joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4670f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4a7413
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0049666c
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0049c005
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0049e9d1
test eax, eax
je 0x46720c
mov ecx, dword [esp + 0x3c]
call fcn.0049c032
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4671d0
push edi
mov ecx, esi
call fcn.004995cb
mov ecx, esi
call fcn.004673b0
cmp dword [esp + 0x38], 1
jne 0x467205
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0049975e
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4693e0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x469413
push esi
call fcn.0046c530
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x46940c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x469499
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x469482
mov eax, dword [esi + 8]
test eax, eax
je 0x469437
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x46947e
cmp eax, 2
je 0x469482
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46942a
cmp eax, 3
je 0x46945d
cmp eax, 1
jne 0x46942a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46942a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46942a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004694c0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4694a8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004694c0
add esp, 4
pop esi
ret

Function at 0x4779e0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x477a83
test eax, eax
jbe 0x477a83
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x477a83
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x477a2e
xor esi, esi
jmp 0x477a34
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x477a5f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0042c230
add esi, eax
push esi
mov ebx, esi
call fcn.0042c230
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x477a40
pop ebp
test edi, edi
pop edi
jne 0x477a83
test ebx, ebx
je 0x477a83
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00485a50
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x477bc5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x477cdd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x477cdd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00496abe
mov esi, eax
test esi, esi
je 0x477cdd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x477cdd
mov ecx, esi
call fcn.00477b30
cmp edi, eax
jge 0x477cdd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x477c63
mov dword [esp + 0x34], 1
jmp 0x477cbe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x477cdd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.004770a0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x495e49
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.0049ffbd
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x495e7a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.00495e8d
pop edi
pop esi
pop ebx
ret 8

Function at 0x497461
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x497499
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004954aa
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00495482
jmp 0x4974a5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x498d54
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x498d96
call fcn.0049ffbd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x498d96
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x498d8d
xor eax, eax
jmp 0x498d9e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00498da4
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a04ed
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a051b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a0539
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a0453
jmp 0x4a0539
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a0539
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a0453
test edi, edi
mov eax, edi
jne 0x4a0523
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [ecx]
mov ecx, dword [esp + 0x10]
