joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a7cd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.100bdff0
push ebp
push esi
mov esi, dword [esp + 0x54]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push ebp
xor edi, edi
call fcn.100927d0
add esp, 0xc
test eax, eax
je 0x100a7d2a
lea esp, [esp]
mov edx, dword [esp + 0xc]
shl edx, 0xa
test dword [esp + 0x1c], edx
je 0x100a7d0e
inc edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
inc ebp
push ebp
call fcn.100927d0
add esp, 0xc
test eax, eax
jne 0x100a7d00
test edi, edi
jne 0x100a7d4e
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.10009e40
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x4c]
cdq
idiv edi
push ebx
mov ebx, eax
cmp edi, 1
jne 0x100a7d65
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x4c]
push esi
push 0
push eax
call fcn.100be020
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esp + 0x30], 0
call fcn.100927d0
add esp, 0x18
test eax, eax
je 0x100a7e44
lea ebx, [ebx]
mov eax, dword [esp + 0x10]
shl eax, 0xa
test dword [esp + 0x20], eax
je 0x100a7e20
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100a7e51
mov ebp, dword [esp + 0x58]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push esi
push ebp
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x54]
and edx, 1
add edx, ebx
push edx
mov edx, dword [esp + 0x60]
push edi
push eax
call fcn.100a78c0
add esp, 0x34
test eax, eax
je 0x100a7e6f
add edi, ebx
test esi, esi
jle 0x100a7e20
mov eax, dword [esp + 0x54]
mov ecx, ebp
sub ecx, eax
mov ebp, esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec ebp
jne 0x100a7e17
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
inc eax
push edx
push eax
mov dword [esp + 0x24], eax
call fcn.100927d0
add esp, 0xc
test eax, eax
jne 0x100a7da0
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0xc
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.10009e40
add esp, 0x14
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x100a9fd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100bdff0
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0x64]
inc ebp
test byte [ecx + 0x38], 1
je 0x100aa018
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 4]
lea edx, [ecx + ebp]
cmp edx, eax
jbe 0x100aa00b
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub eax, ecx
mov dword [esi + 4], eax
jmp 0x100aa023
mov eax, dword [esp + 0x18]
cmp ebp, dword [eax + 4]
ja 0x100aa004
mov esi, eax
test dword [edi + 0x100], 0x200
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push ebx
movzx ebx, byte [ecx + edx - 1]
je 0x100aa076
cmp dword [edi + 0x88], 0
jne 0x100aa076
mov eax, dword [edi + 0x58]
push 8
add eax, 8
push 0x101023d0
push eax
call fcn.10003bb0
add esp, 0xc
test eax, eax
jne 0x100aa069
test bl, 1
jne 0x100aa069
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov ecx, dword [edi + 0x58]
test byte [ecx], 8
je 0x100aa076
test ebx, ebx
je 0x100aa076
dec ebx
mov edx, dword [edi + 0x80]
mov eax, dword [edx]
push eax
call fcn.1008eae0
add esp, 4
test eax, 0x200000
je 0x100aa0a1
or ecx, 0xffffffff
sub ecx, ebx
add dword [esi + 4], ecx
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
mov edi, dword [esi + 4]
lea eax, [ebx + ebp]
mov esi, edi
sub esi, eax
xor esi, eax
mov edx, edi
xor edx, eax
or esi, edx
xor esi, edi
shr esi, 0x1f
mov ecx, 0xff
lea eax, [edi - 1]
dec esi
mov dword [esp + 0x18], ecx
cmp eax, ecx
jae 0x100aa0cf
mov ecx, eax
mov dword [esp + 0x18], eax
xor ebp, ebp
test ecx, ecx
je 0x100aa127
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0xc]
mov ecx, ebx
shr ecx, 0x1f
lea eax, [edi + edx - 1]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], eax
lea ecx, [ecx]
mov edx, ebx
sub edx, ebp
shr edx, 0x1f
mov eax, ebp
shr eax, 0x1f
xor dl, al
xor cl, al
or dl, cl
mov ecx, dword [esp + 0x10]
xor dl, cl
dec dl
movzx eax, dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx]
dec dword [esp + 0x24]
xor edx, ebx
and eax, edx
not eax
inc ebp
and esi, eax
cmp ebp, dword [esp + 0x18]
jb 0x100aa0f0
mov edx, dword [esp + 0x1c]
not esi
and esi, 0xff
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
and ecx, esi
neg ecx
lea eax, [ebx + 1]
and eax, ecx
sub edi, eax
shl eax, 8
or dword [edx], eax
pop ebx
mov dword [edx + 4], edi
mov eax, ecx
pop edi
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebp
pop ecx
ret
Function at 0x100aa160
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa4
call fcn.100bdff0
mov eax, dword [0x101151b0]
xor eax, esp
mov dword [esp + 0xa0], eax
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x1c], esi
sub esi, edi
xor ebp, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebp
cmp ebx, edi
jae 0x100aa1ca
push str.orig_len___md_size
push pe_nt_image_headers32
push str.._ssl_s3_cbc.c
call fcn.10003b80
add esp, 0xc
cmp edi, 0x40
jbe 0x100aa1e6
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.10003b80
add esp, 0xc
lea ecx, [esp + 0x30]
neg ecx
and ecx, 0x3f
lea edx, [edi + 0x100]
lea ecx, [esp + ecx + 0x30]
mov dword [esp + 0x20], ecx
cmp ebx, edx
jbe 0x100aa210
mov eax, ebx
sub eax, edi
sub eax, 0x100
mov dword [esp + 0x14], eax
mov ebp, eax
mov eax, edi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, esi
xor edx, edx
div edi
push edi
push 0
push ecx
mov ebx, edx
mov dword [esp + 0x30], ebx
call fcn.100be020
mov ecx, dword [esp + 0x20]
add esp, 0xc
xor esi, esi
cmp ecx, dword [esp + 0xc4]
jae 0x100aa2f0
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x1f
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xbc]
mov eax, dword [eax + 0xc]
shr edx, 0x1f
sub ecx, ebx
sub ebx, dword [esp + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
jmp 0x100aa288
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
add ebx, ecx
shr ebx, 0x1f
xor bl, dl
mov eax, ebp
shr eax, 0x1f
xor dl, al
or bl, dl
mov dl, byte [esp + 0x2c]
xor bl, al
dec bl
mov byte [esp + 0x13], bl
mov ebx, ecx
shr ebx, 0x1f
xor bl, dl
xor dl, al
or bl, dl
mov edx, dword [esp + 0x18]
mov dl, byte [edx + ebp]
xor al, bl
dec al
not al
and al, dl
and al, byte [esp + 0x13]
mov edx, dword [esp + 0x20]
or byte [esi + edx], al
inc esi
mov eax, esi
sub eax, edi
xor eax, edi
mov ebx, esi
xor ebx, edi
or eax, ebx
xor eax, esi
shr eax, 0x1f
neg eax
inc ebp
and esi, eax
inc ecx
cmp ebp, dword [esp + 0xc4]
jb 0x100aa280
mov ebx, dword [esp + 0x24]
jmp 0x100aa2f4
mov edx, dword [esp + 0x20]
xor esi, esi
test edi, edi
je 0x100aa32d
lea ebx, [ebx]
mov ecx, ebx
xor ecx, 0x20
mov al, byte [ecx + edx]
mov cl, byte [ebx + edx]
mov eax, dword [esp + 0x28]
mov byte [eax + esi], cl
inc ebx
mov ecx, ebx
sub ecx, edi
xor ecx, edi
mov eax, ebx
xor eax, edi
or ecx, eax
xor ecx, ebx
shr ecx, 0x1f
neg ecx
inc esi
and ebx, ecx
cmp esi, edi
jb 0x100aa300
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100bc5e4
add esp, 0xa4
ret
Function at 0x100bc5e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101151b0]
jne 0x100bc5ee
repz ret
jmp fcn.100c17f0

Function at 0x100c984c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101151b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100c2724
and dword [ebp - 0x14], 0
cmp dword [0x1011dd58], 0
mov dword [ebp - 0x18], eax
jne 0x100c98ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100c99a7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100c99a7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1011dd58], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1011dd5c], eax
call edi
push eax
call esi
push 0x10104c98
push ebx
mov dword [0x1011dd60], eax
call edi
push eax
call esi
mov dword [0x1011dd68], eax
test eax, eax
je 0x100c98ff
push 0x10104c80
push ebx
call edi
push eax
call esi
mov dword [0x1011dd64], eax
mov eax, dword [0x1011dd64]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100c9958
cmp dword [0x1011dd68], ecx
je 0x100c9958
push eax
call esi
push dword [0x1011dd68]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100c9958
test ebx, ebx
je 0x100c9958
call edi
test eax, eax
je 0x100c994f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100c994f
test byte [ebp - 8], 1
jne 0x100c9958
or dword [ebp + 0x10], 0x200000
jmp 0x100c998b
mov eax, dword [0x1011dd5c]
cmp eax, dword [ebp - 0x18]
je 0x100c998b
push eax
call esi
test eax, eax
je 0x100c998b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100c998b
mov eax, dword [0x1011dd60]
cmp eax, dword [ebp - 0x18]
je 0x100c998b
push eax
call esi
test eax, eax
je 0x100c998b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1011dd58]
call esi
test eax, eax
je 0x100c99a7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100c99a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bc5e4
leave
ret
Function at 0x40233f
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4051f8
call fcn.00402861
push 1
call fcn.004023c2
pop ecx
test al, al
jne 0x4021e8
push 7
call fcn.00402a74
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040238d
mov byte [ebp - 0x24], al
mov eax, dword [0x40633c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4021e1
test eax, eax
jne 0x402252
mov dword [0x40633c], ecx
push 0x40429c
push 0x404284
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x402235
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402339
push 0x404280
push 0x40426c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x40633c], 2
jmp 0x402257
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040251f
pop ecx
call fcn.00402a68
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x402287
push esi
call fcn.00402492
pop ecx
test al, al
je 0x402287
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00402ca3
call esi
call fcn.00402a6e
mov esi, eax
cmp dword [esi], edi
je 0x4022a5
push esi
call fcn.00402492
pop ecx
test al, al
je 0x4022a5
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00402b89
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00402bbc
test al, al
jne 0x4022de
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4022e7
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040253c
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x402339
call fcn.004028a7
ret
call fcn.00402059
jmp 0x4021c9

Function at 0x532901
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x532941
mov cl, byte [ebp + 0x14]
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
mov byte [edx + eax], cl
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x532913
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x532947
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x532984
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
xor cl, byte [ebp + 0x14]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x532959
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x1047830d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dh, 0xcd
cmp dword [ebp + 0x14], ecx
mov byte [esp], 0x85
pushal
mov word [esp], bx
lea esp, [esp + 0x24]
ja 0x1048197e
jno 0x105703ae
push 0x8e04f66
setp bl
mov esi, dword [esp + 4]
push dword [esp]
mov edi, dword [esp + 0xc]
movzx cx, bl
rol ch, 2
not cx
shr ch, 6
add cx, 0x3cb8
mov ecx, dword [esi + 4]
bt ax, bx
bt dx, 6
jmp 0x10815cd7
pop edx
jecxz 0x1057032a
push eax
jecxz 0x10570304
invalid
or edi, dword [edi + 0x5d]
push 0xffffffffffffff8a
jbe 0x105702fe
mov dword [0x9ac42054], eax
out 0xde, eax
wait
insb byte es:[edi], dx
lahf
push esp
and ah, al
lcall 0x9f2e, 0x6c9bdee7
adc edx, ebp
mov eax, dword [0x98e8e86e]
jecxz 0x10570322
invalid
ret 0x967d
cli
leave
xchg ebx, eax
pop esp
mov eax, dword [0x9fd2f02c]
pop edx
leave
inc ebp
mov al, 0xa6
repne scasd eax, dword es:[edi]
ja 0x10570325
xchg ecx, eax
or cl, byte [edx + 0x54]
in al, 0x6f
loopne 0x1057032b
pop edi
inc ecx
push cs
fsubr qword [ecx - 0x68a75f9f]
dec edi
mov dh, byte [esi]
jae 0x10570393
invalid
stosd dword es:[edi], eax
pop eax
call 0xb63450ca
push ecx
out 0x24, al
loope 0x105703c4
push eax
jle 0x10570329
xchg ebp, eax
je 0x10570343
fisttp word [ebp + ebx*2 - 0x6af44873]
inc edx
call fcn.10568683
jmp 0x10570369
jge 0x1057041b
sbb al, 0xe9
mov edx, 0xbeeb2d66
pop edi
xor dl, cl
lahf
inc ebp
adc al, 0xe0
pop ebx
cmc
xor ebp, esp
retf
cdq
and byte [edx + 0x61], ch
pop edx
wait
test edx, ebp
mov ah, 0xba
inc esi
in al, dx
int 0xf
push ds
movsd dword es:[edi], dword [esi]
rcl dword [edx - 0x45b74a40], cl
adc ecx, dword [eax]
wait
dec bl
xchg ah, ah
scasb al, byte es:[edi]
sbb bl, byte [eax - 0x19]
retf 0x3f95
lea esp, [esp + 0x20]
je 0x10478326
and di, ax
rcl bl, cl
rcr di, 6
bt edi, 0x18
add dword [ebp - 4], ecx
neg bh
jmp 0x10482d17
or ecx, ecx
pushal
jmp 0x107aae74
Function at 0x105647f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov byte [esp], 0x62
lea esp, [esp + 0x48]
jbe 0x10565cec
pushal
shld di, ax, cl
shl cl, cl
mov edi, dword [edx + 0x24]
shr ch, 3
rcl cx, cl
btr ecx, ecx
add edi, eax
not bl
shr ch, 7
bt bx, sp
mov ebx, dword [edx + 0x20]
sbb ecx, ebp
and ch, cl
dec ecx
add ebx, eax
cmc
lea ecx, [eax - 0x2bd252e5]
mov dword [ebp - 8], 0
push eax
adc ch, dh
rol cx, 9
inc ch
mov ecx, dword [edx + 0x18]
lea esp, [esp + 0x24]
test edx, 0xf81f2945
cmp eax, edx
mov dword [esp + 4], 0x4ff5fd24
mov byte [esp], 0xfc
lea esp, [esp + 8]
jb 0x10478fba
cmc
cmp ch, ah
jmp 0x104819a2
cmp eax, edx
push dword [esp]
mov dword [esp + 8], 0x1efea7e
pushfd
push ebp
lea esp, [esp + 0x30]
jb 0x10478fba
bt bx, 7
cmp cl, 0xa
bt ecx, 0x18
pushal
cmp eax, dword [ebp - 0x10]
call fcn.107aa38d
push ebx
dec eax
inc ebp
dec esp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, dh
rep movsb byte es:[edi], byte [esi]
cmp eax, dword [ebp - 0x10]
jmp 0x10484424
pushal
pushfd
lea esp, [esp + 0x24]
jae 0x10478fba
lea ebx, [edx + 0x6af322b6]
mov ebx, eax
cmp ah, al
and edi, esi
mov edi, eax
pushal
movzx cx, cl
xor cl, 0x10
mov ecx, 0x104
push ecx
jmp 0x1056680f
test si, 0x93f3
jmp 0x10479c83
push 0xafbec150
sub ecx, dword [edx + 0x10]
cmc
stc
cmp ecx, dword [edx + 0x14]
mov word [esp], si
lea esp, [esp + 4]
jae 0x10815f4a
pushfd
push 0xcb861cbc
lea esp, [esp + 8]
jmp 0x107abda5
mov dword [esp], 0xa77712af
xor al, al
pushfd
mov dword [esp + 8], 0xfbb9162c
cmp ah, 4
stc
repne scasb al, byte es:[edi]
call fcn.10565be7
stc
test eax, eax
mov word [esp], 0x7b8b
pushfd
jmp 0x10566be4
lea esp, [esp + 8]
je 0x10815f4a
setns dh
mov esi, dword [eax + 0x3c]
shl dl, cl
lea edx, [edi + 0x215ba668]
lea edx, [eax*4 - 0x65ee7c3b]
sub edx, esi
add esi, eax
bsr dx, si
adc dh, al
bsf dx, bx
mov edx, dword [esi + 0x78]
test bl, 0x6e
cmc
push eax
test edx, edx
pushfd
lea esp, [esp + 8]
je 0x10815f4a
dec cl
btc cx, 3
add edx, eax
cmp si, 0xf314
jmp 0x1056f9bb
jmp 0x1047794b
test cl, 0xc4
clc
jno 0x107a9ce1
add edi, eax
cmc
mov edi, dword [edi + ecx*4]
cmp dh, bh
cmp di, cx
pushal
test edi, edi
mov byte [esp + 8], 0xf8
lea esp, [esp + 0x20]
je 0x10815f4a
pushal
cmp edi, esp
add eax, edi
push esp
jmp 0x1047aba6
pushal
mov ecx, dword [esi + 0x7c]
test ah, dh
add ecx, edx
pushal
clc
bt edi, ecx
mov dword [ebp - 0x10], ecx
pushfd
inc cl
rol cx, cl
mov ecx, dword [ebp + 0xc]
stc
clc
mov dword [esp + 4], esp
clc
cmp ecx, 0xffff
jmp 0x1056a012
cmp al, 0x5b
cmc
add edi, eax
pushal
cmc
jmp 0x107aa5d7
cmc
mov edi, dword [edi + ecx*4]
bt ecx, 0x1e
mov byte [esp + 0xc], dh
test edi, edi
push dword [esp]
lea esp, [esp + 0x24]
je 0x10815f4a
cmp dl, 0xf9
call fcn.10477fb5
setne bl
mov bl, ch
inc ecx
setge bl
pushfd
sar bl, cl
push dword [esp]
xchg ebp, eax
shld eax, esp, cl
aam 0x8f
add ax, bp
lahf
mov eax, ebp
adc bl, bl
mov bl, 1
pushal
bt bx, 0xf
clc
xchg dword [esp + 0x28], esi
bsf si, si
bswap si
bsf si, ax
sal si, cl
mov esi, edi
cmp bl, ch
stc
bt ax, 9
sub esi, eax
jmp 0x107aacbb
call fcn.107aea38
shr di, 0xe
mov edi, dword [edx + 0x1c]
jmp 0x1056f343
Function at 0x107aa38d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x107a98a7
shld si, cx, 0xd
and si, ax
sub ecx, ebx
neg si
shr si, 0xc
shl si, cl
mov esi, esp
push 0xd92491f0
pushal
sub edi, 4
call fcn.104823c5
inc esi
sbb byte [ebp - 0x7594670d], dh
adc edx, dword [ebp - 0x764f4795]
push edi
int1
shl byte [ebp + 0x32], 0xd1
lahf
adc al, 0x13
test al, 0x71
scasb al, byte es:[di]
or al, byte [ebx + edx*8]
lcall 0x7264, 0x54530603
invalid
pushfd
lea esp, [esp + 4]
jne 0x10815f4a
inc si
mov ecx, edi
lea esi, [ebp + 0x1bf25888]
jmp 0x1056c634
pushal
mov word [esp + 4], 0x1c3b
lea esp, [esp + 0x44]
jae 0x10478fba
sub edi, esp
cmp ch, ch
mov ebx, eax
sbb cx, si
mov edi, eax
bts ecx, ecx
movsx ecx, al
neg cl
movsx cx, cl
mov ecx, 0x104
cmp ah, 0x4f
clc
sub al, al
jbe 0x10816395
stc
stc
repne scasb al, byte es:[edi]
jne 0x10478a70
pushal
lea esp, [esp + 0x20]
jne 0x10815f4a
rcl ecx, cl
sal si, 0xe
btr si, 7
mov ecx, edi
xor esi, 0xd61b8c32
test eax, 0x1c9c5677
shrd si, bp, 5
sub ecx, ebx
clc
mov esi, esp
call 0x1047716e
lds edx, [edx - 0x43e38dee]
mov dl, byte [esi + edx - 0xea3a21d]
mov esp, 0xac336a94
inc edi
or eax, 0x194da1d0
mov ebp, 0xd4053892
lahf
push 0x14cc0834
mov al, byte [0xf8b3fc31]
xor esp, edi
mov bl, 0xf8
fistp word [esi - 0x6531e1b5]
push edi
xchg ebp, eax
push ebp
sbb dword [ebp + 0x4b], edx
loopne 0x108142fd
jnp 0x1081432d
inc ebp
retf
cwde
inc edx
or eax, 0x1187905b
retf 0xcdb2
bt si, 8
repne scasb al, byte es:[edi]
jmp 0x108142d4
Function at 0x405dae
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00406079
test bl, 8
mov dword [ebp - 8], eax
je 0x405ded
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x429ae8], eax
jmp 0x405f6a
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405e07
test eax, eax
je 0x405f18
test bl, 2
je 0x405f18
mov esi, 0x424f50
push edi
push esi
call fcn.004066a2
cmp dword [ebp + 8], 0
je 0x405e26
push 0x40a59c
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405e2c
push edi
call fcn.00405fbd
cmp word [edi], 0
jne 0x405e3c
cmp word [0x424f50], 0x5c
jne 0x405e47
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f0d
cmp word [ebp - 0x22c], 0x2e
jne 0x405e91
cmp word [ebp - 0x22a], 0
je 0x405ef0
cmp word [ebp - 0x22a], 0x2e
jne 0x405e91
cmp word [ebp - 0x228], 0
je 0x405ef0
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.004066a2
test byte [ebp - 0x258], 0x10
je 0x405ebc
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405ef0
push dword [ebp + 0xc]
push edi
call fcn.00405dae
jmp 0x405ef0
push dword [ebp - 4]
push edi
call fcn.00405d66
test eax, eax
jne 0x405ee8
cmp dword [ebp - 4], eax
je 0x405ee0
push edi
push 0xfffffffffffffff1
call fcn.00405727
push 0
push edi
call fcn.00406462
jmp 0x405ef0
inc dword [0x429ae8]
jmp 0x405ef0
push edi
push 0xfffffffffffffff2
call fcn.00405727
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405e69
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405f18
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405f6a
cmp dword [ebp - 8], esi
jne 0x405f2c
inc dword [0x429ae8]
jmp 0x405f6a
push edi
call fcn.004069ff
test eax, eax
je 0x405f6a
push edi
call fcn.00405f71
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405d66
test eax, eax
jne 0x405f62
cmp dword [ebp - 4], esi
je 0x405f24
push edi
push 0xfffffffffffffff1
call fcn.00405727
push esi
push edi
call fcn.00406462
jmp 0x405f6a
push edi
push 0xffffffffffffffe5
call fcn.00405727
pop edi
pop esi
pop ebx
leave
ret 8