joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b3b1
Capabilities:
Hide graphical window
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x30
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.004031e0
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 0x4000
mov dword [ebp - 0x2c], 0x41aec6
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
mov ecx, dword [ebp + 8]
call fcn.00413314
mov dword [ebp - 0x20], eax
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], str.svchost
mov dword [ebp - 0xc], str.svchost
and dword [ebp - 8], 0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
mov ecx, dword [ebp + 8]
call fcn.00413314
push eax
push 0
push 0
push 0x190
push 0x190
push 0
push 0
push 0x2000000
push str.hidden_window
push str.svchost
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0x3c], eax
push 0x2000000
push 0xfffffffffffffff0
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x8000000
push 0xffffffffffffffec
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x18
pop edx
mov ecx, dword [ebp + 8]
call fcn.00417318
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41b491
xor al, al
jmp 0x41b4f7
mov eax, dword [ebp - 4]
mov word [eax], 1
mov eax, dword [ebp - 4]
mov word [eax + 2], 6
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0x100
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add eax, 0xc
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov word [eax], 1
mov eax, dword [ebp - 0x38]
mov word [eax + 2], 2
mov eax, dword [ebp - 0x38]
mov dword [eax + 4], 0x100
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 8], ecx
push 0xc
push 2
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov al, 1
leave
ret
Function at 0x41d4c0
Capabilities:
Accept command line arguments
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0040f6bd
movzx eax, al
test eax, eax
jne 0x41d4e0
jmp 0x41d619
mov ecx, dword [ebp - 0x14]
call fcn.00413197
mov ecx, dword [ebp - 0x14]
call fcn.00414598
push 1
mov edx, str.SeDebugPrivilege
mov ecx, dword [ebp - 0x14]
call fcn.00414fcb
push 1
mov edx, str.SeChangeNotifyPrivilege
mov ecx, dword [ebp - 0x14]
call fcn.00414fcb
and dword [ebp - 8], 0
lea edx, [ebp - 8]
mov ecx, dword [ebp - 0x14]
call fcn.004131cb
mov ecx, dword [ebp - 0x14]
call fcn.00412ab7
mov ecx, dword [ebp - 0x14]
call fcn.0041a144
cmp eax, 0x309
jmp 0x41d544
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41d56c
cmp dword [ebp - 4], 1
jne 0x41d56c
mov ecx, dword [ebp - 0x14]
call fcn.004142f6
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0x14]
call fcn.004144b0
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x58b4]
test eax, eax
jne 0x41d619
mov ecx, dword [ebp - 0x14]
call fcn.004143fc
mov ecx, dword [ebp - 0x14]
call fcn.0041491d
movzx eax, al
test eax, eax
jne 0x41d5b5
mov ecx, dword [ebp - 0x14]
call fcn.00414c13
movzx eax, al
test eax, eax
je 0x41d5c5
mov ecx, dword [ebp - 0x14]
call fcn.00413d0e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
je 0x41d5f1
mov ecx, dword [ebp - 0x14]
call fcn.00413235
test eax, eax
jg 0x41d5e1
mov ecx, dword [ebp - 0x14]
call fcn.00413223
test eax, eax
jle 0x41d5f1
mov ecx, dword [ebp - 0x14]
call fcn.00413d0e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
and dword [ebp - 0x10], 0
jmp 0x41d5fe
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xb40
jge 0x41d614
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41d5f7
jmp 0x41d57d
leave
ret
Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push 0x4065d4
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4065b4
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push 0x406588
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4e5008], 0x8088405
inc edx
mov dword [ebx + 0x4e5008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41d2ec
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41d31d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d305
add dl, dl
jne 0x41d328
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d379
xor eax, eax
add dl, dl
jne 0x41d335
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d416
add dl, dl
jne 0x41d344
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d34f
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d35a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d365
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41d36f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41d314
mov eax, 1
add dl, dl
jne 0x41d387
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41d392
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d37e
sub eax, ebx
mov ebx, 1
jne 0x41d3c5
mov ecx, 1
add dl, dl
jne 0x41d3ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3b6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3a2
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d314
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d3dc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d3e7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d3d3
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41d314
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d437
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41d314
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f504
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4c89f2
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f553
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f572
mov ecx, edx
add ecx, ebx
jmp 0x41f572
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f572
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f5e4
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f5cd
test esi, esi
jbe 0x41f5e4
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088f4
test eax, eax
jne 0x41f5bf
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f5e4
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f59c
jmp 0x41f5e4
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f5e4
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c89f9
ret
Function at 0x420750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x4c9d6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x42078b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4207a4
lea eax, [ebp - 0x10]
mov edx, dword [0x4e773c]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404d30
jmp 0x4207b7
lea eax, [ebp - 0x10]
mov edx, dword [0x4e773c]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4207c3
adc edx, 0
mov edx, dword [edx*4 + 0x4e6538]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x42093d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420930
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dec
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420930
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x4208ce
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x4208ce
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x4208ce
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4208ce
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420930
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420930
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d8c
test eax, eax
je 0x420930
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420930
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420955
inc ebx
cmp ebx, 0x19
jne 0x42077d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9d72
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4018c2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4018d9
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40190e
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40190a
cmp edi, eax
jae 0x40190e
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x4018fc
cmp edi, eax
jb 0x401912
xor eax, eax
jmp 0x40191b
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x401d58
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d030]
jne 0x401d62
repz ret
jmp fcn.00402d1c

Function at 0x406dce
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403119
and dword [ebp - 4], 0
cmp dword [0x40e7d0], 0
mov ebx, eax
jne 0x406e7f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406f30
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406f30
push eax
call fcn.004030a7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e7d0], eax
call esi
push eax
call fcn.004030a7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e7d4], eax
call esi
push eax
call fcn.004030a7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e7d8], eax
call esi
push eax
call fcn.004030a7
pop ecx
mov dword [0x40e7e0], eax
test eax, eax
je 0x406e7f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004030a7
pop ecx
mov dword [0x40e7dc], eax
mov eax, dword [0x40e7dc]
cmp eax, ebx
je 0x406ed7
cmp dword [0x40e7e0], ebx
je 0x406ed7
push eax
call fcn.00403122
push dword [0x40e7e0]
mov esi, eax
call fcn.00403122
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406ed7
test edi, edi
je 0x406ed7
call esi
test eax, eax
je 0x406ece
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406ece
test byte [ebp - 0xc], 1
jne 0x406ed7
or dword [ebp + 0x10], 0x200000
jmp 0x406f10
mov eax, dword [0x40e7d4]
cmp eax, ebx
je 0x406f10
push eax
call fcn.00403122
pop ecx
test eax, eax
je 0x406f10
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406f10
mov eax, dword [0x40e7d8]
cmp eax, ebx
je 0x406f10
push eax
call fcn.00403122
pop ecx
test eax, eax
je 0x406f10
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e7d0]
call fcn.00403122
pop ecx
test eax, eax
je 0x406f30
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406f32
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100a8b48
Capabilities:
Read file on windows
Terminate process

Disassembly:
xchg dword [esp + ecx - 0x1e06ffb], eax
lea edx, [esp + edx + 0x10]
dec ax
sar ecx, 0xb0
mov ax, word [edx + ecx*4 - 0x780]
lea ebp, [ecx + ebp - 0x1e2]
mov word [ecx + ebp - 0x1e0], ax
pop ecx
pop ecx
pop edx
pop ecx
ja fcn.10190646

Function at 0x100a8cf0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 0x10]
push 0x100fded8
jmp loc.101b50be

Function at 0x100a9110
Capabilities:
Encrypt data using rc4 prga
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x100fdf60
mov edi, ecx
jmp fcn.1020f4ed

Function at 0x100a944a
Capabilities:
Read file on windows
Terminate process

Disassembly:
rol ecx, 3
add ecx, 0x119cf3a
push 0x96bc4387
mov edx, 0x79391a13
call fcn.102058a1

Function at 0x100a9500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f9f56
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x1010eeb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.cp_tC6m
jmp fcn.1022fd0b
Function at 0x100c4880
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100faa20
mov eax, dword fs:[0]
push eax
sub esp, 0x2e8
mov eax, dword [0x1010eeb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10100990
jmp loc.1022b091

Function at 0x100c8130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push 0x101009ac
push ebx
call fcn.100e8b2b
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x100c8156
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push 1
lea eax, [ebp - 4]
push 4
push eax
call fcn.100e26c5
add esp, 0x10
cmp dword [ebp - 4], 0x2b565764
je 0x100c81b1
push esi
mov esi, dword [0x101268c8]
push edi
mov edi, dword [0x101268cc]
cmp esi, edi
je 0x100c81af
mov eax, dword [ebp + 0xc]
cmp dword [esi], eax
jne 0x100c81a1
mov eax, dword [esi + 4]
test eax, eax
je 0x100c81aa
push ebx
push eax
call fcn.100e955b
add esp, 8
test eax, eax
je 0x100c81aa
mov eax, dword [ebp + 0xc]
add esi, 8
cmp esi, edi
jne 0x100c8185
jmp 0x100c81af
call fcn.100a9500
pop edi
pop esi
push dword [ebp - 8]
call fcn.100e8983
add esp, 4
cmp dword [ebp - 4], 0x2b565764
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100cde60
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.100de460
mov eax, dword [0x1010eeb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x101009ac
push eax
mov esi, ecx
call fcn.100cf090
mov edi, eax
add esp, 8
test edi, edi
je 0x100cdf36
push edi
push 0x10000
lea eax, [ebp - 0x10004]
mov dword [esi + 0x10], 0
push 1
push eax
mov dword [esi + 0x14], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.100e26c5
add esp, 0x10
test eax, eax
je 0x100cdf0a
nop
push eax
lea eax, [ebp - 0x10004]
mov ecx, esi
push eax
call fcn.100d81e0
push edi
push 0x10000
lea eax, [ebp - 0x10004]
push 1
push eax
call fcn.100e26c5
add esp, 0x10
test eax, eax
jne 0x100cdee0
mov ecx, esi
call fcn.100ced40
push edi
call fcn.100e8983
movups xmm0, xmmword [esi + 0x58]
add esp, 4
mov al, 1
movups xmmword [ebx], xmm0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100de133
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100de133
mov esp, ebp
pop ebp
ret 8
Function at 0x100ceb90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
cmp eax, dword [edi + 4]
je 0x100ceba3
mov dword [edi + 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x100cebae
mov eax, dword [eax]
push 0x101009ac
push eax
call fcn.100cf090
mov ebx, eax
add esp, 8
mov dword [ebp + 8], ebx
test ebx, ebx
jne 0x100cebcc
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
push 2
push 0
push ebx
call fcn.100e8e1d
push ebx
call fcn.100e9470
mov esi, dword [ebp + 0x14]
mov ebx, eax
cmp ebx, esi
push 0
cmovl esi, ebx
push esi
push dword [ebp + 8]
call fcn.100e8e1d
sub ebx, esi
add esp, 0x1c
xor esi, esi
test ebx, ebx
jle 0x100ced0f
movsd xmm0, qword [0x10101be0]
movd xmm1, ebx
cvtdq2pd xmm1, xmm1
comisd xmm0, xmm1
jbe 0x100ced0f
cmp dword [ebp + 0x10], ebx
mov edx, dword [edi + 8]
cmovl ebx, dword [ebp + 0x10]
mov ecx, dword [edi]
sub edx, ecx
cmp ebx, edx
jbe 0x100cecb7
cmp ebx, 0x7fffffff
ja 0x100ced24
mov esi, edx
mov eax, SysReAllocString
shr esi, 1
sub eax, esi
cmp edx, eax
jbe 0x100cec52
mov esi, SysReAllocString
jmp 0x100cec59
add esi, edx
cmp esi, ebx
cmovb esi, ebx
test ecx, ecx
je 0x100cec9d
cmp edx, 0x1000
jb 0x100cec7f
mov eax, dword [ecx - 4]
add edx, 0x23
sub ecx, eax
mov dword [ebp + 0xc], eax
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x100ced29
mov ecx, dword [ebp + 0xc]
push edx
push ecx
call fcn.100dde0b
mov dword [edi], 0
add esp, 8
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push esi
mov ecx, edi
call fcn.100d8cf0
mov esi, dword [edi]
push ebx
push 0
push esi
call fcn.100e00b0
add esp, 0xc
add esi, ebx
jmp 0x100cecf5
mov esi, dword [edi + 4]
sub esi, ecx
cmp ebx, esi
jbe 0x100cece6
push esi
push 0
push ecx
call fcn.100e00b0
mov edi, ebx
sub edi, esi
mov esi, dword [ebp + 0xc]
push edi
push 0
mov esi, dword [esi + 4]
push esi
call fcn.100e00b0
add esp, 0x18
add esi, edi
mov edi, dword [ebp + 0xc]
jmp 0x100cecf5
push ebx
push 0
push ecx
lea esi, [ebx + ecx]
call fcn.100e00b0
add esp, 0xc
mov dword [edi + 4], esi
mov eax, dword [edi]
sub esi, eax
je 0x100ced2e
push dword [ebp + 8]
push ebx
push 1
push eax
call fcn.100e26c5
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
call fcn.100e8983
add esp, 4
cmp esi, ebx
sete al
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.100b3770
call fcn.100e246f
call fcn.100d9290
int3