xor eax, eax
and ebp, 7
cmp ecx, 5
jae 0x10001179
pop ebp
pop ecx
ret
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [edx + ecx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], edx
jmp 0x100011a0
mov ecx, dword [esp + 0x18]
lea edi, [eax + ecx]
cmp edi, edx
jae 0x100011bd
jmp 0x100011b0
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x100011bd
inc edi
cmp edi, edx
jb 0x100011b0
mov eax, edi
sub eax, ecx
mov ecx, eax
sub ecx, dword [esp + 0x1c]
cmp edi, edx
jae 0x100012d2
cmp ecx, 3
jbe 0x100011f1
xor ebp, ebp
mov cl, byte [edi + 4]
mov dword [esp + 0x1c], eax
test cl, cl
je 0x1000122b
cmp cl, 0xff
je 0x1000122b
and ebp, 3
add ebp, ebp
or ebp, 1
inc eax
jmp 0x100011a0
dec ecx
shl ebp, cl
and ebp, 7
je 0x100011d6
movzx ecx, byte [ebp + 0x1009eaa4]
mov ebx, edi
sub ebx, ecx
cmp byte [ebp + 0x1009ea9c], 0
mov cl, byte [ebx + 4]
je 0x10001219
test cl, cl
je 0x10001219
cmp cl, 0xff
jne 0x100011d6
and ebp, 3
add ebp, ebp
mov dword [esp + 0x1c], eax
or ebp, 1
inc eax
jmp 0x100011a0
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
lea esp, [esp]
cmp dword [esp + 0x28], 0
je 0x1000125e
lea ebx, [edx + eax]
add ebx, esi
jmp 0x10001264
sub edx, eax
sub edx, esi
mov ebx, edx
test ebp, ebp
je 0x100012a4
movzx esi, byte [ebp + 0x1009eaa4]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x10001289
cmp dl, 0xff
jne 0x100012a0
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x10001250
mov esi, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [esp + 0x10]
mov byte [edi + 3], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x100011a0
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x100012e5
mov ecx, dword [esp + 0x18]
xor ebp, ebp
mov dword [ecx], ebp
pop ebp
pop ecx
ret
dec ecx
shl ebp, cl
mov ecx, dword [esp + 0x18]
and ebp, 7
mov dword [ecx], ebp
pop ebp
pop ecx
ret
Function at 0x10010720
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
push ebp
mov ebp, dword [eax]
push esi
mov esi, dword [esp + 0x28]
mov ecx, dword [esi + 0x10]
movzx ax, byte [ecx + 6]
add ecx, 6
movzx ecx, byte [ecx + 1]
shl ax, 8
movzx eax, ax
or eax, ecx
and eax, 0xfffffffe
push edi
xor edx, edx
mov edi, eax
shr edi, 1
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
jne 0x1001076c
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
mov cl, byte [esp + 0x34]
test cl, cl
je 0x10010779
inc ebp
mov dword [esp + 0xc], ebp
push ebx
cmp ebp, 0xffff
ja 0x100108b0
mov ecx, dword [esi + 0x10]
lea esi, [ecx + 0xe]
lea ecx, [ecx + eax + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ecx
jmp 0x100107a4
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x1c], 0
test edi, edi
jbe 0x1001088f
lea esp, [esp]
movzx edi, byte [ecx]
movzx ebp, byte [esi + 1]
add ecx, 2
shl di, 8
movzx ebx, di
movzx edi, byte [ecx - 1]
or ebx, edi
movzx edi, byte [esi]
add esi, 2
shl di, 8
movzx edi, di
or edi, ebp
mov ebp, dword [esp + 0x10]
cmp ebp, edi
jb 0x10010861
cmp ebp, ebx
ja 0x10010861
movzx dx, byte [esi + eax - 2]
lea ecx, [esi + eax - 2]
shl dx, 8
movsx ebp, dx
movzx edx, byte [ecx + 1]
add ecx, eax
movzx ax, byte [ecx]
shl ax, 8
or ebp, edx
movzx edx, ax
movzx eax, byte [ecx + 1]
or edx, eax
mov eax, dword [esp + 0x20]
dec eax
cmp dword [esp + 0x1c], eax
jb 0x10010851
cmp edi, 0xffff
jne 0x10010851
cmp ebx, edi
jne 0x10010851
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
test edx, edx
je 0x10010851
mov ebx, dword [eax + 0x1f8]
add ebx, dword [eax + 0x1f4]
lea eax, [edx + ecx + 2]
cmp eax, ebx
ja 0x10010876
cmp edx, 0xffff
jne 0x100108c8
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
inc edi
mov dword [esp + 0x1c], edi
cmp edi, dword [esp + 0x20]
jb 0x100107c0
jmp 0x1001088f
mov ebp, 1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add edx, ebp
and edx, 0xffff
mov dword [esp + 0x14], edx
mov cl, byte [esp + 0x38]
test cl, cl
je 0x100108be
mov ebp, dword [esp + 0x10]
test edx, edx
jne 0x100108b0
inc ebp
mov dword [esp + 0x10], ebp
cmp ebp, 0xffff
jbe 0x100107a0
test cl, cl
je 0x100108be
test edx, edx
je 0x100108be
mov eax, dword [esp + 0x34]
mov dword [eax], ebp
pop ebx
pop edi
