joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ba6b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40b8af
mov eax, dword [esi + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x40b81d
push eax
call fcn.0040b800
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x40b8d5
cmp byte [esi + 0x10], 0
jne 0x40b884
mov edi, dword [esi + 0x14]
test edi, edi
je 0x40b884
push ebx
mov ebx, dword [edi + 0xc]
test ebx, ebx
jne 0x40b8b3
mov eax, dword [edi + 8]
pop ebx
cmp eax, 8
je 0x42ba02
cmp eax, 0xa
je 0x42ba23
cmp eax, 5
je 0x40b8f8
cmp eax, 0xb
je 0x42ba38
cmp eax, 0xc
je 0x42ba53
push edi
mov dword [edi + 8], 1
mov dword [edi], 0
call fcn.004112ef
add esp, 4
mov eax, dword [esi + 0xc]
dec dword [eax]
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0
pop edi
jne 0x40b8a6
mov edx, dword [esi]
push edx
call fcn.004112ef
mov eax, dword [esi + 0xc]
push eax
call fcn.004112ef
add esp, 8
push esi
call fcn.004112ef
add esp, 4
pop esi
ret 4
mov eax, dword [ebx + 0xc]
dec dword [eax]
mov eax, dword [ebx + 0xc]
cmp dword [eax], 0
je 0x40b8e2
push ebx
call fcn.004112ef
add esp, 4
mov dword [edi + 0xc], 0
jmp 0x40b83d
push eax
mov ecx, edi
call fcn.0040b800
jmp 0x40b828
mov ecx, dword [ebx]
push ecx
call fcn.004112ef
mov edx, dword [ebx + 0xc]
push edx
call fcn.004112ef
add esp, 8
jmp 0x40b8c0
mov eax, edi
call fcn.0040e380
jmp 0x40b86e
invalid
or al, bh
test dword [eax], esp
jmp 0x42ba28
invalid
invalid
add byte [edx + esi + 0x32], cl
xor edi, dword [ebx]
push eax
xor eax, 0x4c4833f
add esp, 4
call 0x42ba6b
add byte [esi + 0x32], al
inc esi
inc edi
push eax
add esp, 4
and edi, 0x161b
pop edi
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x42baeb
Function at 0x42bf84
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
cmp eax, 1
jne 0x40bd6d
mov edx, dword [esi]
mov dword [ebx], edx
mov eax, ebx
pop esi
ret
dec eax
cmp eax, 0xb
ja case.default.0x40bd73
jmp dword [eax*4 + 0x40bdc4]
fld qword [esi]
mov eax, ebx
fstp qword [ebx]
pop esi
ret
mov cl, byte [esi]
mov byte [ebx], cl
mov eax, ebx
pop esi
ret
push 0x10
call fcn.0041171a
add esp, 4
test eax, eax
je 0x40bdba
mov esi, dword [esi + 0xc]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov esi, dword [esi + 0xc]
mov dword [eax + 0xc], esi
inc dword [esi]
mov dword [ebx + 0xc], eax
mov eax, ebx
pop esi
ret
xor eax, eax
mov dword [ebx + 0xc], eax
mov eax, ebx
pop esi
ret
invalid
add byte [edi], cl
test dh, cl
add byte [eax], al
add byte [esi + 0x51], dl
push ecx
out 0xff, eax
inc dword [ebp + 0x514175c0]
push esi
add esp, 4
sub ecx, 0xd088
pop ecx
push ecx
push edi
add esp, 4
call 0x42bf84
add byte [ecx + 0x37], cl
dec edx
dec ebp
inc ebp
xor dh, byte [edi]
aaa
aaa
xor al, 0x3a
add esp, 4
pop ecx
push eax
push edx
add esp, 4
jmp 0x42bf94
pop eax
mov dword [ebp - 0x738], 0
jmp 0x42c68e
Function at 0x445cf9
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
push edi
push 1
push eax
call fcn.0044593e
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0
push 0x25
call ebx
mov ebp, dword [sym.imp.USER32.dll_PostMessageW]
shl eax, 0x10
or eax, 1
cmp dword [esp + 0x18], 0
push eax
jge 0x445d5c
mov ecx, dword [esi]
push 0x25
push 0x100
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov edx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x25
push 0x101
push edx
jmp 0x445d8b
mov eax, dword [esi]
push 0x27
push 0x100
push eax
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call edi
push 0
push 0x25
call ebx
mov ecx, dword [esi]
shl eax, 0x10
or eax, 0xc0000001
push eax
push 0x27
push 0x101
push ecx
call ebp
push 0
call edi
mov edx, dword [esi]
push 0
push edx
call fcn.0044593e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x452126
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x27c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x290]
lea esi, [esp + 0x10]
mov dword [esp + 0x20], ecx
call fcn.00401b70
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
inc dword [eax]
mov dword [esp + 0x34], eax
mov edi, 0x48a088
mov eax, esi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
call fcn.0040d330
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x38]
push eax
push ecx
mov bl, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x4522be
mov ebp, dword [esp + 0x29c]
mov edx, dword [esp + 0x20]
push edx
call int.00443009
cmp eax, 1
je 0x4522bc
cmp eax, 0xb
jne 0x4521ba
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x452198
lea eax, [esp + 0x64]
push 0x48724c
push eax
call fcn.004133e4
add esp, 8
test eax, eax
je 0x4522a2
lea ecx, [esp + 0x64]
push 0x48a090
push ecx
call fcn.004133e4
add esp, 8
test eax, eax
je 0x4522a2
lea edx, [esp + 0x28]
push edx
lea esi, [esp + 0x14]
call fcn.0040df50
lea edi, [esp + 0x64]
mov eax, esi
call fcn.0040d330
test byte [esp + 0x38], 0x10
je 0x45226f
cmp byte [esp + 0x2a0], 0
je 0x452220
add dword [ebp], 1
adc dword [ebp + 4], 0
cmp byte [esp + 0x2a4], 0
je 0x4522a2
mov edi, 0x484e10
lea eax, [esp + 0x10]
call fcn.0040d330
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x2a0]
mov edx, dword [esp + 0x298]
push eax
mov eax, dword [esp + 0x298]
push ecx
mov ecx, dword [esp + 0x18]
push ebp
push edx
push eax
push ecx
mov ecx, dword [esp + 0x38]
call fcn.00452126
mov bl, al
test bl, bl
je 0x4522be
jmp 0x4522a2
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
xor edx, edx
xor esi, esi
or edx, eax
mov eax, dword [esp + 0x294]
or ecx, esi
add dword [eax], edx
adc dword [eax + 4], ecx
cmp byte [esp + 0x2a0], 0
je 0x4522a2
mov eax, dword [esp + 0x298]
add dword [eax], 1
adc dword [eax + 4], esi
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x452198
jmp 0x4522be
xor bl, bl
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x28]
call fcn.00402620
lea ecx, [esp + 0x10]
call fcn.00402620
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x27c
ret 0x18
Function at 0x467e5e
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x18
mov al, byte [0x49728f]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov edi, dword [esp + 0x2c]
push 0x8000
push edi
mov byte [esp + 0x18], al
call fcn.0041453a
add esp, 4
push eax
call fcn.00414443
add esp, 8
mov esi, eax
push ebp
mov dword [esp + 0x18], esi
call fcn.00444279
test al, al
je 0x467ebd
push edi
push ebp
call fcn.00443676
push eax
push 1
push ebp
call fcn.004676a3
push eax
call fcn.004146ce
add esp, 0x10
mov ebx, eax
jmp 0x467f09
push esi
jmp 0x467f1c
lea esi, [esp + 0x18]
call fcn.0040d500
push ebp
call fcn.00453063
push esi
push eax
call fcn.0045efe7
mov edx, dword [esp + 0x18]
push edx
push 0x4873d8
push edi
call fcn.00414750
add esp, 0xc
cmp byte [esp + 0x10], 0
mov ebx, eax
je 0x467efc
push ebp
call fcn.00453081
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea esi, [esp + 0x18]
call fcn.00401330
mov esi, dword [esp + 0x14]
push edi
call fcn.004149f6
add esp, 4
cmp esi, 0xffffffff
jne 0x467eba
push 0x4000
push edi
call fcn.0041453a
add esp, 4
push eax
call fcn.00414443
add esp, 8
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x18
ret
Function at 0x10007630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000765c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10007684
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1000768a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10007714
jg 0x100076a1
test esi, esi
je 0x10007714
test ecx, ecx
jl 0x100076f7
jg 0x100076ab
test eax, eax
je 0x100076f7
cmp edi, ecx
jg 0x100076bf
jl 0x100076b5
cmp esi, eax
jae 0x100076bf
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
add edx, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x10007714
jg 0x100076fa
test esi, esi
je 0x10007714
jmp 0x100076fa
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10007714
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10007730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x1000775c
jl 0x10007750
test ecx, ecx
jne 0x1000775c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10007775
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x100077c3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x100077c9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x100077c9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10007836
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100077f2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10007824
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10007836
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10007800
test edi, edi
je 0x10007836
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10007bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10017040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10007be0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0ee
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10007c1c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10007c1c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0ee
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10007cf3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10007c44
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10007c50
movsx eax, bl
jmp 0x10007c88
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10007cb2
sub eax, 1
je 0x10007cb2
sub eax, 2
jne 0x10007cf3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0ee
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10007cd0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10007cf3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0ee
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000d0ee
mov esp, ebp
pop ebp
ret 4
Function at 0x10007ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10017040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10007f5c
cmp byte [esi + 0x3d], 0
je 0x10007f5c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10007f4a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10007f11
sub eax, 1
je 0x10007f15
