joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10086fa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x10087088
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100a3d80
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x10087088
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10086ff7
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x10087088
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10087020
mov eax, dword [0x100eb750]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x10087035
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10087050
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x100870a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.100a3d80
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.10086560
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1008710a
mov al, byte [edi + ecx]
test al, al
je 0x1008710a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x100870f1
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x1008712b
inc eax
sub ecx, 1
jne 0x10087120
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x10087180
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x10087175
lea edi, [ebp - 0x84]
mov eax, 0x7fffffff
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x10087174
mov bl, byte [edi + ecx]
test bl, bl
je 0x10087174
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x10087160
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.100a3d80
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x100eb858
push str.SoftwareComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x1008723a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10087204
test cl, cl
je 0x10087200
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10087204
add eax, 2
add esi, 2
test cl, cl
jne 0x100871e4
xor eax, eax
jmp 0x10087209
sbb eax, eax
or eax, 1
test eax, eax
je 0x1008723a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10087216
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push 0x80000002
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10087243
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x100eb858
push str.SoftwareComMaster
push 0x80000002
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1007d494
mov esp, ebp
pop ebp
ret
Function at 0x10088320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
xor al, al
push edi
xor edi, edi
test esi, esi
je 0x100883e7
push ebx
mov ecx, dword [ebp + 8]
mov dl, byte [edi + ecx]
xor dl, al
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
xor al, 0x8c
and bl, 1
movzx edx, al
movzx eax, cl
cmove edx, eax
mov cl, dl
shr cl, 1
mov al, cl
xor al, 0x8c
and dl, 1
movzx ebx, al
movzx eax, cl
cmove ebx, eax
mov cl, bl
shr cl, 1
mov al, cl
movzx ecx, cl
xor al, 0x8c
and bl, 1
movzx eax, al
cmove eax, ecx
inc edi
cmp edi, esi
jb 0x10088335
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10089ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d83f3
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x8c], 0
mov dword [ebx], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
push 0x201
push dword [0x1010f468]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.10089a30
mov edi, dword [ebp - 0x8c]
test eax, eax
jne 0x10089cc1
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.100a3d80
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x100eccf0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10089cc1
mov eax, dword [ebp - 0x7c]
cmp eax, 1
je 0x10089bb5
cmp eax, 2
jne 0x10089cc1
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x10089bd6
test cl, 1
jne 0x10089cc1
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x10089bdc
jmp 0x10089cc1
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x10089cc1
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x10089cec
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x78]
call fcn.10087f20
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x20]
push 0x100eccf8
push eax
call fcn.1008a0e0
mov esi, dword [ebp - 0x78]
push 0x2a
push esi
call fcn.10088320
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x7c], eax
jne 0x10089ca5
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10089c46
sub edx, ecx
lea eax, [ebp - 0x74]
mov ecx, dword [ebp - 0x80]
sar edx, 1
push edx
push eax
call fcn.10089d00
push dword [0x1010f470]
lea eax, [ebp - 0x74]
push dword [0x1010f46c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x10089c82
mov dword [ebx], 1
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10089c9e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x10089cc3
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10089cc1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
test edi, edi
je 0x10089cce
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10003fe0
int3
Function at 0x10089de0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d8428
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1010f404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x202
push dword [0x1010f468]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push 0x80000002
call fcn.10089a30
test eax, eax
je 0x10089f08
mov esi, dword [ebp - 0x18]
mov edi, dword [0x1010f468]