pop esi
mov eax, edx
pop ebp
add esp, 0x1c
ret
test edx, edx
je 0x1001087b
mov eax, dword [esp + 0x10]
sub eax, edi
lea edx, [edx + eax*2]
movzx ax, byte [ecx + edx]
add ecx, edx
movzx ecx, byte [ecx + 1]
shl ax, 8
movzx edx, ax
mov eax, dword [esp + 0x18]
or edx, ecx
mov dword [esp + 0x14], edx
je 0x1001088f
jmp 0x10010883
Function at 0x1001e010
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
movzx esi, word [esi]
push edi
mov edi, dword [esp + 0x18]
mov ebx, dword [edi]
mov dword [esp + 0xc], ebx
cmp ebx, ecx
jb 0x1001e034
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
sub ecx, ebx
cmp eax, ecx
jbe 0x1001e03c
mov eax, ecx
xor ecx, ecx
test eax, eax
jbe 0x1001e081
push ebp
sub ebx, edx
mov ebp, eax
mov dword [esp + 0x14], eax
jmp 0x1001e050
movzx edi, byte [ebx + edx]
mov ecx, esi
shr ecx, 8
xor ecx, edi
add edi, esi
imul edi, edi, 0x3193
mov esi, 0x58bf
sub esi, edi
mov byte [edx], cl
and esi, 0xffff
inc edx
sub ebp, 1
jne 0x1001e050
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
pop ebp
mov edx, dword [esp + 0x1c]
add ebx, eax
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
pop edi
mov word [edx], si
pop esi
mov eax, ecx
pop ebx
add esp, 8
ret
Function at 0x1004c2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
test esi, esi
jle 0x1004c2fa
push ebx
mov ebx, dword [ebp + 8]
mov edx, ebx
shr edx, 0x10
mov eax, edx
shr eax, 8
mov dword [ebp - 4], eax
mov eax, ebx
shr eax, 8
xor byte [ebp - 4], al
mov eax, dword [ebp - 4]
xor al, dl
xor al, bl
pop ebx
test esi, esi
jle 0x1004c2fa
xor byte [ecx], al
lea ecx, [ecx + 1]
add al, 7
dec esi
jne 0x1004c2f0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004c300
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], ecx
push eax
lea eax, [ebp - 0x14]
mov ebx, edx
push eax
mov dword [ebp - 0xc], ebx
call fcn.1004ce30
mov esi, dword [eax]
cmp esi, dword [0x100daa08]
jne 0x1004c32f
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x3c], 8
lea eax, [esi + 0x28]
jb 0x1004c33a
mov eax, dword [eax]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1004c370
mov eax, dword [ebp + 8]
pop edi
mov dword [ebx], 0
pop esi
mov dword [eax], 0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x1c]
push eax
mov dword [ebp - 4], eax
call fcn.1006305d
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push 0
push 0
push dword [esi + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, ebx
mov ebx, dword [ebp - 4]
test ebx, ebx
jle 0x1004c3de
mov eax, dword [ebp - 8]
mov ecx, eax
shr ecx, 0x10
mov edx, ecx
shr eax, 8
shr edx, 8
xor dl, al
xor dl, cl
xor dl, byte [ebp - 8]
test ebx, ebx
jle 0x1004c3de
mov edi, edi
xor byte [edi], dl
lea edi, [edi + 1]
add dl, 7
dec ebx
jne 0x1004c3d0
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x20]
mov edi, dword [ebp - 0xc]
push ecx
mov dword [ecx], eax
mov eax, dword [esi + 0x14]
push edi
push ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [eax*4 + 0x100d7a4c]
push ebx
call eax
push ebx
mov esi, eax
call fcn.10062cf2
add esp, 0x14
test esi, esi
je 0x1004c42d
push dword [edi]
call fcn.10062cf2
mov eax, dword [ebp + 8]
add esp, 4
mov dword [edi], 0
pop edi
pop esi
mov dword [eax], 0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004eaf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100958f4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100cf288]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
lea edi, [esi + 8]
push 8
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
call fcn.10062ca1
add esp, 4
test eax, eax
jne 0x1004eb60
call fcn.10061d21
mov dword [edi], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi]
mov dword [eax], edi
lea eax, [esi + 0x1c]
mov byte [ebp - 4], 1
push 2
push eax
call fcn.100622c1
add esp, 8
test eax, eax
je 0x1004eb92
push eax
call fcn.10062040
add esp, 4
lea eax, [esi + 0x20]
mov byte [ebp - 4], 2
push eax
call fcn.10061e5e
add esp, 4
test eax, eax
je 0x1004ebaf
push eax
call fcn.10062040
add esp, 4
mov byte [ebp - 4], 3
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
call fcn.1004f860
mov dword [esi + 0x24], eax
mov byte [ebp - 4], 4
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1004f860
push 0
push 0
push esi
push 0x1004ec70
push 0
push 0
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004efe0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009596b
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100cf288]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x100c67c8
lea eax, [ebp - 0x44]
push str.DumpText.dtxt
push eax
call fcn.100632d7
push 0
push 8
push dword [ebp - 0x44]
call fcn.10063c48
push dword [ebp - 0x44]
lea eax, [ebp - 0x50]
push 1
push 4
push eax
call fcn.100634e1
xor ebx, ebx
add esp, 0x28
cmp dword [ebp - 0x50], ebx
jbe 0x1004f1e1
lea eax, [edi + 0x24]
mov dword [ebp - 0x54], eax
lea esi, [edi + 0x34]
lea eax, [edi + 0x2c]
mov dword [ebp - 0x58], eax
lea esp, [esp]
push dword [ebp - 0x44]
lea eax, [ebp - 0x48]
push 1
push 4
push eax
call fcn.100634e1
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 1
push esi
call fcn.100634e1
add esp, 0x20
mov dword [ebp - 0x2c], 0xf
cmp byte [esi], 0
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x1004f09c
xor ecx, ecx
jmp 0x1004f0aa
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004f0a1
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.1004a060
mov dword [ebp - 4], 0
lea eax, [ebp - 0x48]
push dword [ebp - 0x44]
push 1
push 4
push eax
call fcn.100634e1
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 1
push esi
call fcn.100634e1
add esp, 0x20
mov dword [ebp - 0x14], 0xf
cmp byte [esi], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jne 0x1004f0f7
xor ecx, ecx
jmp 0x1004f109
mov ecx, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004f100
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1004a060
mov byte [ebp - 4], 1
lea edi, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae edi, dword [ebp - 0x28]
cmp dword [0x100daa24], 0
jne 0x1004f154
push 0x30
call fcn.10062ca1
add esp, 4
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1004f149
mov ecx, eax
call fcn.1004ff50
jmp 0x1004f14b
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x100daa24], eax
push ecx
push edi
call fcn.10050e40
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
call fcn.1004f270
lea ecx, [ebp - 0x28]
cmp eax, ecx
je 0x1004f17d
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.10049ee0
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x4c]
push eax
call fcn.1004f270
lea ecx, [ebp - 0x40]
cmp eax, ecx
je 0x1004f19c
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.10049ee0
cmp dword [ebp - 0x14], 0x10
jb 0x1004f1ad
push dword [ebp - 0x28]
call fcn.1000a3a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jb 0x1004f1d7
push dword [ebp - 0x40]
call fcn.1000a3a0
add esp, 4
inc ebx
cmp ebx, dword [ebp - 0x50]
jb 0x1004f060
push dword [ebp - 0x44]
call fcn.10063d37
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006249d
mov esp, ebp
pop ebp
ret
Function at 0x10050e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10050ea2
push esi
xor esi, esi
cmp byte [0x100daa96], 0
jne 0x10050e69
push ecx
push 0x100daad0
call fcn.10050d90
mov byte [0x100daa96], 1
mov ecx, edi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10050e70
sub ecx, edx
lea edx, [ecx + 1]
test edx, edx
jle 0x10050e9a
movzx eax, byte [edi]
lea edi, [edi + 1]
mov ecx, esi
shl esi, 8
shr ecx, 0x18
xor ecx, eax
xor esi, dword [ecx*4 + 0x100daad0]
dec edx
jne 0x10050e80
mov eax, esi
pop esi
pop edi
pop ebp
ret 8
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x10050eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10050f22
push esi
xor esi, esi
cmp byte [0x100daa95], 0
jne 0x10050ed9
push ecx
push 0x100daed0
call fcn.10050d90
mov byte [0x100daa95], 1
mov ecx, edi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10050ee0
sub ecx, edx
sar ecx, 1
lea edx, [ecx*2 + 2]
test edx, edx
jle 0x10050f1a
lea ebx, [ebx]
movzx eax, byte [edi]
lea edi, [edi + 1]
mov ecx, esi
shl esi, 8
shr ecx, 0x18
xor ecx, eax
xor esi, dword [ecx*4 + 0x100daed0]
dec edx
jne 0x10050f00
mov eax, esi
pop esi
pop edi
pop ebp
ret 8
xor eax, eax
pop edi
pop ebp
ret 8