sub eax, 2
jne 0x10007f4a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0ee
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10007f33
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10007f4a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0ee
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d0ee
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1000d0ee
mov esp, ebp
pop ebp
ret
Function at 0x1000d16b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x1000d1a0
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x1000d19d
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x1000d1a9
add edx, 0x28
cmp edx, esi
jne 0x1000d18b
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x1000d1a6

Function at 0x1000e050
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1000e220
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1000e12d
mov edx, dword [ebp - 4]
cmp edx, dword [0x100170a0]
jb 0x1000e09a
mov eax, dword [ebp - 4]
cmp eax, dword [0x100170a4]
ja 0x1000e09a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1000e06a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1000e0bf
jmp 0x1000e12d
cmp dword [ebp - 0x14], 0x10000
jne 0x1000e113
cmp dword [ebp - 0x18], 0x10000
jb 0x1000e113
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000e0f6
mov eax, dword [ebp - 8]
jmp 0x1000e12f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1000e106
xor eax, eax
jmp 0x1000e12f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000e128
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1000e220
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000e06a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000f680
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100178a8], eax
je 0x1000f69d
mov eax, 0x10dd
jmp 0x1000f780
mov eax, dword [0x100178b8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000f71c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000f6f8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1000f6f8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1000e700
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.1000d131
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1000f6a5
mov dword [0x100178b8], 0
call fcn.1000efe0
mov ecx, dword [0x100178b4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1000f76a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1000d131
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1000f734
mov dword [0x100178b4], 0
mov dword [0x100178a8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fc60
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100178ac], 0
je 0x1000fc79
mov eax, dword [0x100178ac]
jmp 0x1000fd18
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1000fc8a
xor eax, eax
jmp 0x1000fd18
push 8
call fcn.1000d101
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000fce2
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1000fccb
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.1000d131
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100178ac], eax
mov dword [0x100178b0], 0
mov eax, dword [ebp - 8]
jmp 0x1000fd18
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1000fcfa
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1000fcaa
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100178b4]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100178b4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x3c49a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x408e10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x422014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x4230ec
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.003d80c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x422a8c
push eax
call fcn.003d80c0
mov esi, dword [0x4230fc]
xor ebx, ebx
mov edi, dword [0x423100]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x426390], bl
mov eax, ebx
mov ecx, 0x4230ec
cmovae ecx, dword [0x4230ec]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x4264a0], al
inc ebx
cmp ebx, 0x100
jl 0x3c4a20
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x426390]
movzx eax, byte [esi + 0x4264a0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x3c4a74
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x426390]
mov byte [esi + 0x426390], al
inc esi
mov byte [edi + 0x426390], dl
cmp esi, 0x100
jl 0x3c4a50
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.003c4690
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x3c4ac9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x3c4abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x3c4b1f
push edx
push ecx
call fcn.003dd663
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x3c4b0b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x3c4b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x3c4b1f
push edx
push ecx
call fcn.003dd663
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.003f6c6a
int3