joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a5a5
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x40f348
call fcn.0040ae51
push 1
call fcn.0040a70f
pop ecx
test al, al
jne 0x40a44e
push 7
call fcn.0040affb
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040a6da
mov byte [ebp - 0x24], al
mov eax, dword [0x411ff4]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40a447
test eax, eax
jne 0x40a4b8
mov dword [0x411ff4], ecx
push 0x40c2a4
push 0x40c28c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40a49b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40a59f
push 0x40c288
push 0x40c270
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x411ff4], 2
jmp 0x40a4bd
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040a86c
pop ecx
call fcn.0040afef
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40a4ed
push esi
call fcn.0040a7df
pop ecx
test al, al
je 0x40a4ed
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0040b22a
call esi
call fcn.0040aff5
mov esi, eax
cmp dword [esi], edi
je 0x40a50b
push esi
call fcn.0040a7df
pop ecx
test al, al
je 0x40a50b
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.0040b110
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.0040b143
test al, al
jne 0x40a544
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x40a54d
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040a889
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40a59f
call fcn.0040ae97
ret
call fcn.0040a2b4
jmp 0x40a42f
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x49ba40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x93000]
push edi
or ebp, 0xffffffff
jmp 0x49ba62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49ba69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49ba58
mov eax, 1
add ebx, ebx
jne 0x49ba7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49ba70
jne 0x49ba8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49ba70
xor ecx, ecx
sub eax, 3
jb 0x49baa0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49bb12
mov ebp, eax
add ebx, ebx
jne 0x49baab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x49bab8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x49badc
inc ecx
add ebx, ebx
jne 0x49bac8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49babd
jne 0x49bad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49babd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49bafc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49baed
jmp 0x49ba5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49bafc
add edi, ecx
jmp 0x49ba5e
pop esi
mov edi, esi
mov ecx, 0x920
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49bb1a
cmp byte [edi], 7
jne 0x49bb1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x49bb1f
lea edi, [esi + 0x99000]
mov eax, dword [edi]
or eax, eax
je 0x49bb8e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9b0f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9b1ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49bb4c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9b1b0]
or eax, eax
je 0x49bb88
mov dword [ebx], eax
add ebx, 4
jmp 0x49bb69
call dword [esi + 0x9b1b4]
popal
jmp 0x411bb0
Function at 0xec6e00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6e000]
push edi
jmp 0xec6e1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xec6e21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xec6e10
mov eax, 1
add ebx, ebx
jne 0xec6e33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xec6e44
jne 0xec6e63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xec6e63
dec eax
add ebx, ebx
jne 0xec6e50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xec6e28
add ebx, ebx
jne 0xec6e5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xec6eb5
xor ecx, ecx
sub eax, 3
jb 0xec6e7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xec6eea
sar eax, 1
mov ebp, eax
jmp 0xec6e86
add ebx, ebx
jne 0xec6e86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xec6e54
inc ecx
add ebx, ebx
jne 0xec6e94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xec6e54
add ebx, ebx
jne 0xec6ea1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xec6e96
jne 0xec6eb2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xec6e96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xec6ed4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xec6ec6
jmp 0xec6e16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xec6ed4
add edi, ecx
jmp 0xec6e16
pop esi
mov edi, esi
mov ecx, 0x3a8d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xec6ef2
cmp byte [edi], 0x11
jne 0xec6ef2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xec6ef7
lea edi, [esi + 0xc1000]
mov eax, dword [edi]
or eax, eax
je 0xec6f6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc72dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc7430]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xec6f24
mov ecx, edi
jns 0xec6f53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc7434]
or eax, eax
je 0xec6f69
mov dword [ebx], eax
add ebx, 4
jmp 0xec6f41
call dword [esi + 0xc7444]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xec6fa0
cmp al, 0xef
ja 0xec6f93
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xec6f75
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xec6f82
mov ebp, dword [esi + 0xc7438]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xec6fd4
sub esp, 0xffffff80
jmp 0xe6a08c
Function at 0x710c6b
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x7109ec
sub esp, 4
mov dword [esp], ecx
pop ebx
dec ebx
mov ecx, 0xfb0ed113
call fcn.00710cad
sub ebx, 0x107c3ee7
xor dword [edx], edi
add ebx, 0xad2b92b4
add edx, 1
inc ecx
cmp edx, esi
jne fcn.00710c6b
add ebx, ecx
or ebx, ebx
sub ecx, 0xe7283c25
ret
Function at 0x401a10
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405050]
test esi, esi
jle 0x401b5d
mov edi, dword [0x405054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401aa4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401b56
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401a90
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401b9a
lea ebx, [esi + esi*2]
mov esi, dword [0x405054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b7a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401b4f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401b4f
mov eax, dword [esp + 0x20]
add ebx, dword [0x405054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401b64
add dword [0x405050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401aae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402060
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4020b5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4020ae
test esi, esi
je 0x4020ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402090
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4022d0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x402308
