joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035d60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x36c
mov ecx, dword [0x107ab964]
push ebx
mov ebx, dword [esp + 0x374]
push esi
mov eax, dword [ecx]
push edi
push ebx
call dword [eax + 0x20]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
jle 0x10035e65
mov edx, dword [0x107ab964]
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
push ebx
push edx
call fcn.1000fc50
add esp, 0xc
test eax, eax
je 0x10035e65
mov eax, dword [esp + 0x28]
mov ecx, dword [0x107ab964]
push eax
push ebx
push ecx
call fcn.1000fe50
add esp, 0xc
cmp esi, eax
mov dword [esp + 0x14], eax
jl 0x10035e65
test eax, eax
jle 0x10035e65
lea edx, [esp + 0x10]
push 1
lea ecx, [esp + 0x7c]
push edx
mov edx, dword [0x107ab964]
push ecx
push 0x300
push 0x300
push eax
push esi
push ebx
push edx
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x10035e65
cmp dword [esp + 0x10], 0x300
jne 0x10035e65
xor eax, eax
mov edi, 0xc6830000
mov esi, 0x802d
mov bl, 0x36
mov edx, 0x7ece3946
mov cl, 0xf8
cmp dword [esp + eax + 0x78], 0xff58e8d
jne 0x10035e5d
cmp dword [esp + eax + 0x7c], edi
jne 0x10035e5d
cmp word [esp + eax + 0x80], si
jne 0x10035e5d
cmp byte [esp + eax + 0x82], bl
jne 0x10035e5d
cmp dword [esp + eax + 0x84], edx
jne 0x10035e5d
cmp byte [esp + eax + 0x88], cl
je 0x10035e71
inc eax
cmp eax, 0x2f0
jb 0x10035e28
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x36c
ret
mov cl, byte [esp + eax + 0x83]
add eax, 0x11
cmp eax, 0x2f0
jae 0x10035e65
test cl, cl
je 0x10035e65
cmp eax, 0x300
jae 0x10035e9f
mov bl, byte [esp + eax + 0x78]
xor bl, cl
mov byte [esp + eax + 0x78], bl
inc eax
cmp eax, 0x300
jb 0x10035e8d
mov eax, 0x100
mov esi, 0xd1b858d
mov bl, 0xe8
mov edx, 0xb858006a
mov ecx, 0xe0ff
cmp dword [esp + eax + 0x78], esi
jne 0x10035edc
cmp word [esp + eax + 0x7c], 0
jne 0x10035edc
cmp byte [esp + eax + 0x7e], bl
jne 0x10035edc
cmp dword [esp + eax + 0x83], edx
jne 0x10035edc
cmp word [esp + eax + 0x8b], cx
je 0x10035ef0
inc eax
cmp eax, 0x2e0
jb 0x10035eb5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x36c
ret
mov ecx, dword [esp + eax + 0x87]
mov esi, dword [esp + 0x34]
sub ecx, esi
cmp eax, 0x2e0
jge 0x10035e65
test ecx, ecx
je 0x10035e65
cmp dword [esp + 0x50], ecx
jb 0x10035e65
mov esi, dword [esp + 0x37c]
mov eax, dword [0x107ab964]
push ecx
push esi
push eax
call fcn.10029b30
add esp, 0xc
test eax, eax
je 0x10035e65
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
lea ecx, [eax + 0x1000]
cmp edx, ecx
jl 0x10035e65
mov edx, dword [0x107ab964]
push 0x1000
push eax
push esi
push edx
call fcn.100014d0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x36c
ret
Function at 0x10035f80
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
test eax, eax
jne 0x10035f91
xor eax, eax
add esp, 8
ret
mov eax, dword [esp + 0x10]
mov ecx, eax
and ecx, reloc.platform.dll_Ordinal_7
jns 0x10035fa4
dec ecx
or ecx, 0xfffffff8
inc ecx
je 0x10035fac
xor eax, eax
add esp, 8
ret
push edi
xor ecx, ecx
xor edi, edi
test eax, eax
jle 0x1003604d
add eax, 7
push ebx
shr eax, 3
push ebp
push esi
mov esi, dword [esp + 0x1c]
shl eax, 3
mov dword [esp + 0x14], eax
mov ecx, dword [esi + edi]
mov eax, dword [esi + edi + 4]
mov edx, 0xc6ef3720
mov dword [esp + 0x10], 0x20
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov esi, ecx
shl esi, 4
add esi, ebx
mov ebx, ecx
shr ebx, 5
add ebx, ebp
mov ebp, dword [esp + 0x30]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
sub eax, esi
mov esi, edx
mov ebx, eax
add esi, eax
shl ebx, 4
add ebx, ebp
mov ebp, eax
shr ebp, 5
add ebp, dword [esp + 0x34]
add edx, 0x61c88647
xor ebx, ebp
xor ebx, esi
mov esi, dword [esp + 0x10]
sub ecx, ebx
dec esi
mov dword [esp + 0x10], esi
jne 0x10035fe1
mov esi, dword [esp + 0x1c]
add edi, 8
mov dword [esi + edi - 8], ecx
mov dword [esi + edi - 4], eax
mov eax, dword [esp + 0x20]
cmp edi, eax
jl 0x10035fcd
mov ecx, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
cmp edi, eax
pop edi
je 0x10036058
xor eax, eax
add esp, 8
ret
mov edx, dword [esp + 0x14]
mov eax, 1
mov dword [edx], ecx
add esp, 8
ret
Function at 0x10037cd0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [0x107ab964]
sub esp, 0x400
push ebx
mov ebx, dword [esp + 0x408]
push ebp
mov ebp, dword [esp + 0x410]
push esi
push ebp
push ebx
push eax
call fcn.1002bac0
add esp, 0xc
test eax, eax
jne 0x10037d05
pop esi
pop ebp
pop ebx
add esp, 0x400
ret
push edi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.platform.dll_Ordinal_13
add esp, 8
test eax, eax
jne 0x10037d67
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push 0x2e
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov esi, eax
test esi, esi
pop edi
je 0x10037df5
push 0x102325e4
push esi
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10037df5
mov byte [esi], al
mov ecx, dword [0x107ab964]
push eax
lea eax, [esp + 0x10]
mov edx, dword [ecx]
push eax
call dword [edx]
cmp eax, 0xffffffff
je 0x10037df5
mov ecx, dword [0x107ab964]
lea eax, [esp + 0xc]
push 0x180
push eax
mov edx, dword [ecx]
call dword [edx + 0x38]
lea ecx, [esp + 0xc]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [0x107ab964]
lea eax, [esp + 0xc]
push ebx
push eax
mov edx, dword [ecx]
call dword [edx + 0x4c]
test eax, eax
je 0x10037df5
mov dword [ebp], 1
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x400
ret
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x400
ret
Function at 0x10038b60
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x404
push ebx
mov ebx, dword [esp + 0x410]
push esi
push edi
mov edi, dword [esp + 0x414]
mov dword [ebx], 0
mov ecx, dword [0x107ab964]
push 0
push 0x8002
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10038ba3
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x404
ret
mov ecx, dword [0x107ab964]
push esi
mov edx, dword [ecx]
call dword [edx + 0x20]
cmp eax, 0x800
jg 0x10038bc9
mov ecx, dword [0x107ab964]
push esi
mov eax, dword [ecx]
call dword [eax + 0x18]
push ebx
push edi
jmp 0x10038d3f
mov edx, dword [0x107ab964]
push 0x800
push eax
push esi
push edx
call fcn.1002b090
mov ecx, dword [0x107ab964]
add esp, 0x10
test eax, eax
jne 0x10038bfb
mov eax, dword [ecx]
push esi
call dword [eax + 0x18]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x404
ret
mov edx, dword [ecx]
push esi
call dword [edx + 0x20]
add eax, 0xfffffffd
test eax, eax
jg 0x10038c20
mov ecx, dword [0x107ab964]
push esi
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x404
ret
mov ecx, dword [0x107ab964]
push 1
push 0
push eax
push esi
push ecx
call fcn.10013800
mov ecx, dword [0x107ab964]
add esp, 0x14
mov edx, dword [ecx]
push esi
call dword [edx + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x2e
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
mov byte [esp + 0x413], 0
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
mov edx, eax
add esp, 8
test edx, edx
je 0x10038d5e
mov edi, 0x10265154
or ecx, 0xffffffff
xor eax, eax
push 0x80
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [0x107ab964]
push 0
lea eax, [esp + 0x14]
push 0x8002
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, eax
cmp esi, 0xffffffff
je 0x10038d5e
mov ecx, dword [0x107ab964]
push esi
mov edx, dword [ecx]
call dword [edx + 0x20]
mov ecx, dword [0x107ab964]
lea edi, [eax - 3]
push 0
push edi
mov eax, dword [ecx]
push esi
call dword [eax + 8]
cmp eax, edi
jne 0x10038d5e
mov ecx, dword [0x107ab964]
lea eax, [esp + 0xc]
push 3
push eax
mov edx, dword [ecx]
push esi
call dword [edx + 0xc]
cmp eax, 3
jl 0x10038d5e
cmp byte [esp + 0xc], 0x44
jne 0x10038d5e
cmp byte [esp + 0xd], 0x69
jne 0x10038d5e
cmp byte [esp + 0xe], 0x41
jne 0x10038d5e
mov ecx, dword [0x107ab964]
push esi
mov edx, dword [ecx]
call dword [edx + 0x18]
lea eax, [esp + 0x10]
push ebx
mov dword [ebx], 0
push eax
mov ecx, dword [0x107ab964]
push ecx
call fcn.1002bac0
add esp, 0xc
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
neg eax
add esp, 0x404
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x404
ret
Function at 0x1003a5a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x40c
test eax, eax
push ebx
push esi
push edi
jne 0x1003a5bd
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x40c
ret
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
xor esi, esi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push 0
push 0
push 0
push ecx
push edx
push esi
push Ordinal_6
mov dword [esp + 0x2c], 0x400
call ebx
test eax, eax
jne 0x1003a5b1
lea eax, [esp + 0x18]
push str._Classes
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x1003a624
lea ecx, [esp + 0x18]
push ecx
call fcn.1003a560
add esp, 4
cmp eax, 1
je 0x1003a636
inc esi
cmp esi, 0xa
jbe 0x1003a5c5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x40c
ret
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x41c]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebx
mov byte [eax + ecx - 1], 0
mov eax, 1
add esp, 0x40c
ret
Function at 0x10040b70
Capabilities:
Set file attributes

Disassembly:
mov ecx, dword [0x107ab964]
sub esp, 0x400
mov eax, dword [ecx]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x410]
push edi
push 0x180
push esi
call dword [eax + 0x38]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push esi
call ebp
mov ecx, dword [0x107ab964]
push esi
mov edx, dword [ecx]
call dword [edx + 0x3c]
test eax, eax
je 0x10040bbd
mov eax, dword [esp + 0x418]
mov dword [eax], 1
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 0x2e
mov eax, ecx
mov esi, edi
mov edi, edx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
jne 0x10040c0e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret
mov esi, str..scr
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10040c37
test cl, cl
je 0x10040c33
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10040c37
add eax, 2
add esi, 2
test cl, cl
jne 0x10040c13
xor eax, eax
jmp 0x10040c3c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10040cdc
mov cl, byte [esp + 0x40f]
mov eax, 0x3ff
cmp cl, bl
je 0x10040c72
test eax, eax
jle 0x10040c65
mov cl, byte [esp + eax + 0xf]
dec eax
cmp cl, bl
jne 0x10040c54
test eax, eax
jg 0x10040c72
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x400
ret
mov byte [esp + eax + 0x10], 0
mov edi, str..doc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x107ab964]
push edx
mov eax, dword [ecx]
call dword [eax]
cmp eax, 0xffffffff
je 0x10040cdc
mov ecx, dword [0x107ab964]
lea edx, [esp + 0x10]
push 0x180
push edx
mov eax, dword [ecx]
call dword [eax + 0x38]
lea eax, [esp + 0x10]
push 0x80
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x400
ret
Function at 0x10046430
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x20
push esi
push edi
xor esi, esi
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], esi
push esi
rep stosd dword es:[edi], eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 8], edi
jne 0x10046463
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
lea eax, [esp + 0xc]
push ebp
push eax
push edi
mov dword [esp + 0x18], 0x1c
call sub.KERNEL32.dll_Thread32First
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100464ce
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
cmp eax, ecx
jne 0x100464b1
mov edx, dword [esp + 0x1c]
push edx
push 0
push 2
call edi
mov esi, eax
test esi, esi
je 0x100464b1
push esi
call ebx
push esi
call ebp
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1004648e
mov edi, dword [esp + 0x10]
mov esi, 1
pop ebx
push edi
call ebp
pop ebp
mov eax, esi
pop edi
pop esi
add esp, 0x20
ret
Function at 0x10047fb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x56c
mov ecx, dword [0x107ab964]
push ebx
push esi
mov esi, dword [esp + 0x578]
mov eax, dword [ecx]
push edi
push esi
call dword [eax + 0x20]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x14], ebx
jle 0x100480ce
mov edx, dword [0x107ab964]
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
push esi
push edx
call fcn.1000fc50
add esp, 0xc
test eax, eax
je 0x100480ce
mov edx, dword [esp + 0x28]
lea eax, [esp + 0xc]
push 0
lea ecx, [esp + 0x7c]
push eax
mov eax, dword [0x107ab964]
push ecx
push 0x500
push 0x500
push edx
push ebx
push esi
push eax
mov dword [esp + 0x30], 0
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x100480ce
cmp dword [esp + 0xc], 0x500
jne 0x100480ce
mov ecx, dword [esp + 0x28]
mov edx, dword [0x107ab964]
push ecx
push esi
push edx
call fcn.1000fe50
add esp, 0xc
mov dword [esp + 0x10], eax
xor eax, eax
mov ebx, 0xb58d
mov edi, 0xfe8b
mov esi, 0x4beb9
mov edx, 0x34ac
mov ecx, 0xe2aa
cmp dword [esp + eax + 0x78], 0xe8
jne 0x100480c6
cmp dword [esp + eax + 0x7c], 0xed815d00
jne 0x100480c6
cmp word [esp + eax + 0x84], bx
jne 0x100480c6
cmp word [esp + eax + 0x8a], di
jne 0x100480c6
cmp dword [esp + eax + 0x8c], esi
jne 0x100480c6
cmp word [esp + eax + 0x91], dx
jne 0x100480c6
cmp word [esp + eax + 0x94], cx
je 0x100480da
inc eax
cmp eax, 0x4b0
jb 0x10048081
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x56c
ret
mov dl, byte [esp + eax + 0x93]
mov ecx, dword [esp + eax + 0x80]
mov edi, dword [esp + 0x34]
mov eax, dword [esp + eax + 0x86]
mov ebx, dword [esp + 0x28]
mov esi, edi
sub eax, ecx
sub esi, ecx
add eax, 5
test dl, dl
lea esi, [esi + ebx + 5]
je 0x100480ce
test esi, esi
je 0x100480ce
cmp eax, 0x50
jg 0x100480ce
test eax, eax
jl 0x100480ce
cmp eax, 0x500
mov ecx, eax
jae 0x1004812b
xor byte [esp + ecx + 0x78], dl
inc ecx
cmp ecx, 0x500
jb 0x1004811e
mov eax, dword [esp + eax + 0x7a]
sub eax, edi
add esi, eax
mov eax, esi
sub eax, ebx
cmp eax, 0x4fc
ja 0x100480ce
mov eax, dword [esp + eax + 0x78]
mov esi, dword [esp + 0x57c]
mov ecx, dword [0x107ab964]
sub eax, edi
push eax
push esi
push ecx
call fcn.10029b30
add esp, 0xc
test eax, eax
je 0x100480ce
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [0x107ab964]
sub eax, ecx
push eax
push ecx
push esi
push edx
call section..text
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x56c
ret
Function at 0x1004c2c0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x420
push ebx
mov ebx, dword [esp + 0x428]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push ebx
call ebp
mov ecx, dword [0x107ab964]
push 0x180
push ebx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [0x107ab964]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x3c]
test eax, eax
je 0x1004c316
mov eax, dword [esp + 0x430]
pop ebp
pop ebx
mov dword [eax], 1
xor eax, eax
add esp, 0x420
ret
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
mov edx, eax
add esp, 8
test edx, edx
je 0x1004c354
inc edx
jmp 0x1004c358
lea edx, [esp + 0x30]
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x43c]
cmp eax, 0x169c
je 0x1004c3ad
cmp eax, 0x179c
je 0x1004c383
cmp eax, 0x2348
je 0x1004c3ad
jmp 0x1004c3d3
mov eax, dword [str.userinitxx.exe]
mov ecx, dword [0x10265394]
mov dword [esp + 0x10], eax
mov eax, dword [0x10265398]
mov dword [esp + 0x14], ecx
mov cx, word [0x1026539c]
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
jmp 0x1004c3d3
mov eax, dword [str.ws2helpXP.dll]
mov ecx, dword [0x10265384]
mov dword [esp + 0x10], eax
mov eax, dword [0x10265388]
mov dword [esp + 0x14], ecx
mov cl, byte [0x1026538c]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov byte [edx], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x30]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x30]
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x107ab964]
push edx
mov eax, dword [ecx]
call dword [eax]
pop edi
pop esi
test eax, eax
je 0x1004c428
pop ebp
mov eax, 1
pop ebx
add esp, 0x420
ret
lea eax, [esp + 0x28]
push 0x80
push eax
call ebp
mov ecx, dword [0x107ab964]
lea eax, [esp + 0x28]
push 0x180
push eax
mov edx, dword [ecx]
call dword [edx + 0x38]
mov ecx, dword [0x107ab964]
lea eax, [esp + 0x28]
push ebx
push eax
mov edx, dword [ecx]
call dword [edx + 0x4c]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop ebp
mov eax, ecx
pop ebx
add esp, 0x420
ret
Function at 0x1004c470
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x400
or ecx, 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [esp + 0x408]
push ebp
mov ebp, dword [esp + 0x410]
push edi
mov edi, ebx
mov dword [ebp], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x400
jb 0x1004c4ac
pop edi
pop ebp
pop ebx
add esp, 0x400
ret
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x2e
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
pop esi
je 0x1004c4e8
mov byte [eax], 0
lea edx, [esp + 0xc]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [0x107ab964]
push ebp
push ebx
push eax
call fcn.1002bac0
add esp, 0xc
test eax, eax
jne 0x1004c51a
push ebx
push 0x10227334
call fcn.10029940
add esp, 8
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x400
ret
Function at 0x1004f680
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x109c
call fcn.102244a0
mov ecx, dword [0x107ab964]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10ac]
mov eax, dword [ecx]
push edi
push esi
call dword [eax + 0x20]
mov ebp, eax
test ebp, ebp
jle 0x1004f80f
mov edx, dword [0x107ab964]
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4c]
push ecx
push esi
push edx
call fcn.1000fc50
add esp, 0xc
test eax, eax
je 0x1004f80f
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], eax
push ecx
mov byte [esp + 0x24], al
mov eax, dword [0x107ab964]
push edx
push esi
push eax
call fcn.10010a00
add esp, 0x10
test eax, eax
je 0x1004f80f
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0xb0]
push ecx
mov ecx, dword [0x107ab964]
push edx
push 0x1000
push 0x1000
push eax
push ebp
push esi
push ecx
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x1004f80f
cmp dword [esp + 0x14], 0x1000
jne 0x1004f80f
xor edx, edx
xor esi, esi
xor edi, edi
mov byte [esp + 0x13], 0
xor eax, eax
mov bl, 0xb8
cmp edx, 2
jge 0x1004f81c
mov ecx, edx
sub ecx, 0
je 0x1004f7b0
dec ecx
jne 0x1004f803
cmp word [esp + eax + 0xac], 0x48a
jne 0x1004f803
cmp word [esp + eax + 0xae], 0x340e
jne 0x1004f803
cmp word [esp + eax + 0xb1], 0x188
jne 0x1004f803
mov dl, byte [esp + eax + 0xb0]
mov byte [esp + 0x13], dl
mov edx, 2
jmp 0x1004f803
cmp word [esp + eax + 0xac], 0x45c7
jne 0x1004f803
cmp dword [esp + eax + 0xaf], 0x657865
jne 0x1004f803
cmp byte [esp + eax + 0xb3], bl
jne 0x1004f803
cmp word [esp + eax + 0xb8], 0x4589
jne 0x1004f803
cmp byte [esp + eax + 0xbb], bl
jne 0x1004f803
cmp byte [esp + eax + 0xc3], bl
jne 0x1004f803
mov esi, dword [esp + eax + 0xbc]
mov edi, dword [esp + eax + 0xb4]
mov edx, 1
inc eax
cmp eax, 0xfb0
jl 0x1004f763
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x109c
ret
cmp eax, 0xfb0
jge 0x1004f80f
cmp edx, 2
jne 0x1004f80f
test esi, esi
jbe 0x1004f80f
mov eax, dword [esp + 0x84]
cmp eax, esi
jbe 0x1004f80f
test edi, edi
je 0x1004f80f
cmp eax, edi
jbe 0x1004f80f
lea eax, [esp + 0x14]
mov edx, dword [0x107ab964]
push 0
lea ecx, [esp + 0xb0]
push eax
push ecx
push 0x1000
push 0x1000
push esi
mov esi, dword [esp + 0x10c8]
push ebp
push esi
push edx
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x1004f80f
cmp dword [esp + 0x14], 0x1000
jne 0x1004f80f
xor eax, eax
mov cl, byte [esp + 0x13]
mov bl, byte [esp + eax + 0xac]
xor bl, cl
mov byte [esp + eax + 0xac], bl
inc eax
cmp eax, 0x1000
jb 0x1004f881
lea edx, [esp + 0xac]
push 0x1000
push edx
call fcn.1000ba10
add esp, 8
test eax, eax
je 0x1004f80f
mov eax, dword [0x107ab964]
push edi
push esi
push eax
call fcn.10029b30
add esp, 0xc
test eax, eax
je 0x1004f80f
mov eax, dword [esp + 0x38]
mov ecx, dword [0x107ab964]
sub ebp, eax
push ebp
push eax
push esi
push ecx
call section..text
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x109c
ret