joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100dda2a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100dda69
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100dda69
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100dda69
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100dda69
cmp dword [ecx + 0x74], 0xe
jbe 0x100dda69
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100df8a7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.100d3820
mov eax, dword [0x1017d120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100ed948
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100df8e9
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x100dfa45
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.100fc560
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10181288]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100efe71
mov ecx, dword [esi*4 + 0x10181288]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x100dfa3e
cmp eax, dword [ecx + edi + 0x24]
jne 0x100dfa3e
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100dfa3e
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100efe71
add esp, 0x14
test edx, edx
jl 0x100dfa3e
jg 0x100df9b4
test eax, eax
jb 0x100dfa3e
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100dfa3e
jl 0x100df9ce
cmp dword [ebp - 0x1008], eax
ja 0x100dfa3e
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100df9ec
test ebx, ebx
je 0x100dfa25
cmp ecx, edi
jae 0x100dfa25
mov al, byte [ecx]
cmp al, 0xd
jne 0x100dfa06
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100dfa12
cmp byte [ecx + 1], 0xa
jne 0x100dfa12
inc ecx
jmp 0x100dfa12
movzx eax, al
movsx eax, byte [eax + 0x1017d3a0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100df9ec
cmp edx, ebx
jne 0x100df9ec
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100dfa43
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100d24f3
leave
ret

Function at 0x100ee465
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ee3e7
Function at 0x100efeed
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10181288]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100eff2d
cmp byte [ebx], 0xa
jne 0x100eff2d
or byte [edi + eax + 0x28], 4
jmp 0x100eff32
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x100f0031
mov dl, byte [eax]
cmp dl, 0x1a
je 0x100f0014
inc eax
cmp dl, 0xd
je 0x100eff5e
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x100eff84
cmp eax, ecx
jae 0x100eff92
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x100eff46
jmp 0x100f0031
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100f000f
cmp dword [ebp - 0x10], 0
je 0x100f000f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10181288]
test byte [eax + edi + 0x28], 0x48
je 0x100effe9
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100effd4
mov byte [esi], dl
jmp 0x100effe5
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10181288]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100f0031
cmp byte [ebp - 1], 0xa
jne 0x100efff8
cmp esi, ebx
jne 0x100efff8
mov byte [esi], 0xa
jmp 0x100f0030
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100efe8f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100f0031
mov byte [esi], 0xd
jmp 0x100f0030
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10181288]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100f002e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100f0031
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100f003a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10181288]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100f0080
cmp word [ebx], dx
jne 0x100f0080
or byte [eax + edi + 0x28], 4
jmp 0x100f0085
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x100f01e8
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x100f01c8
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x100f00c6
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x100f00fc
cmp eax, edx
jae 0x100f010a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100f00a1
jmp 0x100f01e8
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100f01c3
cmp dword [ebp - 0x18], 0
je 0x100f01c3
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10181288]
test byte [eax + edi + 0x28], 0x48
je 0x100f0199
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100f015d
mov word [esi], cx
jmp 0x100f0194
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10181288]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10181288]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10181288]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x100f01e8
pop eax
cmp word [ebp - 4], ax
jne 0x100f01a9
cmp esi, ebx
jne 0x100f01a9
mov word [esi], ax
jmp 0x100f01e5
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100efe8f
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x100f01e8
push 0xd
pop eax
jmp 0x100f01a4
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10181288]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x100f01e2
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x100f01e8
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100f0d5b
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1010eba4
push 0x1010eb9c
push str.FlsAlloc
push 0x1f