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4022fe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40230a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4022f0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x10006a00
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10006a32
xor al, al
jmp 0x10006b5b
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf00000
jb 0x10006a5b
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x10006b5b
push 0x1000
call fcn.10016dc3
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10006a7e
xor al, al
jmp 0x10006b5b
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x1000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10006ab0
cmp dword [ebp - 0x1c], 0x1000
je 0x10006ac9
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.100170c9
add esp, 4
xor al, al
jmp 0x10006b5b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10006af3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.100170c9
add esp, 4
xor al, al
jmp 0x10006b5b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0x4550
je 0x10006b20
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100170c9
add esp, 4
xor al, al
jmp 0x10006b5b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x34]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x50]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.100170c9
add esp, 4
mov dword [ebp - 4], 0
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006b70
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10006ba2
xor al, al
jmp 0x10006ccb
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf00000
jb 0x10006bcb
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x10006ccb
push 0x1000
call fcn.10016dc3
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10006bee
xor al, al
jmp 0x10006ccb
mov dword [ebp - 0x1c], 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x1000
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10006c20
cmp dword [ebp - 0x1c], 0x1000
je 0x10006c39
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.100170c9
add esp, 4
xor al, al
jmp 0x10006ccb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10006c63
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.100170c9
add esp, 4
xor al, al
jmp 0x10006ccb
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0x4550
je 0x10006c90
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100170c9
add esp, 4
xor al, al
jmp 0x10006ccb
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x34]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x50]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.100170c9
add esp, 4
mov dword [ebp - 4], 0
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000fb80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10027e00
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x1002d030]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x18]
mov eax, dword [ecx + 4]
cmp byte [eax + 0x31], 0
mov edi, ecx
jne 0x1000fbd6
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
cmp dword [eax + 0xc], ecx
jae 0x1000fbcc
mov eax, dword [eax + 8]
jmp 0x1000fbd0
mov edi, eax
mov eax, dword [eax]
cmp byte [eax + 0x31], 0
je 0x1000fbc2
mov esi, dword [ebx]
mov edx, dword [ebx + 0x18]
mov dword [esp + 0x14], edx
test esi, esi
je 0x1000fbe7
cmp esi, esi
je 0x1000fbec
call fcn.100170b9
cmp edi, dword [esp + 0x14]
je 0x1000fbfc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
cmp ecx, dword [edi + 0xc]
jae 0x1000fc62
lea edx, [esp + 0x18]
push edx
call fcn.10010580
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x68], 0
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x40], ecx
call fcn.10011270
push edi
push esi
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ebx
mov byte [esp + 0x78], 1
call fcn.10010210
mov esi, dword [eax]
mov edi, dword [eax + 4]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x68], 0
call fcn.1000f5d0
lea ecx, [esp + 0x18]
mov dword [esp + 0x68], 0xffffffff
call fcn.1000f5d0
test esi, esi
jne 0x1000fc8d
call fcn.100170b9
cmp edi, dword [esi + 0x18]
jne 0x1000fc75
call fcn.100170b9
lea eax, [edi + 0x10]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esi]
jmp 0x1000fc6b
Function at 0x10016dce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002d030]
jne 0x10016dd8
repz ret
jmp fcn.10018b86

Function at 0x10021761
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100191dc
and dword [ebp - 4], 0
cmp dword [0x1002ee9c], 0
mov ebx, eax
jne 0x10021812
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100218c3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100218c3
push eax
call fcn.1001916a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1002ee9c], eax
call esi
push eax
call fcn.1001916a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1002eea0], eax
call esi
push eax
call fcn.1001916a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1002eea4], eax
call esi
push eax
call fcn.1001916a
pop ecx
mov dword [0x1002eeac], eax
test eax, eax
je 0x10021812
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001916a
pop ecx
mov dword [0x1002eea8], eax
mov eax, dword [0x1002eea8]
cmp eax, ebx
je 0x1002186a
cmp dword [0x1002eeac], ebx
je 0x1002186a
push eax
call fcn.100191e5
push dword [0x1002eeac]
mov esi, eax
call fcn.100191e5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1002186a
test edi, edi
je 0x1002186a
call esi
test eax, eax
je 0x10021861
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10021861
test byte [ebp - 0xc], 1
jne 0x1002186a
or dword [ebp + 0x10], 0x200000
jmp 0x100218a3
mov eax, dword [0x1002eea0]
cmp eax, ebx
je 0x100218a3
push eax
call fcn.100191e5
pop ecx
test eax, eax
je 0x100218a3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100218a3
mov eax, dword [0x1002eea4]
cmp eax, ebx
je 0x100218a3
push eax
call fcn.100191e5
pop ecx
test eax, eax
je 0x100218a3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002ee9c]
call fcn.100191e5
pop ecx
test eax, eax
je 0x100218c3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100218c5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100c80d6
Capabilities:
Packed with generic packer

Disassembly:
test ah, 0xa7
bt bp, 0xe
cmp dword [ebp - 0x18], 0
pushal
pushfd
lea esp, [esp + 0x28]
je 0x10121267
lea ecx, [ebp + 0x75adabab]
movsx ecx, al
mov eax, dword [ebp - 0x18]
call fcn.100c905b
les esp, [eax - 0x18]
sbb ecx, esi
sub byte [ebx + 0x61], 0x5c
mov eax, dword [0xfd482fc9]
invalid
push 0xe3bb98ad
pushal
call fcn.1010c59c
cmc
mov dword [ebp - 0x13c], eax
push ebx
cmp esp, edx
cmp dword [ebp - 0x13c], 0
pushfd
pushfd
push dword [esp]
push dword [esp + 8]
lea esp, [esp + 0x14]
jge 0x1018175f
lea eax, [esi + 0x2557ca9d]
push edi
mov eax, dword [ebp - 0x13c]
pushal
mov word [esp + 8], 0xa8bf
mov word [esp], bx
pushal
lea esp, [esp + 0x44]
jmp fcn.10015a6f