joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x458030]
jne 0x401073
repz ret
jmp fcn.00401e41

Function at 0x408aeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d3a
and dword [ebp - 4], 0
cmp dword [0x45ab68], 0
mov ebx, eax
jne 0x408b9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c4d
push eax
call fcn.00404cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45ab68], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45ab6c], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45ab70], eax
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x45ab78], eax
test eax, eax
je 0x408b9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x45ab74], eax
mov eax, dword [0x45ab74]
cmp eax, ebx
je 0x408bf4
cmp dword [0x45ab78], ebx
je 0x408bf4
push eax
call fcn.00404d43
push dword [0x45ab78]
mov esi, eax
call fcn.00404d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bf4
test edi, edi
je 0x408bf4
call esi
test eax, eax
je 0x408beb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408beb
test byte [ebp - 0xc], 1
jne 0x408bf4
or dword [ebp + 0x10], 0x200000
jmp 0x408c2d
mov eax, dword [0x45ab6c]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c2d
mov eax, dword [0x45ab70]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45ab68]
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af50
Capabilities:
Set console window title

Disassembly:
sub esp, 0x820
mov eax, dword [0x458030]
xor eax, esp
mov dword [esp + 0x81c], eax
mov eax, dword [0x2c3855c]
push ebx
mov ebx, dword [0x2c38280]
push esi
mov esi, dword [0x458f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40af91
push str.zolihetujejijitewi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c3855c]
mov dword [0x45ad0c], esi
cmp eax, 0x114e
jne 0x40afbb
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x2c3855c]
cmp eax, 0x2f
jne 0x40afdb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae50
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x820
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433030]
jne 0x401073
repz ret
jmp fcn.00401e51

Function at 0x408b0b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d5a
and dword [ebp - 4], 0
cmp dword [0x435b68], 0
mov ebx, eax
jne 0x408bbc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c6d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c6d
push eax
call fcn.00404ce8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435b68], eax
call esi
push eax
call fcn.00404ce8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435b6c], eax
call esi
push eax
call fcn.00404ce8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435b70], eax
call esi
push eax
call fcn.00404ce8
pop ecx
mov dword [0x435b78], eax
test eax, eax
je 0x408bbc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ce8
pop ecx
mov dword [0x435b74], eax
mov eax, dword [0x435b74]
cmp eax, ebx
je 0x408c14
cmp dword [0x435b78], ebx
je 0x408c14
push eax
call fcn.00404d63
push dword [0x435b78]
mov esi, eax
call fcn.00404d63
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408c14
test edi, edi
je 0x408c14
call esi
test eax, eax
je 0x408c0b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408c0b
test byte [ebp - 0xc], 1
jne 0x408c14
or dword [ebp + 0x10], 0x200000
jmp 0x408c4d
mov eax, dword [0x435b6c]
cmp eax, ebx
je 0x408c4d
push eax
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c4d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c4d
mov eax, dword [0x435b70]
cmp eax, ebx
je 0x408c4d
push eax
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435b68]
call fcn.00404d63
pop ecx
test eax, eax
je 0x408c6d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c6f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af60
Capabilities:
Set console window title

Disassembly:
sub esp, 0x820
mov eax, dword [0x433030]
xor eax, esp
mov dword [esp + 0x81c], eax
mov eax, dword [0x2c1355c]
push ebx
mov ebx, dword [0x2c13280]
push esi
mov esi, dword [0x433f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40afa1
push 0x4318cc
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c1355c]
mov dword [0x435d0c], esi
cmp eax, 0x114e
jne 0x40afcb
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x2c1355c]
cmp eax, 0x2f
jne 0x40afeb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae60
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x820
ret
Function at 0x4226aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4226b9
pop dword [ebp - 0x2c]
mov eax, 0xe0576aec
add eax, 0x1feabbcd
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x50699
push 0
mov eax, 0xf505d73f
sub eax, 0xf4c1248f
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xe6b6f923
sub ecx, 0xe6b6aff4
xor edx, edx
add edx, eax
mov ebx, 0xbd075d41
add ebx, 0x434130bf
add ebx, dword [ebp - 0x2c]
mov esi, 0xff645cf4
add esi, 0x2693e0c8
mov edi, dword [ebx]
add dword [ebp - 0x10], esi
add edi, esi
xor dword [ebp - 8], 0x45b7eaa0
mov dword [edx], edi
sub dword [ebp - 0x14], 0x752a6992
add edx, 4
add ebx, 0xd4e4840e
sub ebx, 0xd4e4840a
loop 0x42271a
add eax, 0x935cb6c6
sub eax, 0x935b9f37
mov ebx, eax
add eax, 0x9b805085
add eax, 0x647faf80
mov ecx, 0x743e5650
add ecx, 0x8c01a9b0
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x438c96
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop edx
add eax, 1
push 0x62bbd588
pop eax
call fcn.00438cde
or ecx, ecx
inc ecx
xor dword [ebx], edx
add ecx, 0xa91fda6d
or ecx, ecx
add ecx, 1
inc ebx
add ecx, eax
add ecx, ecx
add eax, eax
cmp ebx, edi
jne fcn.00438c96
mov eax, ecx
sub ecx, ecx
add eax, eax
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4063ba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4063de
xor eax, eax
test eax, eax
je 0x4063f1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4063f1
xor ecx, ecx
jmp 0x4063f4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4064db
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x406512
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4064ec
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x4064e7
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406543
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x406525
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402d89
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x402dbf
lea esi, [edi + 4]
test esi, esi
je 0x402dbf
call fcn.00402ceb
test al, al
je 0x402dbf
mov ecx, edi
call fcn.00402ceb
test al, al
je 0x402dbf
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x402dc1
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x40612f
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4061b0
mov byte [esi + 8], 1
call main
cmp dword [esi + 0x10], 0
je 0x4061b0
test al, al
je 0x40614f
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.00406749
test al, al
jne 0x406176
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call main
cmp dword [esi + 0x18], 0
jne 0x40619d
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x4061b0
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x406749
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x406756
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x40678f
cmp eax, 0x80
je 0x40678f
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x406752
mov al, 1
pop esi
ret

Function at 0x407427
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407496
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407472
push ebx
push edi
push eax
call fcn.0040b3a0
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x40748d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10020ff5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10021004
pop dword [ebp - 0x48]
mov eax, 0x10021004
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x49719cb
add dword [ebp - 0x58], 0x49bb2b80
mov dword [ebp - 0x54], 0xea4948ba
add dword [ebp - 0x54], 0x47ea038b
mov dword [ebp - 0x50], 0x7da01074
add dword [ebp - 0x50], 0xceac33ba
mov dword [ebp - 0x4c], 0x3357840c
sub dword [ebp - 0x4c], 0x3357840c
lea eax, [ebp - 0x58]
push eax
mov eax, 0x1b91d933
sub eax, 0xb8fb8ef
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xf0ef4bb6
add dword [ebp - 0x58], 0x83831da0
mov dword [ebp - 0x54], 0x20b720d9
sub dword [ebp - 0x54], 0xdf4abf64
mov dword [ebp - 0x50], 0xed3d9819
add dword [ebp - 0x50], 0x7631d453
mov dword [ebp - 0x4c], 0x116a8ff5
sub dword [ebp - 0x4c], 0x116a8ff5
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x26b2d3cc
sub eax, 0x16b0b38c
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1c2
push 0
call eax
mov ecx, 0x5002
mov esi, eax
mov edi, 0x10031c00
add edi, dword [ebp - 0x48]
mov edx, 0x11413863
add edx, 0xc6b6bd29
mov dword [ebp - 0x28], 0x74073707
mov ebx, dword [edi]
xor dword [ebp - 0x24], edi
add ebx, edx
xor dword [ebp - 4], 0xfa9267cf
mov dword [esi], ebx
mov dword [ebp - 0x44], 0x1cecad20
add esi, 0x974c552b
add esi, 0x68b3aad9
add edi, 0xd1d32bf5
sub edi, 0xd1d32bf1
loop 0x10021115
add eax, 0x43052ed9
sub eax, 0x4303fbfe
xor ebx, ebx
add ebx, eax
add eax, 0x78f0aae
sub eax, 0x78f0aa9
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10005764
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
mov al, byte [0x100c09b8]
test al, al
je 0x10005878
mov ecx, 0x100c09a0
call fcn.10024c86
push 0x4d
push 0x30c72ec8
push 0xec4
push 0x100c09a0
call fcn.10004243
add esp, 0x10
mov al, byte [0x100c09f8]
test al, al
je 0x100058cd
mov ecx, 0x100c09c0
call fcn.10024cd0
push 0x47
push 0x8a0906
push 0xb10f16
push 0x100c09c0
call fcn.10004243
add esp, 0x10
mov al, byte [0x100c0a18]
test al, al
je 0x10005935
mov ecx, 0x100c0a00
call fcn.10024c86
push 0x4d
push 0x313dd368
push 0xee8
push 0x100c0a00
call fcn.10004243
add esp, 0x10
mov al, byte [0x100c0a58]
test al, al
je 0x1000598a
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
mov ecx, 0x100c0a20
call fcn.10024cd0
push 0x47
push 0x8b572e
push 0xb2bcba
push 0x100c0a20
call fcn.10004243
add esp, 0x10
mov al, byte [0x100c0a80]
test al, al
je 0x100059f2
mov ecx, 0x100c0a60
call fcn.10024d1a
push 0x409
push 0xe3e8
push 0x123d8c
push 0x100c0a60
call fcn.10004243
add esp, 0x10
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
pop esi
pop edi
ret
push 0x100c09b8
call fcn.100252dc
add esp, 4
test eax, eax
je 0x10005773
movaps xmm0, xmmword [0x100b0220]
movaps xmmword [0x100c09a0], xmm0
mov dword [0x100c09b0], 0x4f1e79c6
mov word [0x100c09b4], 0x182
push 0x1001e844
call fcn.100013b0
add esp, 4
push 0x100c09b8
call fcn.10025383
add esp, 4
jmp 0x10005773
push 0x100c09f8
call fcn.100252dc
add esp, 4
test eax, eax
je 0x100057a3
movaps xmm0, xmmword [0x100b0230]
movaps xmmword [0x100c09c0], xmm0
movaps xmm0, xmmword [0x100b0240]
movaps xmmword [0x100c09d0], xmm0
movaps xmm0, xmmword [0x100b0250]
movaps xmmword [0x100c09e0], xmm0
mov dword [0x100c09f0], 0x16c04e5
push 0x1001e85a
call fcn.100013b0
add esp, 4
push 0x100c09f8
call fcn.10025383
add esp, 4
jmp 0x100057a3
push 0x100c0a18
call fcn.100252dc
add esp, 4
test eax, eax
je 0x100057d3
movaps xmm0, xmmword [0x100b0220]
movaps xmmword [0x100c0a00], xmm0
mov dword [0x100c0a10], 0x4f1e79c6
mov word [0x100c0a14], 0x182
push 0x1001e87d
call fcn.100013b0
add esp, 4
push 0x100c0a18
call fcn.10025383
add esp, 4
jmp 0x100057d3
push 0x100c0a58
call fcn.100252dc
add esp, 4
test eax, eax
je 0x10005803
movaps xmm0, xmmword [0x100b0230]
movaps xmmword [0x100c0a20], xmm0
movaps xmm0, xmmword [0x100b0240]
movaps xmmword [0x100c0a30], xmm0
movaps xmm0, xmmword [0x100b0250]
movaps xmmword [0x100c0a40], xmm0
mov dword [0x100c0a50], 0x16c04e5
push 0x1001e893
call fcn.100013b0
add esp, 4
push 0x100c0a58
call fcn.10025383
add esp, 4
jmp 0x10005803
push 0x100c0a80
call fcn.100252dc
add esp, 4
test eax, eax
je 0x1000583b
mov byte [0x100c0a7e], 1
movaps xmm0, xmmword [0x100b0260]
movaps xmmword [0x100c0a60], xmm0
movsd xmm0, qword [0x100b0270]
movsd qword [0x100c0a70], xmm0
mov dword [0x100c0a78], 0x41287bdb
mov word [0x100c0a7c], 0x6ad3
push 0x1001e8b6
call fcn.100013b0
add esp, 4
push 0x100c0a80
call fcn.10025383
add esp, 4
jmp 0x1000583b
Function at 0x10024c86
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x15], 0
je 0x10024cce
push ebx
push edi
push esi
sub esp, 8
movsd xmm0, qword [0x100b1020]
movsd qword [esp], xmm0
xor eax, eax
xor esi, esi
xor edx, edx
xor edi, edi
mov ebx, eax
and ebx, 7
mov bl, byte [esp + ebx]
xor byte [ecx + eax], bl
add edx, 1
adc edi, 0
cmp eax, 0x14
sbb esi, 0
mov eax, edx
mov esi, edi
jb 0x10024ca7
mov byte [ecx + 0x15], 0
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x10024cd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x33], 0
je 0x10024d18
push ebx
push edi
push esi
sub esp, 8
movsd xmm0, qword [0x100b1030]
movsd qword [esp], xmm0
xor eax, eax
xor esi, esi
xor edx, edx
xor edi, edi
mov ebx, eax
and ebx, 7
mov bl, byte [esp + ebx]
xor byte [ecx + eax], bl
add edx, 1
adc edi, 0
cmp eax, 0x32
sbb esi, 0
mov eax, edx
mov esi, edi
jb 0x10024cf1
mov byte [ecx + 0x33], 0
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x10024d1a
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1e], 0
je 0x10024d62
push ebx
push edi
push esi
sub esp, 8
movsd xmm0, qword [0x100b1040]
movsd qword [esp], xmm0
xor eax, eax
xor esi, esi
xor edx, edx
xor edi, edi
mov ebx, eax
and ebx, 7
mov bl, byte [esp + ebx]
xor byte [ecx + eax], bl
add edx, 1
adc edi, 0
cmp eax, 0x1d
sbb esi, 0
mov eax, edx
mov esi, edi
jb 0x10024d3b
mov byte [ecx + 0x1e], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x10077a10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x10], 0x100b624c
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
test edi, edi
je 0x10077a4e
mov dword [edi], 0
call fcn.1007dcd0
mov dword [edi + 4], eax
mov dword [esp], 0
call fcn.1007dcd0
mov dword [esp + 4], eax
mov edi, esp
lea eax, [esp + 0x80]
lea ecx, [esp + 8]
push edi
push eax
push esi
push ecx
call fcn.100771b0
add esp, 0x10
movzx eax, byte [esp + 8]
cmp eax, 2
je 0x10077a91
test eax, eax
jne 0x10077a9b
lea ecx, [esp + 0x10]
push edi
call fcn.10077c30
jmp 0x10077aba
test byte [ebx], 1
je 0x10077abc
mov eax, dword [ebx + 8]
jmp 0x10077abf
mov dword [esp + 0x30], 0x14
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push 0x100b625d
push eax
push ecx
call fcn.10078800
add esp, 0xc
jmp 0x10077ad0
lea eax, [ebx + 2]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, eax
mov al, 1
test ecx, ecx
je 0x10077ad8
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10074ea0
add esp, 4
mov esi, eax
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], esi
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
jne 0x10077b54
call dword [sym.imp.msvcrt.dll__errno]
mov esi, dword [eax]
call fcn.1007db30
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x28], 0
call fcn.1007dcd0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x20]
push eax
push ecx
push ebx
push edx
call fcn.100771b0
add esp, 0x10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
cmp al, 2
jne 0x10077b77
xor eax, eax
jmp 0x10077ad0
call dword [sym.imp.msvcrt.dll__errno]
mov esi, dword [eax]
call fcn.1007db30
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], esi
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
jmp 0x10077a8a
jmp 0x10077a85