call fcn.100f0b46
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100f0d8f
push dword [ebp + 8]
mov ecx, esi
call dword [0x10109304]
call esi
jmp 0x100f0d95
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100f0dd9
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1010ebb4
push 0x1010ebac
push str.FlsGetValue
push 0x21
call fcn.100f0b46
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100f0e10
push dword [ebp + 8]
mov ecx, esi
call dword [0x10109304]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100f0e18
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1010ebbc
push 0x1010ebb4
push str.FlsSetValue
push 0x22
call fcn.100f0b46
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100f0e52
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10109304]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100f50ee
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100f518b
push ebx
push esi
call fcn.100f50b7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100ec819
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100f5138
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100f518a
push edi
push eax
call fcn.100ec679
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100f5158
call fcn.100ec583
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100f5189
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100ec819
add esp, 0x20
test eax, eax
jne 0x100f5177
push edi
call fcn.100ec583
jmp 0x100f517f
push ebx
call fcn.100ec583
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100f518e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100f519f
pop esi
ret
push ebx
push edi
push esi
call fcn.100f50b7
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100ec679
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100f51c7
push ebx
push esi
push edi
call fcn.100d42e0
add esp, 0xc
push 0
call fcn.100ec583
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100f5597
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100f51dc

Function at 0x100f76ba
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100eabd3
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100f7729
cmp esi, dword [ebp - 4]
je 0x100f7724
cmp dword [ebp + 0xc], 0
je 0x100f7724
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100f7701
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100f720c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100f772b
xor eax, eax
inc eax
jmp 0x100f772b
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100f7790
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1017d120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100eabd3
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100eabd3
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100f7807
cmp word [ecx], dx
je 0x100f7807
mov eax, dword [0x1010f204]
push edi
dec eax
push eax
push 0x1010f0f0
call fcn.100f772f
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100f787a
cmp word [eax], dx
je 0x100f787a
mov eax, dword [edi]
test eax, eax
je 0x100f782b
cmp word [eax], dx
je 0x100f782b
lea eax, [ebp - 0x10]
push eax
call fcn.100f7112
jmp 0x100f7834
lea eax, [ebp - 0x10]
push eax
call fcn.100f71ad
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100f78a4
mov eax, dword [0x1010f0ec]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1010ede0
call fcn.100f772f
add esp, 0xc
test al, al
je 0x100f78a4
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100f786f
cmp word [eax], di
je 0x100f786f
lea eax, [ebp - 0x10]
push eax
call fcn.100f7112
pop ecx
jmp 0x100f78a6
lea eax, [ebp - 0x10]
push eax
call fcn.100f71ad
jmp 0x100f786c
mov eax, dword [edi]
test eax, eax
je 0x100f7891
cmp word [eax], dx
je 0x100f7891
lea eax, [ebp - 0x10]
push eax
call fcn.100f70c7
pop ecx
jmp 0x100f78a4
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100f796f
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100f75b4
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100f796f
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100f796f
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100f796f
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100f78fc
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100f0ff4
test ebx, ebx
je 0x100f796a
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100f0ff4
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100f796f
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100f796f
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100ee0c7
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100f7971
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d24f3
leave
ret
Function at 0x100fb8d1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100fb84d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100fba40
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100fba40
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100fb9f5
jg 0x100fb92d
test eax, eax
je 0x100fb9eb
push 1
push 0x1000
call fcn.100ec885
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100fb950
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100fb9e2
push 0x8000
push ebx
call fcn.100fb77e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100fb979
jg 0x100fb974
cmp ecx, 0x1000
jb 0x100fb979
