joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f081ee3
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x7f081e6c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x7f081e8a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x7f081ee8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x7f081ecf
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x7f081ed8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x7f081ee2
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x7f081ec4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x7f081e4e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x7f081f35
dec eax
je 0x7f081f2c
sub eax, 3
je 0x7f081f23
mov dword [ebp - 4], 0x40
jmp 0x7f081f52
mov dword [ebp - 4], 4
jmp 0x7f081f38
mov dword [ebp - 4], 0x20
jmp 0x7f081f38
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x7f081f84
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x7f081f04
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.7f081795
retf
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x7f08262a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx], ch
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.7f081795
xor dword [ecx + 0x5b], esp
xchg esp, eax
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x43b64a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
or edx, edx
push 0x6ea7e480
pop esi
sub edx, edx
call fcn.0043b686
dec esi
mov esi, edx
xor dword [edi], eax
sub edx, edx
add edx, edx
inc edi
add edx, esi
dec edx
mov esi, 0x550d7870
cmp edi, ebx
jne fcn.0043b64a
or esi, esi
or esi, esi
ret
Function at 0x402d40
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp], 0
push eax
push 2
push 0
push 0x4020e4
push 0x80000002
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x402d99
mov edx, dword [esp]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push eax
push 0x402158
push edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
add esp, 8
ret
Function at 0x4030e0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401246
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401200
mov edx, dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.MSVBVM60.DLL___vbaStrCopy]
push 3
lea eax, [ebp - 0x30]
push 0x402198
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaAryConstruct2]
call fcn.00402d40
mov ecx, dword [ebp - 0x18]
or ebx, 0xffffffff
push ecx
push esi
mov word [0x40406c], si
mov word [0x40406e], bx
mov dword [0x404070], esi
mov word [0x404074], si
mov dword [0x404078], ebx
mov word [0x40407c], si
call dword [sym.imp.MSVBVM60.DLL_rtcBstrFromAnsi]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrMove]
mov edx, eax
lea ecx, [ebp - 0x40]
call edi
push eax
call dword [sym.imp.MSVBVM60.DLL___vbaStrCat]
mov edx, eax
mov ecx, 0x404024
call edi
lea ecx, [ebp - 0x40]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
mov edx, dword [0x404024]
push edx
call dword [sym.imp.MSVBVM60.DLL_VarPtr]
push 0x402f00
mov dword [0x404028], eax
mov dword [0x404030], eax
call fcn.00402da0
mov edi, dword [sym.imp.KERNEL32.DLL_CreateEventW]
push esi
push esi
push 1
push esi
mov dword [0x404034], eax
mov dword [0x404038], esi
mov dword [0x40403c], esi
call edi
push esi
push esi
push 1
push esi
mov dword [0x404060], eax
call edi
push esi
push esi
push 1
push esi
mov dword [0x404068], eax
call edi
mov ecx, dword [0x404060]
mov dword [0x404064], eax
cmp ecx, esi
je 0x40326d
cmp dword [0x404068], esi
je 0x40326d
cmp eax, esi
je 0x40326d
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], esi
push eax
push 4
push esi
push 0x403050
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, esi
mov dword [0x40402c], eax
je 0x403272
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov ecx, dword [ebp - 0x24]
mov edx, dword [0x40402c]
push ebx
push esi
mov dword [ecx], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x404064]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x24]
push edx
push 2
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
cmp eax, 1
jne 0x40326d
push 4
mov word [0x40406c], bx
mov word [0x40406e], si
call fcn.00402db0
mov eax, dword [0x40402c]
cmp word [0x40406c], si
jne 0x40329e
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call esi
mov eax, dword [0x404060]
push eax
call esi
mov ecx, dword [0x404068]
push ecx
call esi
mov edx, dword [0x404064]
push edx
call esi
mov eax, dword [0x40406c]
push 0x4032e1
not eax
mov word [0x40406e], ax
mov ecx, dword [0x40406c]
mov dword [ebp - 0x3c], ecx
jmp 0x4032c5
lea ecx, [ebp - 0x18]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
lea eax, [ebp - 0x44]
lea edx, [ebp - 0x30]
push eax
push 0
mov dword [ebp - 0x44], edx
call dword [sym.imp.MSVBVM60.DLL___vbaAryDestruct]
ret
Function at 0x403300
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
xor esi, esi
mov dword [esp + 0xc], eax
mov ecx, 5
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov word [esp + 0x10], ax
call dword [sym.imp.MSVBVM60.DLL___vbaUI1I4]
lea ecx, [esp + 4]
mov byte [esp + 0x11], al
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
mov ecx, 2
call dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
lea edx, [esp + 0x30]
push eax
push edx
call dword [sym.imp.ADVAPI32.DLL_AllocateAndInitializeSid]
test eax, eax
je 0x403384
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.DLL_CheckTokenMembership]
test eax, eax
je 0x403379
mov ecx, dword [esp + 8]
xor edx, edx
cmp ecx, esi
setne dl
neg edx
mov esi, edx
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_FreeSid]
mov ax, si
pop esi
add esp, 0x10
ret
Function at 0x409ec4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409f97
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409fb0
push ebx
push 0x409fbc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409f44
mov al, 0x6a
call fcn.00409b20
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409e98
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409f4d
call fcn.00409e98
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409f9e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x40a050
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a104
jmp 0x40a0f9
cmp dword [esi + 0x10], 0x1000
jne 0x40a0e5
test byte [esi + 0x15], 1
jne 0x40a0e5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40a0a4
cmp eax, 2
je 0x40a0a4
cmp eax, 0x10
je 0x40a0a4
cmp eax, 0x20
jne 0x40a0b9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40a0b9
mov bl, 1
xor ebp, ebp
jmp 0x40a0ca
mov eax, dword [esi]
add eax, ebp
call fcn.0040a048
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40a0bd
test bl, bl
je 0x40a0e5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a104
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40a07c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x105e37b0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x105e399d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x363000]
push edi
or ebp, 0xffffffff
jmp 0x105e37da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x105e37e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105e37d0
mov eax, 1
add ebx, ebx
jne 0x105e37f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x105e3804
jne 0x105e3823
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105e3823
dec eax
add ebx, ebx
jne 0x105e3810
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x105e37e8
add ebx, ebx
jne 0x105e381f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x105e3875
xor ecx, ecx
sub eax, 3
jb 0x105e383b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x105e38aa
sar eax, 1
mov ebp, eax
jmp 0x105e3846
add ebx, ebx
jne 0x105e3846
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105e3814
inc ecx
add ebx, ebx
jne 0x105e3854
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105e3814
add ebx, ebx
jne 0x105e3861
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x105e3856
jne 0x105e3872
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x105e3856
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x105e3894
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x105e3886
jmp 0x105e37d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x105e3894
add edi, ecx
jmp 0x105e37d6
pop esi
mov edi, esi
mov ecx, 0x6ef8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x105e38b2
cmp byte [edi], 0x2d
jne 0x105e38b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x105e38b7
lea edi, [esi + 0x5d8000]
mov eax, dword [edi]
or eax, eax
je 0x105e392f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5f038c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5f04bc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x105e38e4
mov ecx, edi
jns 0x105e3913
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5f04c0]
or eax, eax
je 0x105e3929
mov dword [ebx], eax
add ebx, 4
jmp 0x105e3901
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x105e3960
cmp al, 0xef
ja 0x105e3953
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x105e3935
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x105e3942
mov ebp, dword [esi + 0x5f04c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x105e3994
sub esp, 0xffffff80
jmp 0x10106942
Function at 0x10003591
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*8 + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
jmp 0x100035e4
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x10003629
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x14], edx
push dword [ebp - 0x14]
push dword [ebp + 0x14]
call fcn.1000353e
pop ecx
pop ecx
cmp eax, dword [ebp + 0x10]
jne 0x10003627
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*4]
mov eax, edx
jmp 0x1000362b
jmp 0x100035dd
xor eax, eax
leave
ret

Function at 0x1000362d
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x10003696
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x30]
call fcn.10003140
pop ecx
cmp dword [ebp + 8], eax
jne 0x1000368c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
jmp 0x10003698
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x10003665
xor eax, eax
leave
ret

Function at 0x10024fbe
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test edx, edx
jle 0x10024fec
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
shr esi, 8
xor esi, edi
shl eax, 8
and esi, 0xff
xor ax, word [esi*2 + 0x10097400]
dec edx
inc ecx
movzx eax, ax
test edx, edx
jg 0x10024fc6
pop edi
pop esi
ret
Function at 0x10025084
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push ebx
mov dword [ebp - 4], edi
call fcn.100827f2
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, edi
jne 0x100250fb
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100250ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
push 5
jmp 0x10025140
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x100250ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100250c6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add dword [edi], 0xffffffd4
xor eax, eax
jmp 0x10025141
push ebx
call fcn.1008379f
mov dword [esi], eax
cmp eax, edi
jne 0x10025138
push ebx
lea eax, [ebp - 4]
push eax
call fcn.10082f6a
mov dword [esi], eax
cmp eax, edi
jne 0x100250c6
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.100833a6
mov dword [esi], eax
cmp eax, edi
je 0x1002512b
push 5
pop edi
lea eax, [ebp - 4]
push eax
call fcn.10083182
mov eax, edi
jmp 0x10025141
mov dword [esi], 0x32
push 0x16
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1002514d
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push ebx
mov dword [ebp - 4], edi
call fcn.100827f2
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, edi
jne 0x100251c4
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10025193
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
push 5
jmp 0x10025209
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [ebp + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x100251b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002518f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add dword [edi], 0xffffffd4
xor eax, eax
jmp 0x1002520a
push ebx
call fcn.1008379f
mov dword [esi], eax
cmp eax, edi
jne 0x10025201
push ebx
lea eax, [ebp - 4]
push eax
call fcn.10082f6a
mov dword [esi], eax
cmp eax, edi
jne 0x1002518f
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.1008345c
mov dword [esi], eax
cmp eax, edi
je 0x100251f4
push 5
pop edi
lea eax, [ebp - 4]
push eax
call fcn.10083182
mov eax, edi
jmp 0x1002520a
mov dword [esi], 0x32
push 0x16
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100252b0
Capabilities:
Check os version
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x149c
call fcn.10062090
mov eax, dword [0x1009a008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1009c300], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x149c], eax
jne 0x100252e2
xor eax, eax
jmp 0x100254f8
push ebx
mov ebx, 0x400
cmp dword [ebp + 0xc], ebx
jae 0x100252f4
push 2
jmp 0x100253e8
push esi
push edi
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.100620c0
push 0x20100110
push 0x100016d8
lea eax, [ebp - 0x1004]
push 0x10001698
push eax
call fcn.10062ada
lea edi, [ebp - 0x1004]
add esp, 0x1c
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002532e
push 0x12
pop ecx
mov esi, 0x10001650
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1004]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10025347
push 0x10
pop ecx
mov esi, 0x10001608
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1004]
push eax
push 0x10001604
movsw word es:[edi], word [esi]
call fcn.10036ff6
push ebx
push dword [ebp - 0x149c]
lea eax, [ebp - 0x1498]
push eax
call fcn.10062770
add esp, 0x14
pop edi
xor eax, eax
pop esi
mov cx, word [ebp - 0x1498]
xor word [ebp + eax*2 - 0x1496], cx
inc eax
cmp eax, 0x1ff
jb 0x10025386
mov edx, 0x3fe
lea ecx, [ebp - 0x1496]
call fcn.10024fbe
cmp ax, word [ebp - 0x1498]
je 0x100253c5
mov ebx, 0x100015b0
call fcn.10025216
jmp 0x1002548c
cmp dword [ebp - 0x109c], 0x20100110
je 0x100253ee
push 0x10001528
call fcn.10036ff6
pop ecx
mov ebx, 0x100014a8
call fcn.10025216
push 0x15
pop eax
jmp 0x100254f7
movzx eax, word [ebp - 0x1496]
test eax, eax
jl 0x10025454
cmp eax, 0xb
jle 0x1002543d
cmp eax, 0xc
je 0x1002542c
cmp eax, 0xd
je 0x10025425
cmp eax, 0xe
je 0x1002541e
cmp eax, 0xf
jne 0x10025454
push 0x10001450
call fcn.10036ff6
jmp 0x10025460
push 0x100013f8
jmp 0x10025417
push 0x100013a8
jmp 0x10025417
push 0x10001350
call fcn.10036ff6
mov ebx, 0x100012f8
jmp 0x1002544c
push 0x10001280
call fcn.10036ff6
mov ebx, 0x10001210
pop ecx
call fcn.10025216
jmp 0x10025461
push eax
push 0x100011a0
call fcn.10036ff6
pop ecx
pop ecx
lea eax, [ebp - 0x1190]
push eax
lea eax, [ebp - 0x1490]
push eax
push dword [ebp - 0x1494]
push 0x10001174
call fcn.10036ff6
push 0x10001110
call fcn.10036ff6
add esp, 0x14
lea eax, [ebp - 0x1098]
push eax
mov dword [ebp - 0x1098], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x1094], 5
jae 0x100254c5
push dword [ebp - 0x1090]
push dword [ebp - 0x1094]
push 0x100010d4
call fcn.10036ff6
add esp, 0xc
call fcn.10082dec
call fcn.1003730c
test eax, eax
je 0x100254e2
push eax
push eax
push 0x10001070
call fcn.10036ff6
add esp, 0xc
movzx eax, word [ebp - 0x1496]
mov dword [0x10097638], eax
mov byte [0x1009c300], 1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10062074
leave
ret 8
Function at 0x100262e1
Capabilities:
Get file size

Disassembly:
push 0x24
mov eax, 0x10087b90
call fcn.1006301c
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
xor esi, esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1002635a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x28]
push eax
push eax
push dword [ebp + 0xc]
mov dword [ecx], eax
push 0x10001770
push dword [ebp + 0x24]
push dword [ebp + 0x20]
call fcn.100631a3
add esp, 0x18
push 5
pop eax
jmp 0x100263ca
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10026394
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x28]
push eax
push eax
push esi
push edi
push 0x10001700
push dword [ebp + 0x24]
mov dword [ecx], eax
push dword [ebp + 0x20]
call fcn.100631a3
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10026355
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x7c0
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
push dword [ebp + 0x18]
mov eax, dword [ecx]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 2
push 0x100016f0
push dword [ebp + 0xc]
call dword [eax + 0x28]
mov eax, dword [ebp - 0x14]
call fcn.100630d0
ret 0x24