
mov byte [eax + 0x15], bl
mov eax, dword [esi + 0x70]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x70]
mov dword [eax], eax
mov eax, dword [esi + 0x70]
mov dword [eax + 8], eax
mov dword [esi + 0x74], edi
mov eax, dword [0x1006eb44]
mov dword [esi + 0x78], eax
mov ecx, dword [0x1006eb44]
mov dword [esi + 0x7c], ecx
mov edx, dword [0x1006eb44]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x80], edx
mov eax, dword [0x1006eb44]
mov dword [esi + 0x84], eax
mov dword [esi + 4], ecx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x1000af80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.1000a192
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
invalid
xchg ebp, eax