joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4028a5
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call fcn.00408ea0
mov eax, dword [0x2e7dff8]
mov ecx, dword [0x2e7cf48]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x402980
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x2e7dff8], 0x959
jne 0x40296e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.004026ee
add edi, 8
dec ebx
jne 0x4028d1
pop edi
pop ebx
pop esi
leave
ret
Function at 0x101a950d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x101a9591
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x101a9628
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x14], eax
je 0x101a9628
jmp 0x101a9539
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 0x104
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], ecx
jl 0x101a9591
jmp 0x101a95a7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x101a9543
jmp 0x101a9539
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], edx
jne 0x101a9560
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x101a9539
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x101a9539
mov dword [0x1027858c], 0x3e8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101a9539
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x101a9539
mov dword [0x1027858c], 0xfffff741
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov dx, word [eax + ecx*2 - 0x12]
mov word [ebp - 0x26], dx
mov ax, word [ebp - 0x26]
cmp ax, 0x64
je 0x101a9580
jmp 0x101a9539
mov eax, dword [ebp - 0x14]
add esp, 0x28
pop ebp
ret
Function at 0x101a9743
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.101a909d
xor ecx, ecx
mov edx, eax
mov dword [0x1027858c], 0xdcd
mov esi, dword [eax + 0x3c]
mov dword [0x1027858c], 0x1269
mov esi, dword [eax + esi + 0x78]
mov dword [0x1027858c], 0x1b01
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
jne 0x101a97fd
mov eax, dword [ebp - 0x24]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
add eax, 1
mov cl, byte [ebp - 0x29]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x2a]
and ch, dl
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], ch
mov eax, dword [ebp - 0x30]
cmp eax, 0x20
setb cl
mov dl, byte [ebp - 0x31]
and dl, cl
test dl, 1
mov dword [ebp - 0x38], eax
jne 0x101a9811
jmp 0x101a983e
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x38], edx
jmp 0x101a9811
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], eax
jmp 0x101a97e1
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x4c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x29], bh
mov byte [ebp - 0x2a], cl
jne 0x101a97ab
mov al, byte [ebp - 0x2a]
test al, 1
jne 0x101a988b
jmp 0x101a9847
mov eax, dword [ebp - 0x44]
add eax, 1
mov ecx, dword [ebp - 0x48]
add ecx, 2
mov edx, dword [ebp - 0x18]
cmp eax, edx
setb bl
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x55], bl
xor eax, eax
mov cl, byte [ebp - 0x55]
test cl, 1
mov edx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], esi
jne 0x101a97e1
jmp 0x101a97a0
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x1027858c], 0x22e9
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x24], edx
jmp 0x101a97a0
Function at 0x101a99bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10278594], 0
mov dword [0x10278598], 0
mov dword [0x102785a4], 0
mov dword [0x1027858c], 0x1efc
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x101a9b12
jmp 0x101a9a37
mov eax, dword [0x10278594]
mov ecx, dword [0x10278598]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10278594], edx
mov dword [0x1027858c], 0x24cf
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x10278598], edx
mov dword [0x1027858c], 0xb3c
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1027859c], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x10278590]
add edx, 0xffffde22
mov dword [0x1027858c], edx
mov cl, byte [0x1027859c]
mov edx, dword [0x10278598]
mov byte [edi + edx], cl
mov edx, dword [0x10278594]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10278598]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x10278590], 0x14eb
and ebx, 0xff
mov dword [0x102785a4], ebx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x30]
xor cl, byte [edx + ebx]
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], cl
add ebx, 1
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
mov dword [ebp - 0x2c], ebx
jne 0x101a9a20
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101a9b1a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10278598], 0
mov byte [0x1027859c], 0
mov dword [0x10278594], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1027858c], 0x192c
mov eax, dword [0x10278594]
add eax, 1
mov dword [0x10278594], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101a9b55
mov eax, 0x21b9
xor ecx, ecx
mov dword [0x1027858c], 0x21b9
mov dword [0x10278594], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
mov dword [0x102785a0], 0
mov esi, dword [0x10278598]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x102785a0], ebx
mov eax, ebx
cdq
mov ebx, dword [ebp - 0x2c]
idiv ebx
mov dword [0x10278598], edx
mov esi, dword [ebp - 0x28]
mov bl, byte [edi + esi]
mov byte [0x1027859c], bl
add ecx, 0xfffff8bb
mov dword [0x1027858c], ecx
mov bl, byte [edi + edx]
mov byte [edi + esi], bl
mov bl, byte [0x1027859c]
mov ecx, dword [0x10278598]
mov byte [edi + ecx], bl
mov ecx, dword [0x10278594]
add ecx, 1
mov dword [0x10278594], ecx
cmp ecx, 0x100
mov dword [ebp - 0x30], ecx
jge 0x101a9c59
mov eax, dword [0x1027858c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x101a9ba6
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101aa075
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x5c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [0x1027858c]
add edx, 0xd1d
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov dword [0x1027858c], ecx
mov dword [ebp - 0x34], eax
jmp 0x101aa0ea
lea eax, [ebp - 0x24]
mov dword [0x10278590], 0x1f1f
mov dword [ebp - 0x38], eax
call fcn.101a9df5
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.101a9f11
cmp eax, 0
sete cl
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x3d], cl
mov al, byte [ebp - 0x3d]
test al, 1
jne 0x101aa0e2
jmp 0x101aa112
xor eax, eax
add esp, 0x5c
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov cl, byte [eax + 0x101ab1d4]
mov dl, byte [eax + 0x101ab1a5]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x34], eax
je 0x101aa0a7
jmp 0x101aa0ea
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, esp
mov dword [eax + 0xc], 0x40
mov dword [eax + 8], 0x1000
mov dword [eax + 4], 0x6000
mov dword [eax], 0
mov eax, dword [ebp - 0x44]
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x48], eax
call fcn.101a9645
xor eax, eax
mov ecx, dword [ebp - 0x48]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x30], ecx
mov ecx, dword [ebp - 0x48]
mov dword [edx + 0x2c], ecx
mov dword [0x1027858c], 0x2706
add ecx, 0x229d
mov esi, dword [ebp - 0x48]
cmp esi, 0
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], eax
je 0x101aa1a3
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
add esp, 0x5c
pop esi
pop ebp
ret
Function at 0x101aa1c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
mov dword [0x1027858c], 0xe6a
mov dword [0x10278590], 0x1c1d
mov dword [ebp - 0x130], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
jmp 0x101aa202
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
xor edx, edx
lea esi, section..data
imul edi, eax, 0xac
mov ebx, esi
add ebx, edi
add ebx, 0xa8
mov edi, dword [ebx]
imul ebx, eax, 0xac
add esi, ebx
add esi, 0x7c
movzx esi, word [esi]
xor esi, edi
add esi, ecx
add eax, 1
cmp eax, 0x71a
mov ecx, esi
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x140], edx
jne 0x101aa202
mov eax, dword [ebp - 0x140]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101ab1d4]
mov dh, byte [eax + 0x101ab1a5]
sub dh, dl
mov byte [ebp + eax - 0x12c], dh
cmp ecx, 0xe
mov dword [ebp - 0x140], ecx
jne 0x101aa263
lea eax, [ebp - 0x12c]
mov dword [0x10278590], 0x1490
mov dword [0x1027858c], 0x2176
mov dword [ebp - 0x144], eax
call fcn.101a9df5
mov dword [esp], eax
mov eax, dword [ebp - 0x144]
mov dword [esp + 4], eax
call fcn.101a9f11
mov ecx, eax
mov dword [0x102785a8], eax
mov eax, esp
mov edx, dword [ebp - 0x13c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
imul esi, eax, 0xac
mov edi, edx
add edi, esi
add edi, 0xa8
mov esi, dword [edi]
imul edi, eax, 0xac
mov ebx, edx
add ebx, edi
add ebx, 0x20
mov edi, dword [ebx]
imul ebx, eax, 0xac
add edx, ebx
add edx, 0x7c
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x148]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.101a9414
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x71a
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edx
jne 0x101aa30e
lea eax, [0x101ab1b3]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x1027858c], 0x1cea
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.101a9b1a
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x13c]
mov dword [esp + 0xc], edx
call fcn.101a99bb
xor eax, eax
mov ecx, dword [ebp - 0x148]
add ecx, 0x5be6b
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x167000
mov ecx, dword [ebp - 0x148]
add ecx, 0x28846
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x2010
mov dword [0x1027858c], 0x25ad
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101aa45c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.101aa1c7
lea ecx, [0x101a9052]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x88], edx
mov dword [esp + 0x38], 0x167000
mov edx, dword [0x10278578]
mov dword [esp + 0x54], edx
mov edx, dword [0x1027857c]
mov dword [esp + 0x60], edx
mov edx, dword [0x10278580]
mov dword [esp + 0x3c], edx
mov edx, dword [0x10278584]
mov dword [esp + 0x74], edx
mov edx, dword [0x10278588]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x101aa501
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
sete dl
mov dword [esp + 0x14], ecx
mov byte [esp + 0x13], dl
mov al, byte [esp + 0x13]
test al, 1
jne 0x101aa515
jmp 0x101aa501
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x101aa4cf
mov eax, dword [esp + 0x18]
mov dword [esp + 0x7c], eax
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x40], edx
mov dword [0x1027858c], 0x17cf
call fcn.101a950d
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x101aa581
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 8]
mov dword [esp + 4], eax
call fcn.101aa075
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1027858c], 0x7ca
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x43b658
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop eax
add ebx, ecx
dec ecx
add ebx, 0x72932053
call fcn.0043b6a6
sub esp, 4
mov dword [esp], 0xbe2ce54d
pop ebx
xor dword [esi], eax
and ecx, ebx
mov ecx, ecx
inc esi
inc ecx
mov ecx, ebx
and ebx, ebx
cmp esi, edx
jne fcn.0043b658
and ebx, ebx
or ecx, ecx
sub esp, 4
mov dword [esp], 0x6b37b00b
pop ecx
ret
Function at 0x1000cd31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002cd97
call fcn.10017073
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000cdae
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000cdae
call fcn.10005a99
mov esi, eax
jmp 0x1000ce85
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000cdd1
call fcn.10005a99
jmp 0x1000ce78
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000cdc7
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000ce01
mov esi, 0x8007000e
jmp 0x1000ce7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000fc81
jmp 0x1000ce27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cdfa
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000cdc7
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000fc81
mov esi, eax
test edi, edi
je 0x1000ce85
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000ce9e
lea ecx, [ebp - 0x418]
call fcn.1000c4af
mov eax, esi
call fcn.10016fc0
ret 0x10
Function at 0x100123e7
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002d2cf
call fcn.10016fd1
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1000fc81
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x10012492
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000fc81
mov ecx, dword [esi]
test al, al
je 0x10012474
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000fc81
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x1001248b
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.1000fc81
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009bb3
cmp dword [ebx + 0x24], 0
je 0x100124b2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1000fc81
test al, al
je 0x100124b2
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016f9a
ret
Function at 0x100133d0
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002d3b0
call fcn.10017005
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x100133fb
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x10013586
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1002f4d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001341f
mov eax, 0x80004005
jmp 0x10013586
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.1000fc81
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.1000fc81
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.1000fc81
test al, al
je 0x1001355e
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100194b0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.1000fc81
add esp, 0x14
test eax, eax
jne 0x100134d8
push 0x2f
push edi
call fcn.1000fc81
pop ecx
pop ecx
test eax, eax
je 0x100134f8
add eax, 2
push 0x2e
push eax
call fcn.1000fc81
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1000fc81
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x10013557
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.1000fc81
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10013549
lea eax, [ebp - 0x218]
push eax
call fcn.1000fc81
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001354f
push edi
call fcn.1000fc81
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x1001356f
mov esi, 0x80004005
jmp 0x10013578
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.1000fc81
push eax
lea ecx, [ebx + 0x10]
call fcn.1000fc81
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016faf
ret 0xc