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100efa2d
add esp, 0x10
cmp eax, 0xffffffff
je 0x100fb9be
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100fb974
jl 0x100fb9a5
test ecx, ecx
jne 0x100fb966
push dword [ebp - 0xc]
push ebx
call fcn.100fb77e
push esi
call fcn.100ec583
add esp, 0xc
xor ebx, ebx
jmp 0x100fba4e
cmp byte [edi + 0x24], 0
je 0x100fb9d5
cmp dword [edi + 0x20], 5
jne 0x100fb9d5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100fb9e0
mov ebx, dword [edi + 0x18]
jmp 0x100fb9e2
xor ebx, ebx
push esi
call fcn.100ec583
pop ecx
jmp 0x100fba4e
test ecx, ecx
jg 0x100fb9b7
jl 0x100fb9f5
test eax, eax
jae 0x100fb9b7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100efe8f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100fba15
cmp byte [edi + 0x1c], 0
je 0x100fb9b7
jmp 0x100fba46
push ebx
call fcn.100f9761
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100fb9b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100fba4e
cmp byte [edi + 0x1c], 0
je 0x100fba4b
mov ebx, dword [edi + 0x18]
jmp 0x100fba4e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100efe8f
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100fc520
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100fc54d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100fc54d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41e901
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x41e941
mov cl, byte [ebp + 0x14]
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
mov byte [edx + eax], cl
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x41e913
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x41e947
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x41e984
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
xor cl, byte [ebp + 0x14]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x41e959
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x10002c45
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003c6c8]
jne 0x10002c4f
repz ret
jmp fcn.10004ccd

Function at 0x1000603f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10002d4c
and dword [ebp - 4], 0
cmp dword [0x1003e898], 0
mov ebx, eax
jne 0x100060f0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100061a1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100061a1
push eax
call fcn.10002cda
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003e898], eax
call esi
push eax
call fcn.10002cda
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003e89c], eax
call esi
push eax
call fcn.10002cda
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1003e8a0], eax
call esi
push eax
call fcn.10002cda
pop ecx
mov dword [0x1003e8a8], eax
test eax, eax
je 0x100060f0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10002cda
pop ecx
mov dword [0x1003e8a4], eax
mov eax, dword [0x1003e8a4]
cmp eax, ebx
je 0x10006148
cmp dword [0x1003e8a8], ebx
je 0x10006148
push eax
call fcn.10002d55
push dword [0x1003e8a8]
mov esi, eax
call fcn.10002d55
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10006148
test edi, edi
je 0x10006148
call esi
test eax, eax
je 0x1000613f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000613f
test byte [ebp - 0xc], 1
jne 0x10006148
or dword [ebp + 0x10], 0x200000
jmp 0x10006181
mov eax, dword [0x1003e89c]
cmp eax, ebx
je 0x10006181
push eax
call fcn.10002d55
pop ecx
test eax, eax
je 0x10006181
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10006181
mov eax, dword [0x1003e8a0]
cmp eax, ebx
je 0x10006181
push eax
call fcn.10002d55
pop ecx
test eax, eax
je 0x10006181
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1003e898]
call fcn.10002d55
pop ecx
test eax, eax
je 0x100061a1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100061a3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008fc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1003c058], 0
mov byte [0x1003c05c], 0
mov dword [0x1003c054], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1003c04c], 0x1fdd
mov eax, dword [0x1003c054]
add eax, 1
mov dword [0x1003c054], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10008ffb
jmp 0x1000903d
mov eax, dword [0x1003c04c]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x10009054
xor eax, eax
mov ecx, 0x1fdd
mov dword [0x1003c054], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x1003c060], 0
add eax, 0xfffff6b9
mov dword [ebp - 0x2c], eax
mov eax, ecx
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x1003c058]
mov ebx, dword [ebp - 0x18]
movzx esi, byte [ebx + ecx]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1003c060], esi
mov dword [0x1003c050], 0x1dfc
mov eax, esi
cdq
mov esi, dword [ebp - 0x30]
idiv esi
mov dword [0x1003c058], edx
mov esi, dword [ebp - 0x2c]
mov dword [0x1003c04c], esi
mov bl, byte [ebx + ecx]
mov byte [0x1003c05c], bl
mov dword [0x1003c050], 0xe30
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov ecx, dword [0x1003c050]
add ecx, 0xfffffd81
mov dword [0x1003c04c], ecx
mov bl, byte [0x1003c05c]
mov ecx, dword [0x1003c058]
mov byte [esi + ecx], bl
mov ecx, dword [0x1003c054]
add ecx, 1
mov dword [0x1003c054], ecx
cmp ecx, 0x100
mov dword [ebp - 0x20], ecx
jl 0x1000902d
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret