joyce8/EMBER2024-capa huggingface dataset:
Function at 0x694348
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x694350
push ebx
xor eax, eax
push ebp
push 0x69458b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x6bfb92], 0
je 0x694379
mov eax, dword [0x6b7c00]
cmp byte [eax], 0
je 0x69437d
xor eax, eax
jmp 0x69437f
mov al, 1
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x11]
call fcn.005ff6dc
mov edx, dword [ebp - 0x18]
mov eax, 0x6bf8ec
call fcn.0040ac5c
cmp byte [ebp - 0x11], 0
je 0x6943ac
lea eax, [ebp - 0x10]
mov edx, 0x6945a4
call fcn.0040aca4
jmp 0x6943b4
lea eax, [ebp - 0x10]
call fcn.0040a86c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x11
mov eax, dword [0x6bf8ec]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0x11
lea edx, [ebp - 0x28]
mov ecx, 1
mov eax, 0x6945c8
call fcn.00607e98
mov eax, dword [0x6b7c00]
cmp byte [eax], 0
je 0x6943f0
mov eax, dword [0x6bf8ec]
call fcn.006072f4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x69454a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [0x6bf8ec]
call fcn.005b9cdc
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
mov ecx, 0x694618
call fcn.0040bad8
push 0
mov eax, dword [ebp - 4]
call fcn.0040b88c
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x69449d
call sub.kernel32.dll_GetLastError
mov ebx, eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x40]
mov edx, dword [ebp - 4]
mov ax, 0x3d
call fcn.005c327c
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x44]
call fcn.00424910
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
lea edx, [ebp - 0x48]
mov eax, ebx
call fcn.005bd7d4
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x3c]
mov ecx, 2
mov ax, 0x81
call fcn.005c324c
mov ecx, dword [ebp - 0x30]
mov dl, 1
mov eax, dword [0x41d190]
call fcn.0042b510
call fcn.00409f64
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x69452b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00617058
cmp dword [ebp - 8], 0
je 0x694513
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x69450c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov ecx, 0x694634
mov edx, dword [ebp - 4]
call fcn.0040bad8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.006942ec
mov eax, dword [ebp - 0xc]
call fcn.006170ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x694513
lea eax, [ebp - 0xc]
call fcn.0040a86c
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x694532
lea eax, [ebp - 8]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x6972f0
Capabilities:
Hide graphical window

Disassembly:
mov byte [0x6bfbd9], 1
call fcn.00601594
test al, al
jne 0x697342
push 5
mov eax, dword [0x6b7adc]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x6b7adc]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_SetForegroundWindow
push 0
push 1
push 1
mov eax, dword [0x6b7af0]
mov eax, dword [eax + 0x15c]
mov cl, 2
xor edx, edx
call fcn.00696ff8
ret

Function at 0x69acd8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, 3
lea ebx, [ebp - 8]
lea esi, [ebp - 0xc]
lea edi, [ebp - 4]
movzx eax, byte [esi]
movzx edx, byte [ebx]
sub eax, edx
imul dword [ebp - 0x10]
push ecx
mov ecx, 0xff
cdq
idiv ecx
pop ecx
movzx edx, byte [ebx]
add eax, edx
mov byte [edi], al
inc edi
inc esi
inc ebx
dec ecx
jne 0x69acfd
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x69cba8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x69cbd4
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x69cbdd
call fcn.0069b784
mov eax, 0xa
call fcn.005bddf8
call fcn.0069b784
call fcn.0069cb74
test al, al
jne 0x69cbb2
pop ebx
ret

Function at 0x69d108
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x6b74dc]
cmp dword [eax], 0
je 0x69d1b3
mov eax, dword [0x6b74dc]
mov eax, dword [eax]
call fcn.00516774
test al, al
je 0x69d1b3
mov eax, dword [0x6b74dc]
mov eax, dword [eax]
cmp byte [eax + 0x21d], 0
je 0x69d15d
cmp byte [ebx + 0x3f9], 0
jne 0x69d15d
mov eax, dword [0x6b7adc]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x69d161
xor eax, eax
jmp 0x69d163
mov al, 1
mov ebx, eax
mov eax, dword [0x6b74dc]
mov eax, dword [eax]
call fcn.0051630c
push 0xfffffffffffffff0
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x69d1b3
test bl, bl
je 0x69d19f
push 5
mov eax, dword [0x6b74dc]
mov eax, dword [eax]
call fcn.0051630c
push eax
call sub.user32.dll_ShowWindow
jmp 0x69d1b3
push 0
mov eax, dword [0x6b74dc]
mov eax, dword [eax]
call fcn.0051630c
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x69d264
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffcc
push 0x69d470
call sub.kernel32.dll_GetModuleHandleW
mov ebx, eax
mov byte [0x6bfb90], 0
push 0x69d48c
push ebx
call fcn.00415434
mov esi, eax
test esi, esi
je 0x69d2f4
lea eax, [esp + 2]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x69d2f4
cmp word [esp], 0
je 0x69d2f4
mov byte [0x6bfb90], 1
movzx eax, word [esp + 2]
sub ax, 0x14c
je 0x69d2ca
sub ax, 0x8518
je 0x69d2d6
sub ax, 0x2400
je 0x69d2e2
jmp 0x69d2eb
mov byte [0x6b7295], 1
jmp 0x69d369
mov byte [0x6b7295], 2
jmp 0x69d369
mov byte [0x6b7295], 4
jmp 0x69d369
mov byte [0x6b7295], 0
jmp 0x69d369
push 0x69d4ac
push ebx
call fcn.00415434
mov esi, eax
test esi, esi
je 0x69d324
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x69d324
cmp dword [esp + 4], 0
je 0x69d324
mov byte [0x6bfb90], 1
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_GetNativeSystemInfo
movzx eax, word [esp + 0x10]
sub ax, 1
jb 0x69d347
sub ax, 8
je 0x69d350
sub ax, 3
je 0x69d359
jmp 0x69d362
mov byte [0x6b7295], 1
jmp 0x69d369
mov byte [0x6b7295], 2
jmp 0x69d369
mov byte [0x6b7295], 4
jmp 0x69d369
mov byte [0x6b7295], 0
cmp byte [0x6bfb90], 0
je 0x69d3aa
call fcn.005fdb60
test al, al
je 0x69d3a3
push 0x69d4cc
push ebx
call fcn.00415434
test eax, eax
je 0x69d3a3
push 0x69d500
push 0x69d520
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00415434
test eax, eax
jne 0x69d3aa
mov byte [0x6bfb90], 0
movzx eax, byte [0x69d53c]
mov byte [0x6bfba1], al
cmp byte [0x6b7295], 0
je 0x69d3e1
movzx eax, byte [0x6b7295]
cmp al, 7
ja 0x69d3e1
and eax, 0x7f
mov edx, 0x6bfba1
mov ecx, edx
and ecx, 3
sub edx, ecx
shl ecx, 3
add eax, ecx
bts dword [edx], eax
push 0x69d540
push ebx
call fcn.00415434
mov esi, eax
test esi, esi
je 0x69d439
lea eax, [esp + 8]
push eax
push 0x1c4
call esi
test eax, eax
jne 0x69d410
test byte [esp + 8], 1
je 0x69d410
or byte [0x6bfba1], 8
test byte [0x6bfba1], 4
jne 0x69d468
lea eax, [esp + 8]
push eax
push 0x8664
call esi
test eax, eax
jne 0x69d468
test byte [esp + 8], 1
je 0x69d468
or byte [0x6bfba1], 4
jmp 0x69d468
push 0x69d574
push ebx
call fcn.00415434
mov ebx, eax
test ebx, ebx
je 0x69d468
lea eax, [esp + 0xc]
push eax
push 0x1c4
call ebx
test eax, eax
jne 0x69d468
cmp dword [esp + 0xc], 0
je 0x69d468
or byte [0x6bfba1], 8
add esp, 0x34
pop esi
pop ebx
ret
Function at 0x69e5ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x69e696
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x69e6b4
push ebx
push 0x69e6c4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040bb60
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00407d24
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040b88c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x69e672
mov eax, dword [0x6b7af0]
mov eax, dword [eax + 0x20c]
call fcn.0069e540
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69e69d
lea eax, [ebp - 4]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x69f06c
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x69f074
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x69f287
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
call fcn.005bc874
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 4]
mov eax, dword [0x6b78c8]
movzx eax, byte [eax]
call fcn.005ff4f8
mov ebx, eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.005b9cdc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x69f2a4
call fcn.0040bad8
test bl, bl
jne 0x69f103
xor eax, eax
push ebp
push 0x69f0f9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.005ffa6c
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.005ffa6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x69f103
push 0
mov eax, dword [ebp - 8]
call fcn.0040b88c
mov ebx, eax
push ebx
mov eax, dword [0x6bfca0]
call fcn.0040b88c
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x69f134
mov eax, dword [0x6b7af0]
mov eax, dword [eax + 0x208]
call fcn.0069e540
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x6bb63c]
push eax
push 0
mov ecx, 0x69f2bc
mov edx, 0x69f2c0
xor eax, eax
call fcn.004161ec
mov dword [ebp - 0xc], eax
push 0x69e708
push 0xfffffffffffffffc
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x6bfccc], eax
xor eax, eax
push ebp
push 0x69f249
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x6b7adc]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.005bc214
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x2c]
mov ecx, 1
mov eax, 0x69f2dc
call fcn.00425bfc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
call fcn.005bc0ec
mov edx, dword [ebp - 0x34]
pop eax
call fcn.0040ba80
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0069e5ec
mov dword [ebp - 0x10], eax
call fcn.0069e6cc
test al, al
jne 0x69f227
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x69f205
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69f250
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_DestroyWindow
pop eax
jmp eax
Function at 0x6a0644
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6a08fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6b7adc]
mov eax, dword [eax]
mov edx, 0x6a0918
call fcn.005ab3ac
push 5
mov eax, dword [0x6b7adc]
mov eax, dword [eax]
mov eax, dword [eax + 0x190]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x6a08c3
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00697580
lea eax, [ebp - 0x10]
call fcn.005bc700
mov eax, dword [ebp - 0x10]
call fcn.00425724
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.005bc214
mov edx, dword [ebp - 0x14]
mov eax, 0x6bfca0
call fcn.0040ac5c
call fcn.0069e8d8
lea ecx, [ebp - 0x18]
mov edx, 0x6a0938
mov eax, dword [0x6bfca0]
call fcn.005b9dc8
mov edx, dword [ebp - 0x18]
mov eax, 0x6bfca4
call fcn.0040ac5c
lea ecx, [ebp - 0x1c]
mov edx, 0x6a0950
mov eax, dword [0x6bfca0]
call fcn.005b9dc8
mov edx, dword [ebp - 0x1c]
mov eax, 0x6bfca8
call fcn.0040ac5c
push 2
push 0
push 1
mov ecx, dword [0x6bfca0]
mov dl, 1
mov eax, dword [0x5c1258]
call fcn.005c1c04
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6a079e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.005c1bc4
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.005c1b9c
cmp dword [ebp - 0xc], 0x67734d49
je 0x6a0777
mov cl, 1
xor edx, edx
mov eax, dword [0x6bfca8]
call fcn.005c3430
jmp 0x6a0786
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x6bfca0]
call fcn.005c3430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a07a5
mov eax, dword [ebp - 4]
call fcn.00408bcc
pop eax
jmp eax
Function at 0x6a0a94
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6a0bd5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x6a0bf0
mov edx, ebx
call fcn.0040bad8
mov eax, dword [ebp - 0x25c]
call fcn.0040b88c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x6a0bad
xor eax, eax
push ebp
push 0x6a0ba6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6a0c0c
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.004258a4
test eax, eax
jne 0x6a0b75
test byte [ebp - 0x258], 0x10
jne 0x6a0b75
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.0040b928
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040bad8
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x6a0b6d
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.0040b88c
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.00425184
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x6a0b05
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0bad
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0bdc
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.0040a8cc
lea eax, [ebp - 4]
call fcn.0040a86c
pop eax
jmp eax
Function at 0x6a0c18
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6a0d18
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.0040a86c
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.005ba25c
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x6a0d34
call fcn.00425bfc
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040bad8
mov eax, dword [ebp - 8]
call fcn.0040b88c
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x6a0cb6
test esi, 0x10
jne 0x6a0ce6
test esi, 1
je 0x6a0cb6
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.0040b88c
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.0040b88c
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040b88c
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x6a0ce0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040ac5c
jmp 0x6a0cf3
inc edi
cmp edi, 0xa
je 0x6a0cf3
inc ebx
cmp ebx, 0x3e8
jne 0x6a0c57
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0d1f
lea eax, [ebp - 0x14]
call fcn.0040a86c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a8cc
pop eax
jmp eax
Function at 0x10008260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
and eax, 0xff
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
cdq
mov ecx, 0xfe
idiv ecx
mov byte [ebp - 4], dl
mov dl, byte [ebp - 4]
add dl, 1
mov byte [ebp - 4], dl
mov dword [ebp - 8], 0
jmp 0x1000829a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jge 0x100082ca
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
xor al, byte [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov byte [ecx], al
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
add al, byte [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov byte [ecx], al
jmp 0x10008291
mov esp, ebp
pop ebp
ret

Function at 0x100091ff
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.10020a40
push edi
mov byte [ebp - 0x101c], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x101b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x1020], 0
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x1020], eax
push 0
push 0
push 0
push 0
push 0x53aa738
call fcn.10004d43
add esp, 0x14
mov dword [ebp - 0x1028], eax
cmp dword [ebp - 0x1028], 0
je 0x100092fb
push 0
push 0x4000000
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x1028]
push edx
call fcn.10004d62
add esp, 0x18
mov dword [ebp - 0x102c], eax
cmp dword [ebp - 0x102c], 0
je 0x100092e2
push 0x3e8
push 0
lea eax, [ebp - 0x101c]
push eax
call fcn.10020a26
add esp, 0xc
lea ecx, [ebp - 0x1030]
push ecx
push 0x1000
lea edx, [ebp - 0x101c]
push edx
mov eax, dword [ebp - 0x102c]
push eax
call fcn.10004d85
add esp, 0x10
mov ecx, dword [ebp - 0x102c]
push ecx
call fcn.10004da0
add esp, 4
mov dword [ebp - 0x102c], 0
mov edx, dword [ebp - 0x1028]
push edx
call fcn.10004da0
add esp, 4
mov dword [ebp - 0x1028], 0
mov byte [ebp - 0x1c], 0x50
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x67
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x20
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0x15], 0x6e
mov byte [ebp - 0x14], 0x20
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x20
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x20
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 9], 0x70
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x61
mov byte [ebp - 6], 0x79
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x21
mov byte [ebp - 2], 0
mov eax, dword [ebp - 0x1020]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10015213
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x10015223
xor eax, eax
jmp 0x100153ec
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x100153a4
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x53a3a84]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x53a3a84]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x53a3a84]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x53a3a84]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x53a3a84]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x53a3a84]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x53a3a84]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x53a3a84]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x1001522c
cmp dword [ebp + 0x10], 0
je 0x100153e6
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x53a3a84]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x100153aa
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret