joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10061920
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esp + 0x10]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x10061955
push ebx
lea esp, [esp]
movzx ebx, byte [edx - 1]
dec edx
xor ebx, edi
add eax, ebx
dec esi
dec ecx
mov byte [esi], al
shr eax, 8
test ecx, ecx
jne 0x10061940
pop ebx
pop edi
pop esi
ret

Function at 0x10082e80
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.10011fd0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.1005a980
mov ebx, eax
push ebx
push esi
call fcn.1005aae0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x10082f0c
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x10082ee6
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x10082ed9
mov edi, ebx
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.1005ab50
push esi
call fcn.1005a840
mov edi, eax
add esp, 0x10
test edi, edi
jbe 0x10082f0c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.1005a980
mov ebx, eax
push ebx
push esi
call fcn.1005aae0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x10082f7e
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
push edi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x10082f64
mov edx, dword [esp + 0x10]
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x10082f57
mov edi, ebx
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [edi*8]
push ecx
push edi
push esi
call fcn.1005ab50
push esi
call fcn.1005a840
add esp, 0x10
mov edi, eax
test edi, edi
ja 0x10082f04
push esi
call fcn.1005a840
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100855d9
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0x1008564f
test eax, eax
je 0x1008561b
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.1005c110
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0x1008561b
push 0x3b
push str.....Srcopenssl_1.1.1tcryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.1004a410
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x1008564b
cmp edi, 0x40a
je 0x10085642
cmp edi, 0x43f
je 0x10085642
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x10085647
mov eax, 0x20
cmp esi, eax
je 0x1008564f
push 0x41
jmp 0x10085600
push ebx
push 0x46
push str.....Srcopenssl_1.1.1tcryptoececx_meth.c
push 0x40
call fcn.100530f0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x10085685
push 0x48
push str.....Srcopenssl_1.1.1tcryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.1004a410
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0x1008569d
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call fcn.10010aa0
add esp, 0xc
jmp case.0x100857ce.1036
cmp edi, 0x40a
je 0x100856bd
cmp edi, 0x43f
je 0x100856bd
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x100856c2
mov eax, 0x20
push 0x50
push str.....Srcopenssl_1.1.1tcryptoececx_meth.c
push eax
call fcn.100596f0
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x100856f5
push 0x52
push str.....Srcopenssl_1.1.1tcryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.1004a410
add esp, 0x14
jmp 0x10085748
cmp ebp, 2
jne 0x10085788
cmp edi, 0x40a
je 0x1008571e
cmp edi, 0x43f
je 0x1008571e
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x10085723
mov eax, 0x20
push eax
push esi
call fcn.1005b0b0
add esp, 8
test eax, eax
jg 0x1008575e
push 0x57
push str.....Srcopenssl_1.1.1tcryptoececx_meth.c
push esi
call fcn.10059710
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push str.....Srcopenssl_1.1.1tcryptoececx_meth.c
push ebx
call fcn.10053160
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0x10085777
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0x100857bc
cmp edi, 0x40b
jne 0x100857bc
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x100857bc
cmp edi, 0x40a
je 0x100857a8
cmp edi, 0x43f
je 0x100857a8
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x100857ad
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.10010aa0
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x100857ce.1036
movzx ecx, byte [eax + 0x10085828]
jmp dword [ecx*4 + 0x10085814]
push esi
push ebx
call fcn.100e2990
jmp 0x100857f7
push esi
push ebx
call fcn.100e28c0
jmp 0x100857f7
push esi
push ebx
call fcn.100d56b0
jmp 0x100857f7
push esi
push ebx
call fcn.100d3a10
add esp, 8
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.1005c690
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0x10091490
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x10094a20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.10011fd0
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.10056960
add esp, 8
test eax, eax
jne 0x10094a5b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x10094abd
xor ebx, ebx
test ebp, ebp
jle 0x10094c20
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x10094a9f
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x10094a78
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x10094a70
jmp 0x10094c20
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
cmp dword [esp + 0x40], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
jle 0x10094c20
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
cmp edi, esi
mov dword [esp + 0x20], esi
jle 0x10094bfc
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x10094b90
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
jl 0x10094b60
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x100d3b90
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
push ebp
lea ecx, [ebx + 0xc]
push esi
lea eax, [edx + 4]
sub ebx, edx
mov ebp, 4
mov esi, dword [eax - 4]
mov edx, dword [ecx - 0xc]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax - 4], esi
xor dword [ecx - 0xc], edx
mov esi, dword [eax]
mov edx, dword [ebx + eax]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax], esi
xor dword [ebx + eax], edx
mov esi, dword [eax + 4]
mov edx, dword [ecx - 4]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 4], esi
xor dword [ecx - 4], edx
mov esi, dword [eax + 8]
mov edx, dword [ecx]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 8], esi
xor dword [ecx], edx
add eax, 0x10
add ecx, 0x10
sub ebp, 1
jne 0x100d3ba2
pop esi
pop ebp
pop ebx
ret
Function at 0x100e28c0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.10011fd0
mov eax, dword [0x101561c0]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xec]
push esi
mov esi, dword [esp + 0xec]
push edi
lea ecx, [esp + 0xa8]
push ecx
push 0x20
push eax
call fcn.100923e0
mov dl, byte [esp + 0xd3]
and byte [esp + 0xb4], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esp + 0xd3], dl
lea ecx, [esp + 0xb4]
lea edx, [esp + 0x14]
call fcn.100da160
lea edi, [esp + 0x14]
call fcn.100d95c0
lea eax, [esp + 0xb4]
push 0x40
push eax
call fcn.1005f7f0
mov ecx, dword [esp + 0xfc]
add esp, 0x14
pop edi
pop esi
xor ecx, esp
call fcn.100108f1
add esp, 0xe4
ret
Function at 0x100e2990
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x140
call fcn.10011fd0
mov eax, dword [0x101561c0]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x144]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x154]
push edi
mov ecx, 8
lea edi, [esp + 0x12c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x148]
and byte [esp + 0x12c], 0xf8
shr ecx, 0x18
and cl, 0x3f
or cl, 0x40
mov byte [esp + 0x14b], cl
lea ecx, [esp + 0x12c]
lea edx, [esp + 0x64]
mov dword [esp + 0x10], eax
call fcn.100da160
mov eax, dword [esp + 0xb4]
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb8]
mov esi, dword [esp + 0x94]
mov edi, dword [esp + 0x98]
mov ebx, dword [esp + 0x9c]
add edx, eax
sub eax, dword [esp + 0x8c]
mov ebp, dword [esp + 0xa0]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x90]
add edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0xbc]
add esi, edx
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0xc0]
add edi, esi
sub ecx, dword [esp + 0x90]
sub edx, dword [esp + 0x94]
sub esi, dword [esp + 0x98]
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0xc4]
add ebx, edi
sub edi, dword [esp + 0x9c]
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0xc8]
add ebx, ebp
mov ebp, dword [esp + 0xa4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xc8]
sub eax, dword [esp + 0xa0]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0xcc]
add ebx, ebp
mov ebp, dword [esp + 0xa8]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0xcc]
sub eax, dword [esp + 0xa4]
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0xd0]
add ebx, ebp
mov ebp, dword [esp + 0xac]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0xd0]
sub eax, dword [esp + 0xa8]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0xd4]
add ebx, ebp
mov ebp, dword [esp + 0xb0]
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0xd8]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0xd4]
add ebp, ebx
sub eax, dword [esp + 0xac]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x5c], eax
sub ebx, dword [esp + 0xb0]
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x64], ebx
call fcn.100d81a0
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, edx
call fcn.100d5f20
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
call fcn.100d5bc0
lea ecx, [esp + 0x13c]
push 0x20
push ecx
call fcn.1005f7f0
mov ecx, dword [esp + 0x164]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100108f1
add esp, 0x140
ret
Function at 0x100f7690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x5c
call fcn.10011fd0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x74]
push edi
xor edi, edi
push 0x38
lea eax, [esp + 0x38]
push edi
push eax
mov dword [esp + 0x3c], edi
call fcn.10010900
lea ecx, [esp + 0x3c]
sub ecx, esi
mov dword [esp + 0x20], ecx
xor eax, eax
lea ecx, [esp + 0x40]
add esp, 0xc
sub ecx, esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
jmp 0x100f76e4
mov esi, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx + eax*4]
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x18], 7
lea ecx, [ecx]
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
push ebp
push ecx
push 0
push eax
call fcn.10011f90
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + esi]
xor ebp, ebp
add eax, ecx
mov ecx, dword [esp + 0x10]
push ebp
adc edx, ebp
add edi, eax
mov eax, dword [esi + 4]
push ecx
adc ebx, edx
mov edx, dword [esp + 0x1c]
push ebp
push eax
mov dword [edx + esi], edi
call fcn.10011f90
