joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3501fe0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x350978a]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.03501fba
xor ebx, ebx
mov edi, eax
pop ecx
mov dword [ebp - 0x1fc], edi
cmp edi, ebx
je 0x3502180
push 3
call fcn.03503d97
cmp eax, 1
pop ecx
je 0x350212c
push 3
call fcn.03503d97
pop ecx
test eax, eax
jne 0x350203e
cmp dword [0x350947a], 1
je 0x350212c
cmp esi, 0xfc
je 0x3502180
mov edi, 0x3509ffa
push str.Runtime_Error__n_nProgram:
push 0x314
push edi
call fcn.03503d34
sub esp, 0xfffffff4
test eax, eax
jne 0x3502122
mov esi, 0x350a02c
push 0x104
push esi
push ebx
mov word [0x350a234], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 0x2fb
or eax, eax
jne 0x35020aa
push str._program_name_unknown_
push ebx
push esi
call fcn.03503d34
add esp, 0xc
test eax, eax
je 0x35020aa
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0350363c
push esi
call fcn.03503d19
pop ecx
inc eax
cmp eax, 0x3c
jbe 0x35020e1
push esi
call fcn.03503d19
push 3
push 0x3507074
lea eax, [eax*2 + 0x3509fb6]
mov ecx, eax
sub ecx, esi
sar ecx, 1
sub ebx, ecx
push ebx
push eax
call fcn.03503c4c
add esp, 0x14
or eax, eax
jne 0x350209e
push 0x350706c
mov esi, 0x314
push esi
push edi
call fcn.03503bd7
sub esp, 0xfffffff4
or eax, eax
jne 0x350209e
push dword [ebp - 0x1fc]
push esi
push edi
call fcn.03503bd7
add esp, 0xc
test eax, eax
jne 0x350209e
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push edi
call fcn.03503a6b
sub esp, 0xfffffff4
jmp 0x3502180
push ebx
push ebx
push ebx
push ebx
push ebx
jmp 0x35020a5
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
cmp esi, ebx
je 0x3502180
cmp esi, 0xffffffff
je 0x3502180
xor eax, eax
mov cl, byte [edi + eax*2]
mov byte [ebp + eax - 0x1f8], cl
cmp word [edi + eax*2], bx
je 0x3502159
inc eax
cmp eax, 0x1f4
jb 0x3502141
lea edi, [ebp - 0x1fc]
lea eax, [ebp - 0x1f8]
push ebx
push edi
push eax
mov byte [ebp - 5], bl
call fcn.035039e0
pop ecx
push eax
lea eax, [ebp - 0x1f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.03503dd6
leave
ret
Function at 0x35026a2
Capabilities:
Query environment variable

Disassembly:
mov esi, esi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x35026be
xor eax, eax
jmp 0x3502735
cmp word [edi], bx
je 0x35026d3
add eax, 2
cmp word [eax], bx
jne 0x35026c3
add eax, 2
cmp word [eax], bx
jne 0x35026c3
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, edi
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x350272b
push eax
call fcn.03504654
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x350272b
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
test eax, eax
jne 0x350271f
push dword [ebp - 4]
call fcn.035045bb
pop ecx
mov dword [ebp - 4], ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [ebp - 4]
jmp 0x3502734
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret

Function at 0x3503890
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edx], ax
je 0x35038a6
xor eax, eax
pop ebp
ret
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x35038a2
xor edx, edx
mov eax, 0x10b
cmp word [ecx + 0x18], ax
sete dl
mov eax, edx
pop ebp
ret
Function at 0x3503a6b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov edi, edi
mov ebp, esp
add esp, 0xffffffdc
mov eax, dword [0x350978a]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.035029ca
and dword [ebp - 0x14], 0
cmp dword [0x350a8b6], 0
mov dword [ebp - 0x18], eax
jne 0x3503b1e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x3503bc6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x3503bc6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x350a8b6], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x350a8ba], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x350a8be], eax
call edi
push eax
call esi
mov dword [0x350a8c6], eax
or eax, eax
je 0x3503b1e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x350a8c2], eax
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
mov eax, dword [0x350a8c2]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
je 0x3503b77
cmp dword [0x350a8c6], ecx
je 0x3503b77
push eax
call esi
push dword [0x350a8c6]
mov edi, eax
call esi
test edi, edi
mov ebx, eax
je 0x3503b77
or ebx, ebx
je 0x3503b77
call edi
or eax, eax
je 0x3503b6e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x3503b6e
test byte [ebp - 8], 1
jne 0x3503b77
or dword [ebp + 0x10], 0x200000
jmp 0x3503baa
mov eax, dword [0x350a8ba]
cmp eax, dword [ebp - 0x18]
je 0x3503baa
push eax
call esi
test eax, eax
je 0x3503baa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x3503baa
mov eax, dword [0x350a8be]
cmp eax, dword [ebp - 0x18]
je 0x3503baa
push eax
call esi
or eax, eax
je 0x3503baa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x350a8b6]
call esi
test eax, eax
je 0x3503bc6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x3503bc8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
pop ebx
call fcn.03503dd6
leave
ret

Function at 0x3503dd6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x350978a]
jne 0x3503de0
repz ret
jmp fcn.03505046
Function at 0x10016331
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10016340
pop dword [ebp - 0x28]
mov eax, 0x10016340
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc8c59fbc
add dword [ebp - 0x38], 0x858ca58f
mov dword [ebp - 0x34], 0x669874b3
add dword [ebp - 0x34], 0xcb9ad792
mov dword [ebp - 0x30], 0x3e3ea511
add dword [ebp - 0x30], 0xe0d9f1d
mov dword [ebp - 0x2c], 0x835a54d9
add dword [ebp - 0x2c], 0x7ca5ab27
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xc3f2ec47
add dword [ebp - 0x38], 0xb07f7d0f
mov dword [ebp - 0x34], 0x4ab0c49a
sub dword [ebp - 0x34], 0x9446325
mov dword [ebp - 0x30], 0xcfee2880
sub dword [ebp - 0x30], 0x6c7ebc14
mov dword [ebp - 0x2c], 0x785363e0
add dword [ebp - 0x2c], 0x87ac9c20
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x83c4d649
add eax, 0x8c3cc9c3
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x35b6c
push 0
call eax
mov ecx, 0x35e7
xor esi, esi
add esi, eax
mov edi, 0xbbd90eed
add edi, 0x54293b13
add edi, dword [ebp - 0x28]
mov edx, 0x48c145d9
sub edx, 0x5caf8430
add dword [ebp - 0xc], 0x94ebb3cd
mov ebx, dword [edi]
xor dword [ebp - 0x24], 0xe76e884d
xor ebx, edx
xor dword [ebp - 0x14], ebx
mov dword [esi], ebx
xor dword [ebp - 0x1c], 0xf50fd9cd
add esi, 0x1f9d1755
sub esi, 0x1f9d1751
add edi, 0x435e002
sub edi, 0x435dffe
loop 0x10016454
add eax, 0x5a20bd01
add eax, 0xa5e00d6e
mov ebx, eax
add eax, 0x43c588
sub eax, 0x43c583
mov ecx, 0x650662b4
add ecx, 0xaaf99d4c
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x1000cc3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002d770
call fcn.10016ea3
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000ccbb
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000ccbb
call fcn.10005a09
mov esi, eax
jmp 0x1000cd92
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000ccde
call fcn.10005a09
jmp 0x1000cd85
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000ccd4
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000cd0e
mov esi, 0x8007000e
jmp 0x1000cd87
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10029874
jmp 0x1000cd34
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cd07
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000ccd4
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10029874
mov esi, eax
test edi, edi
je 0x1000cd92
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000cdab
lea ecx, [ebp - 0x418]
call fcn.1000c3cf
mov eax, esi
call fcn.10016df0
ret 0x10
Function at 0x10012247
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002dc29
call fcn.10016e01
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.10029874
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x100122f2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10029874
mov ecx, dword [esi]
test al, al
je 0x100122d4
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10029874
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x100122eb
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.10029874
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009b23
cmp dword [ebx + 0x24], 0
je 0x10012312
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10029874
test al, al
je 0x10012312
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016dca
ret
Function at 0x10013230
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002dcec
call fcn.10016e35
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x1001325b
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x100133e6
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x100304d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001327f
mov eax, 0x80004005
jmp 0x100133e6
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.10029874
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.10029874
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.10029874
test al, al
je 0x100133be
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10019ba0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.10029874
add esp, 0x14
test eax, eax
jne 0x10013338
push 0x2f
push edi
call fcn.10029874
pop ecx
pop ecx
test eax, eax
je 0x10013358
add eax, 2
push 0x2e
push eax
call fcn.10029874
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10029874
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x100133b7
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10029874
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x100133a9
lea eax, [ebp - 0x218]
push eax
call fcn.10029874
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x100133af
push edi
call fcn.10029874
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x100133cf
mov esi, 0x80004005
jmp 0x100133d8
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.10029874
push eax
lea ecx, [ebx + 0x10]
call fcn.10029874
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016ddf
ret 0xc
Function at 0x10013a90
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002ddab
call fcn.10016e35
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013bcc
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.10019ba0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.10029874
add esp, 0x18
test eax, eax
jne 0x10013b31
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.10029874
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013b70
cmp dword [ebp - 0x818], 0
jne 0x10013b70
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.10029874
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009b23
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013bcc
cmp dword [ebp - 0x818], 0
jne 0x10013bcc
test esi, esi
jns 0x10013bcc
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016ddf
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10029874
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x10029874
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10029883
pop dword [ebp - 0x4c]
mov eax, 0xcbd9cce7
add eax, 0x4428cb9c
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3d270
push 0
mov eax, 0x3325fcaa
add eax, 0xdcdd04b2
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x3bbf
xor edx, edx
add edx, eax
mov ebx, 0x39c54366
add ebx, 0xd63f789a
add ebx, dword [ebp - 0x4c]
mov edi, 0xb951c138
xor dword [ebp - 8], 0xd4ec717b
mov esi, dword [ebx]
xor dword [ebp - 0x28], ecx
xor esi, edi
add dword [ebp - 0x2c], 0x6a45514d
mov dword [edx], esi
sub dword [ebp - 0x40], ecx
add edx, 0xd0c54d7b
sub edx, 0xd0c54d77
add ebx, 0x74358d1d
add ebx, 0x8bca72e7
loop 0x100298d8
add eax, 0xe1cf
mov ebx, eax
add eax, 0xa79ebd6
add eax, 0xf586142f
mov ecx, 0xdca34e0d
sub ecx, 0xcca34e0d
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x408a00
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x428024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], 0
mov ebx, ecx
push eax
mov dword [ebp - 0x1c], ebx
push 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
push dword [ebp - 0x1c]
call fcn.004197e8
add esp, 4
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
movzx eax, byte [edi + 0x199]
push eax
movzx eax, byte [edi + 0x198]
push eax
movzx eax, byte [edi + 0x197]
push eax
movzx eax, byte [edi + 0x196]
push eax
movzx eax, byte [edi + 0x195]
push eax
movzx eax, byte [edi + 0x194]
push eax
push str._02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.00402dd0
push edi
call fcn.00419543
mov dword [ebx + 0x14], 0xf
add esp, 0x28
mov dword [ebx + 0x10], 0
mov byte [ebx], 0
cmp byte [ebp - 0x18], 0
jne 0x408aad
xor eax, eax
jmp 0x408abc
lea eax, [ebp - 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408ab3
sub eax, edx
push eax
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.00404420
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.00419532
mov esp, ebp
pop ebp
ret

Function at 0x40a780
Capabilities:
Delete file
Move file

Disassembly:
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov esi, eax
add esp, 4
test esi, esi
je 0x40a7a8
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x40a7a8
pop edi
mov eax, esi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x40a8f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40a8fe
pop ebp
ret 0xc
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
pop ebp
ret 0xc

Function at 0x40a950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
test eax, eax
jne 0x40a95e
pop ebp
ret 0xc
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop ebp
ret 0xc

Function at 0x40aa90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40aaa3
test al, 0x10
je 0x40aaa3
mov al, 1
ret
xor al, al
ret

Function at 0x40aab0
Capabilities:
Create directory

Disassembly:
push ebx
push ecx
xor bl, bl
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
add esp, 4
test eax, eax
je 0x40aace
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 0x11
mov al, bl
jne 0x40aad0
mov al, 1
pop ebx
ret
Function at 0x40c470
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b642
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x428024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push 0x104
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x11c], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x40c4ee
mov eax, dword [esi]
jmp 0x40c4f0
mov eax, esi
mov byte [eax], 0
cmp byte [ebp - 0x118], 0
jne 0x40c500
xor ecx, ecx
jmp 0x40c519
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c510
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
mov ecx, esi
push eax
call fcn.00404420
push 9
mov dword [ebp - 4], 0
mov ecx, esi
push str._system32
mov dword [ebp - 0x11c], 1
call fcn.00402750
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419532
mov esp, ebp
pop ebp
ret 4

Function at 0x40c570
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b692
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x428024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push 0x104
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x11c], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x40c5f1
mov eax, dword [esi]
jmp 0x40c5f3
mov eax, esi
mov byte [eax], 0
cmp byte [ebp - 0x118], 0
jne 0x40c603
xor ecx, ecx
jmp 0x40c619
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c610
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
mov ecx, esi
push eax
call fcn.00404420
mov dword [ebp - 4], 0
mov ecx, esi
cmp byte [edi + 0xc], 0
mov dword [ebp - 0x11c], 1
je 0x40c64a
push 0xa
push str._sysnative
jmp 0x40c651
push 9
push str._system32
call fcn.00402750
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419532
mov esp, ebp
pop ebp
ret 4