mov dword [ebp - 0x10], 0
test esi, esi
je 0x10089eb3
cmp dword [esi], 0
je 0x10089ea6
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10089e73
mov eax, 1
jmp 0x10089ed4
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10089eac
push 0
push dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call eax
jmp 0x10089ed4
cmp dword [esi + 4], 0
jne 0x10089eb3
mov eax, 1
jmp 0x10089ed4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20206
push 0
push 0
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10089efe
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10089ee6
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x200
test eax, eax
je 0x10089f0b
xor ebx, ebx
jmp 0x10089faf
mov esi, dword [ebp - 0x20]
xor ebx, ebx
jmp 0x10089faf
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x10089f68
mov ecx, dword [ebx]
test ecx, ecx
je 0x10089fce
push ecx
push eax
call fcn.100ac499
add esp, 8
test eax, eax
je 0x10089f68
mov edx, dword [edi]
test edx, edx
je 0x10089f68
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10089f40
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.m2_old
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebx]
test edx, edx
jne 0x10089f73
lea eax, [edx + 0xd]
jmp 0x10089fa8
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10089f80
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x100eccf0
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
test eax, eax
sete bl
test esi, esi
je 0x10089fba
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10003fe0
int3
Function at 0x1008b5d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008b641
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1008b60f
cmp eax, 2
jne 0x1008b62b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1008b63b
test ecx, ecx
je 0x1008b636
test cl, 1
jne 0x1008b62b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x1008b63b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1008d253
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100a2810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d932b
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
push ebx
push esi
push edi
mov eax, dword [0x1010f404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
lea esi, [ebx + 0x14]
push 0x20000
push 0
push esi
mov dword [ebp - 0x14], edi
call fcn.100a3d80
add esp, 0xc
lea eax, [ebx + 0x20014]
push 0
push eax
push 0x20000
push esi
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100a296b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
call fcn.1005e780
push 1
mov ecx, eax
mov edx, dword [eax]
mov edx, dword [edx + 8]
call edx
movzx ecx, al
sub ecx, 1
jne 0x100a294d
push 0x61
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x44], cl
lea ecx, [ebp - 0x44]
push str.d:jenkins.jenkinsworkspacelib_commonlds_rpclds_rpc_src_rpc_instance_rpc_client_instance.cpp
mov dword [ebp - 0x30], 0xf
call fcn.100057a0
push 3
push 0x100de1bc
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.100057a0
mov byte [ebp - 4], 1
call fcn.1005e780
mov edi, eax
lea ecx, [ebp - 0xdc]
push 0x58
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10008360
mov esi, eax
push str.RecvData_failed__error_code_:
push esi
mov byte [ebp - 4], 2
call fcn.10009a40
add esp, 8
mov ecx, esi
push dword [ebp - 0x10]
call fcn.100096e0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.10009f30
lea ecx, [ebp - 0x2c]
call fcn.10003e30
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0xffffffff
call fcn.10003e30
mov edi, dword [ebp - 0x14]
lea esi, [ebx + 0x14]
cmp dword [ebp - 0x10], 0xe8
mov dword [ebx + 0xc], 6
jne 0x100a296b
mov dword [ebx + 0xc], 7
mov dword [ebx + 0x10], 0
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
push dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov dword [edi + 0x10], 0
mov eax, dword [ebx + 0x20014]
add eax, esi
push eax
push esi
push dword [ecx + 4]
call fcn.1006cb40
mov dword [edi + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100a29b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d936b
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x1010f404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x10], 0
mov edi, dword [ebp + 8]
jne 0x100a29f5
mov dword [ebx + 0xc], 8
jmp 0x100a2b62
mov eax, dword [edi + 8]
sub eax, dword [edi + 4]
inc eax
push eax
mov dword [ebp - 0x18], eax
call fcn.1007d4aa
mov esi, eax
mov dword [ebp - 0x1c], eax
add esp, 4
test esi, esi
je 0x100a2a24
push dword [ebp - 0x18]
push 0
push esi
call fcn.100a3d80
add esp, 0xc
mov byte [esi], 0
jmp 0x100a2a29
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ecx, dword [edi + 4]
mov eax, dword [edi + 8]
sub eax, ecx
mov dword [ebp - 0x14], 0
push eax
push ecx
push esi
call fcn.100a3800
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x14]
sub eax, dword [edi + 4]
add esp, 0xc
inc eax
push 0
push ecx
push eax
push esi
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100a2b50
mov dword [ebx + 0xc], 5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
call fcn.1005e780
push 1
mov ecx, eax
mov edx, dword [eax]
mov edx, dword [edx + 8]
call edx
movzx ecx, al
sub ecx, 1
jne 0x100a2b37
push 0x61
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0x4c], cl