xor ecx, ecx
add eax, ebx
adc edx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + esi]
xor ebx, ebx
add eax, edi
adc edx, ebx
mov dword [ecx + esi], eax
add esi, 8
sub dword [esp + 0x18], 1
mov edi, edx
jne 0x100f7700
mov ebp, dword [esp + 0x30]
imul ebp, ebp, 0xae918bc5
mov dword [esp + 0x68], edi
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], ebp
xor eax, eax
jmp 0x100f7778
mov eax, dword [esp + 0x2c]
mov edx, dword [esi*4 + 0x10149e1c]
push eax
push ebp
push 0
push edx
call fcn.10011f90
mov ecx, dword [esp + esi*4 + 0x30]
xor ebp, ebp
add eax, ecx
adc edx, ebp
add ebx, eax
adc edi, edx
test esi, esi
je 0x100f779f
mov dword [esp + esi*4 + 0x2c], ebx
mov ebp, dword [esp + 0x10]
mov edx, dword [esi*4 + 0x10149e20]
xor eax, eax
push eax
push ebp
push eax
push edx
mov dword [esp + 0x3c], eax
call fcn.10011f90
mov ecx, dword [esp + esi*4 + 0x34]
xor ebx, ebx
add eax, ecx
adc edx, ebx
xor ecx, ecx
add eax, edi
adc edx, ecx
lea ecx, [esi + 1]
test ecx, ecx
je 0x100f77d4
mov dword [esp + esi*4 + 0x30], eax
add esi, 2
xor edi, edi
mov ebx, edx
cmp esi, 0xe
jb 0x100f7774
mov edx, dword [esp + esi*4 + 0x30]
xor eax, eax
lea esi, [esp + esi*4 + 0x30]
xor ecx, ecx
add edx, dword [esp + 0x1c]
adc eax, ecx
add ebx, edx
adc edi, eax
mov eax, dword [esp + 0x20]
inc eax
mov dword [esi - 4], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
cmp eax, 0xe
jb 0x100f76e0
mov eax, dword [esp + 0x70]
push edi
push 0x10149e1c
lea edx, [esp + 0x38]
push edx
push eax
mov edx, 0x10149e1c
call fcn.100f7570
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x100ff9ed
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x100ffa1e
call fcn.100112f8
mov dword [eax], esi
call fcn.100112e5
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10015cb2
add esp, 0x14
push 0x16
pop eax
jmp 0x100ffa73
test dword [ebp + 0xc], 0xfffffff9
jne 0x100ff9fa
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100ffa4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1001130b
pop ecx
call fcn.100112e5
mov eax, dword [eax]
jmp 0x100ffa73
test al, 0x10
jne 0x100ffa71
test al, 1
je 0x100ffa71
test byte [ebp + 0xc], 2
je 0x100ffa71
call fcn.100112f8
mov dword [eax], 5
call fcn.100112e5
mov dword [eax], 0xd
jmp 0x100ffa42
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1000fc81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000fc90
pop dword [ebp - 0x30]
mov eax, 0xb238713c
add eax, 0x5dc88b54
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x43415
push 0
mov eax, 0x1676b345
add eax, 0xf98c3e17
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x5e3b4e84
add ecx, 0xa1c50592
mov esi, eax
mov edi, 0x951a7e29
sub edi, 0x8515d229
add edi, dword [ebp - 0x30]
mov ebx, 0xa96aa7ac
xor dword [ebp - 0x1c], 0x9142a49a
mov edx, dword [edi]
add dword [ebp - 0x1c], edi
add edx, ebx
mov dword [esi], edx
add dword [ebp - 0x2c], 0x70d0d8f2
add esi, 4
add edi, 0x7e8b0491
add edi, 0x8174fb73
loop 0x1000fce9
add eax, 0x86813487
add eax, 0x79800ea4
mov ebx, eax
add eax, 5
mov ecx, 0x7e2c39d0
sub ecx, 0x6e2c39d0
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x100123e7
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002d2cf
call fcn.10016fd1
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1000fc81
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x10012492
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000fc81
mov ecx, dword [esi]
test al, al
je 0x10012474
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000fc81
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x1001248b
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.1000fc81
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009bb3
cmp dword [ebx + 0x24], 0
je 0x100124b2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000fc81
test al, al
je 0x100124b2
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016f9a
ret
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.1000fc81
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10020313
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x10020322
pop dword [ebp - 4]
mov eax, 0x10020322
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xf5e5fb86
add dword [ebp - 0x14], 0x586c49c5
mov dword [ebp - 0x10], 0x6263cdde
add dword [ebp - 0x10], 0xcfcf7e67
mov dword [ebp - 0xc], 0xc95c136a
add dword [ebp - 0xc], 0x82f030c4
mov dword [ebp - 8], 0xc2823394
sub dword [ebp - 8], 0xc2823394
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xa413279c
sub dword [ebp - 0x14], 0x2fa0be46
mov dword [ebp - 0x10], 0x2801e89b
sub dword [ebp - 0x10], 0xe6958726
mov dword [ebp - 0xc], 0x62585cfd
add dword [ebp - 0xc], 0x1170f6f
mov dword [ebp - 8], 0x7804301
add dword [ebp - 8], 0xf87fbcff
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0xb9e4c28a
sub eax, 0xa9e2a24a
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x36790
push 0
call eax
mov ecx, 0x4138
xor ebx, ebx
add ebx, eax
mov edx, 0xad7d4921
add edx, 0x6285d2df
add edx, dword [ebp - 4]
mov edi, 0x793fd83e
mov esi, dword [edx]
xor esi, edi
mov dword [ebx], esi
add ebx, 4
add edx, 4
loop 0x10020430
add eax, 0xf7b3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx