joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013071
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10013084
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x1001308c
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ebp
ret

Function at 0x1001432e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10014349
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10014428
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x1001439b
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x1001439b
and dword [ebp - 0x18], 0
jmp 0x100143a2
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x100143ed
mov eax, dword [ebp - 0x34]
cmp dword [eax], 0xa12a
jg 0x100143c6
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x100143c6
mov dword [ebp - 0xc], 1
jmp 0x100143ca
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 6
je 0x100143d9
mov dword [ebp - 0x10], 1
jmp 0x100143dd
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x10]
jne 0x100143ed
and dword [ebp - 0x14], 0
jmp 0x100143f4
mov dword [ebp - 0x14], 1
push 1
mov ecx, dword [ebp - 0x38]
call fcn.100167dc
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
lea ecx, [edx + ecx + 4]
cmp dword [eax], ecx
jge 0x10014415
mov dword [ebp - 0x1c], 1
jmp 0x10014419
and dword [ebp - 0x1c], 0
push 2
mov ecx, dword [ebp - 0x3c]
call fcn.100167dc
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001461f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001464b
push 0
push 0
push 0
push 0
push 0x24fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10014662
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1001638e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10016483
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax], 0x8f9e
cmp eax, 0xcadd
jne 0x100163fd
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffffe
jbe 0x100163e5
mov dword [ebp - 0xc], 1
jmp 0x100163e9
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0xfffb
jae 0x100163fd
xor eax, eax
inc eax
jne 0x100163fd
and dword [ebp - 0x10], 0
jmp 0x10016404
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jg 0x10016417
mov dword [ebp - 0x14], 1
jmp 0x1001641b
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jg 0x1001642e
mov dword [ebp - 0x18], 1
jmp 0x10016432
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
je 0x10016445
mov dword [ebp - 8], 1
jmp 0x10016449
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
imul eax, dword [ebp - 8], 0x890f
test eax, eax
je 0x1001646e
mov eax, 0xc554
test eax, eax
je 0x1001646e
mov dword [ebp - 0x1c], 1
jmp 0x10016472
and dword [ebp - 0x1c], 0
push 0
mov ecx, dword [ebp - 0x30]
call fcn.100167dc
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x100164b6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x100164b6
push 0
push 0
push 0
push 0
push 0x24fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x1001b632
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001b68d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001b66e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1001b68b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100167dc
mov dword [eax], 0xdb3ae355
jmp 0x1001b663
jmp 0x1001b6ab
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001b6ab
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x1001bbbb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001bbcf
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x1001bbf8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001bbf8
push 0
push 0
push 0
push 0
push 0x24fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x1001bf2b
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001bf86
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001bf67
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1001bf84
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100167dc
mov dword [eax], 0xfbce008f
jmp 0x1001bf5c
jmp 0x1001bf8e
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret

Function at 0x1001c0fa
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001c155
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001c136
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001c153
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100167dc
mov dword [eax], 0xfffffffd
jmp 0x1001c12b
jmp 0x1001c164
push 0xb01
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esp, ebp
pop ebp
ret
Function at 0x1001c411
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001c454
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001c452
push 0
push 0
push 0
push 0
push 0x24fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1001c4a7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 0x14651886
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1002777d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100277aa
push 0
push 0
push 0
push 0
push 0x24fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x100277f5
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100277d8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x100277f5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100167dc
mov dword [eax], 0xe83c773
jmp 0x100277cd
mov esp, ebp
pop ebp
ret
Function at 0x1002adc6
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002ae1b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 2
jmp 0x1002adf6
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x1002ae19
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002ae17
push 0x15dd
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1002adeb
jmp 0x1002ae21
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esp, ebp
pop ebp
ret

Function at 0x1002b794
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002b7ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
jmp 0x1002b7cb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002b7cb
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret
Function at 0x1002ed37
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002ed72
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ecx + 0x34], eax
jmp 0x1002ed8f
push 0
push 0
push 0
push 0
push 0x24fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x1002f1e8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x28af
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 0x2b3e
call fcn.1002f02b
add esp, 0x14
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002f222
xor eax, eax
jmp 0x1002f376
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0x61de
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.1002f088
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f24f
xor eax, eax
jmp 0x1002f376
push 0x4105
push 0x4da4
lea eax, [ebp - 0xc]
push eax
push 0x415
push 1
lea eax, [ebp - 8]
push eax
call fcn.1002f0fc
add esp, 0x18
cmp dword [ebp - 0xc], 0
jne 0x1002f27d
xor eax, eax
jmp 0x1002f376
lea eax, [ebp - 0x24]
push eax
push 0x131b
push 0x98
push 0x5c11
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x77d0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 1
call fcn.1002ed93
add esp, 0x28
push dword [ebp - 4]
push dword [ebp - 8]
push 0
push dword [ebp + 8]
call fcn.1002b90d
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002f2de
push 1
push dword [ebp - 0x14]
push dword [ebp - 4]
call fcn.10028171
add esp, 0xc
push dword [ebp - 4]
call fcn.1002e88d
pop ecx
test eax, eax
jne 0x1002f2f2
xor eax, eax
jmp 0x1002f376
push 0x6dfe
push 0x49c1
push 0x3325
push 0
push dword [ebp - 4]
call fcn.100294c6
add esp, 0x14
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f35e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002f32d
xor eax, eax
jmp 0x1002f376
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002f346
xor eax, eax
jmp 0x1002f376
push 1
push 0x1d30
lea eax, [ebp - 4]
push eax
push 0x7638
call fcn.1002f171
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002f36f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002f373
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10047684
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100476b1
push 0
push 0
push 0
push 0
push 0x24fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x100476f9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100476df
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100476f9
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100167dc
or dword [eax], 0xffffffff
jmp 0x100476d4
mov esp, ebp
pop ebp
ret

Function at 0x100476fd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10047748
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
shl eax, 2
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
sub ecx, eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax + 0x20], ecx
jmp 0x1004777b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1004777b
push 0
push 0
push 0
push 0
push 0x24fb
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x1004791d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100479c2
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], 0
jmp 0x10047979
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax]
jge 0x100479c0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 4]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov esi, dword [ebp - 8]
add edx, dword [esi]
mov esi, dword [ebp - 0x10]
mov esi, dword [esi]
mov ax, word [ecx + eax]
mov word [esi + edx], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x10047972
jmp 0x100479ca
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10079865
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008438c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006a794
mov dword [ebp - 0x14], eax
cmp dword [0x1073432c], esi
jne 0x10079958
push 0x800
push esi
push 0x1000793c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100798e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10079a38
push esi
push esi
push 0x1000793c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10079a38
push 0x10007954
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10079a38
push eax
call ebx
push 0x10007960
push edi
mov dword [0x1073432c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007970
push edi
mov dword [0x10734330], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007984
push edi
mov dword [0x10734334], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1073433c], eax
test eax, eax
je 0x10079955
push 0x100079a0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10734338], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007997d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10079970
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10079992
push 4
pop eax
jmp 0x10079a3a
cmp dword [ebp - 0x14], esi
je 0x10079992
push dword [0x1073432c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10079977
mov eax, dword [0x10734338]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100799f0
cmp dword [0x1073433c], edi
je 0x100799f0
push eax
call ebx
push dword [0x1073433c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100799f0
test eax, eax
je 0x100799f0
call ecx
test eax, eax
je 0x100799e5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100799e5
test byte [ebp - 8], 1
jne 0x100799f0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10079a20
mov eax, dword [0x10734330]
cmp eax, edi
je 0x10079a1d
push eax
call ebx
test eax, eax
je 0x10079a1d
call eax
mov esi, eax
test esi, esi
je 0x10079a1d
mov eax, dword [0x10734334]
cmp eax, edi
je 0x10079a1d
push eax
call ebx
test eax, eax
je 0x10079a1d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1073432c]
call ebx
test eax, eax
je 0x10079a38
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10079a3a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x40657c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4065a0
xor eax, eax
test eax, eax
je 0x4065b3
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4065b3
xor ecx, ecx
jmp 0x4065b6
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
mov ecx, 0x46f569e0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x243a114a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x1c754c6c
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x2f2022e
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
popal
nop
nop
nop
nop
nop
jmp loc.00401219