lea ecx, [ebp - 0x4c]
push str.d:jenkins.jenkinsworkspacelib_commonlds_rpclds_rpc_src_rpc_instance_rpc_client_instance.cpp
mov dword [ebp - 0x38], 0xf
call fcn.100057a0
push 3
push 0x100de1bc
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
call fcn.100057a0
mov byte [ebp - 4], 1
call fcn.1005e780
mov edi, eax
lea ecx, [ebp - 0xe4]
push 0x48
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10008360
mov esi, eax
push str.send_failed__error_code_:
push esi
mov byte [ebp - 4], 2
call fcn.10009a40
add esp, 8
mov ecx, esi
push dword [ebp - 0x18]
call fcn.100096e0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xe4]
call fcn.10009f30
lea ecx, [ebp - 0x34]
call fcn.10003e30
lea ecx, [ebp - 0x4c]
call fcn.10003e30
mov esi, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 0xe8
jne 0x100a2b57
mov dword [ebx + 0xc], 7
mov dword [ebx + 0x10], 0
jmp 0x100a2b57
mov dword [ebx + 0xc], 0
push 1
push esi
call fcn.1007d115
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007d494
mov esp, ebp
pop ebp
ret 4

Function at 0x100befae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100bee2d

Function at 0x100c5733
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100c53f3
Function at 0x40ed64
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x40eae0
pop edx
mov ebx, 0x5a27abd1
dec edi
call fcn.0040ed91
mov ebx, ebx
inc edi
xor dword [eax], edx
mov edi, 0x4775d198
add eax, 1
sub edi, edi
cmp eax, esi
jne fcn.0040ed64
ret

Function at 0x10001b30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
push ebx
cmovae eax, dword [ebp + 0x20]
push esi
push edi
push dword [ebp + 0x30]
mov dword [ebp - 4], ecx
mov ecx, 0x10019948
push eax
call fcn.10005860
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x10019930
push eax
call fcn.10005860
mov esi, dword [0x10019958]
xor ebx, ebx
mov edi, dword [0x1001995c]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x1001a5f0], bl
mov eax, ebx
mov ecx, 0x10019948
cmovae ecx, dword [0x10019948]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x1001a4f0], al
inc ebx
cmp ebx, 0x100
jl 0x10001b80
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x1001a5f0]
movzx eax, byte [esi + 0x1001a4f0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x10001bd4
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x1001a5f0]
mov byte [esi + 0x1001a5f0], al
inc esi
mov byte [edi + 0x1001a5f0], dl
cmp esi, 0x100
jl 0x10001bb0
mov esi, dword [ebp - 4]
mov ecx, esi
call fcn.10001980
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10001c29
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001c1f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001c74
push edx
push ecx
call fcn.10006011
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x10001c6b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10001c61
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001c74
push edx
push ecx
call fcn.10006011
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10008640
int3
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412ea9
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x60
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
dec byte [esi + ebx]
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xcf
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x3d
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd1
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x6d
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 7
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc3
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x78
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xee
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x75
add esp, 0x40
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8a
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 5
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa2
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451ba9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bba
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b052
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b063
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af39
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b08b
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4014da
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0xfa8]
mov eax, 0x1028
call fcn.0040a9a0
mov eax, dword [0x42b7a4]
xor eax, ebp
mov dword [ebp + 0xfa4], eax
push esi
push edi
mov edi, dword [ebp + 0xfb0]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40157e
push esi
call fcn.00404676
test al, al
je 0x40157e
push esi
call fcn.0040468d
test al, al
jne 0x40157e
push 0x800
push edi
lea eax, [ebp - 0x60]
push eax
call fcn.00407851
lea eax, [ebp - 0x60]
push eax
call fcn.0040e348
pop ecx
lea eax, [eax*2 + 2]
cmp eax, 0x1002
jae 0x401597
xor ecx, ecx
push 0x1e
mov word [ebp + eax - 0x60], cx
lea eax, [ebp - 0x80]
push ecx
push eax
call fcn.0040bb90
add esp, 0xc
mov dword [ebp - 0x7c], 3
push 0x14
pop eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp + 0xfa4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040a986
add ebp, 0xfa8
leave
ret 4
call fcn.0040a8ab
int3