joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10c4580
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push esi
mov esi, dword [edx]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x10c29a0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10c45b3
mov edx, dword [esi + 0x1bc]
push eax
call edx
pop esi
pop ebp
ret 4

Function at 0x10c51c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
push edi
push 6
push eax
call fcn.010a5800
cmp dword [ebp + 0xc], 0
mov dword [esi + 0x2a16c], eax
mov dword [esi + 0x2a168], 0
jne 0x10c521b
cmp dword [esi + 0x407c], 0
jne 0x10c521b
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push 0x3e8
call edi
call ebx
cmp eax, 0x57e40
ja 0x10c521a
cmp dword [esi + 0x407c], 0
je 0x10c5201
pop ebx
mov ecx, dword [esi + 8]
mov edi, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10c50d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10c5243
push eax
mov eax, dword [edi + 0x1bc]
call eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x10c5250
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp dword [eax + 0x25398], 0
je 0x10c5351
or dword [eax + 0x2a16c], 2
mov ecx, dword [eax + 0x2a16c]
mov eax, dword [eax + 8]
push edi
push ecx
push 6
push eax
call fcn.010a5880
mov edi, dword [esi]
mov ecx, dword [edi + 8]
push 6
push ecx
call fcn.010a5800
mov dword [edi + 0x2a16c], eax
test al, 2
je 0x10c52b1
push edi
push 0x10b0540
push edi
call fcn.0104e8f0
push edi
push 0x10afdb0
push edi
call fcn.0104e8f0
mov edi, dword [esi + 4]
push ebx
push 0x2000
call fcn.0101c4b0
lea ebx, [eax*4 + 8]
lea edx, [ebx + edi]
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x2000
push edi
call fcn.01087c30
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x424]
call eax
mov ecx, dword [esi + 4]
add ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov eax, dword [esi]
push eax
push 0x10ae580
push eax
call fcn.0104e8f0
mov edx, dword [esi]
push 1
add edx, 0x27ce8
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov eax, dword [esi]
mov edi, dword [esi + 4]
lea ecx, [ebp + 8]
push ecx
push 0
push eax
push 0x1082710
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebx
test eax, eax
je 0x10c5342
mov edx, dword [edi + 0x1bc]
push eax
call edx
mov eax, dword [esi]
push esi
push 0x10ae550
push eax
call fcn.0104e8f0
pop edi
pop esi
pop ebp
ret 8
Function at 0x10c7420
Capabilities:
Enumerate gui resources
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.010c7350
mov eax, dword [esi]
mov ecx, dword [eax]
push 0
push ecx
call fcn.01099330
mov edx, dword [esi]
mov eax, dword [edx]
cmp dword [eax + 0x26a8c], 6
jb 0x10c7466
mov eax, dword [eax + 0x25c]
test eax, eax
je 0x10c7466
cmp eax, fcn.0101b180
je 0x10c7466
lea ecx, [esi + 0x2fb58]
push ecx
call eax
mov eax, dword [esi + 0x2fb58]
mov ecx, dword [esi + 0x2fb5c]
mov edx, eax
or edx, ecx
jne 0x10c7490
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [eax + 0x2f758]
mov dword [esi + 0x2fb58], ecx
mov edx, dword [eax + 0x2f75c]
jmp 0x10c74a4
push 0
push 0x400
push ecx
push eax
call fcn.01121780
mov dword [esi + 0x2fb58], eax
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x2e9d4]
mov edi, 0x3f
push ecx
mov dword [esi + 0x2fb5c], edx
mov dword [ebp + 8], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [ebp + 8]
push edx
lea eax, [esi + 0x2ea56]
push eax
push 3
mov dword [ebp + 8], edi
call sub.Secur32.dll_GetUserNameExW
mov ecx, dword [esi]
mov edx, dword [ecx]
push edx
call fcn.010883f0
mov dword [esi + 0x2ead8], eax
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
call fcn.010882f0
mov dword [esi + 0x2eadc], eax
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [esi + 0x2fafc]
push edx
push ecx
call fcn.0101c620
mov edx, dword [esi]
mov eax, dword [edx]
lea ecx, [eax + 0x26a42]
push ecx
push eax
call fcn.0108c6b0
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x43
call edi
mov edx, dword [esi]
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x2fb00], eax
mov eax, dword [edx]
mov ecx, dword [eax + 0x12c]
call ecx
mov edx, dword [esi]
push 0x1015954
push 0x1015940
mov word [esi + 0x2fb04], ax
mov eax, dword [edx]
push DirectSoundEnumerateW
push eax
call fcn.01089830
push esi
push 0x105e120
mov dword [esi + 0x2eae0], eax
call dword [sym.imp.USER32.dll_EnumWindows]
push 0
call edi
push 1
mov dword [esi + 0x2fb48], eax
call edi
push 0
mov dword [esi + 0x2fb4c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x10c75a8
push 0xc
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edi
push 0
mov dword [esi + 0x2fb50], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esi]
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x26b28]
xor edi, edi
neg eax
sbb eax, eax
and eax, 0x100
push eax
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0x101592c
push 0x10158b8
push DirectSoundEnumerateW
push ecx
call fcn.010895a0
test eax, eax
je 0x10c75f1
mov edi, dword [eax]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov dword [esi + 0x2fb54], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10c99c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
mov dword [ebp - 8], 0
jne 0x10c9a03
lea ebx, [ebx]
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x10c9a03
mov ecx, dword [ebp + 0x18]
cmp dword [ecx], 0
je 0x10c9a03
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0x128]
push 0xa
call eax
cmp dword [esi + 0x10], 0
je 0x10c99e0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp dword [esi + 0x10], 0
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ecx]
mov dword [ebp - 4], eax
jne 0x10c9b27
push edi
lea esp, [esp]
test ebx, ebx
je 0x10c9b20
mov edx, dword [esi + 0x18]
cmp dword [edx + 0x26d18], 0
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], 0
mov eax, 0x7000
jne 0x10c9a46
mov eax, dword [esi + 0x4c]
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 8]
push ecx
push eax
push edx
push 0
push ebx
push esi
call fcn.010c9890
mov edi, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10c9a7c
push 0
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push 2
push edi
push ebx
push eax
push esi
call ecx
test edi, edi
jne 0x10c9a7c
mov edi, eax
mov ebx, edi
cmp dword [ebp - 0xc], edi
jne 0x10c9b00
mov edx, dword [ebp + 0x18]
cmp dword [edx], 0
jne 0x10c9ae5
mov eax, dword [esi + 0x18]
cmp dword [eax + 0x26d18], 0
mov dword [ebp - 8], 1
mov dword [ebp + 8], 0
mov eax, 0x7000
jne 0x10c9aad
mov eax, dword [esi + 0x4c]
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 8]
push ecx
push eax
push edx
push 1
push edi
push esi
call fcn.010c9890
mov ebx, eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10c9b09
push 0
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push 2
push ebx
push edi
push eax
push esi
call ecx
test ebx, ebx
jne 0x10c9b09
mov ebx, eax
jmp 0x10c9b09
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x927c0
jbe 0x10c9b09
test byte [esi + 0x3ac], 1
jne 0x10c9b20
jmp 0x10c9b09
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 4], eax
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0x128]
push 0xa
call eax
cmp dword [esi + 0x10], 0
je 0x10c9a20
cmp dword [ebp - 8], 0
pop edi
jne 0x10c9b4f
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
test eax, eax
je 0x10c9b4f
push 0
push 1
lea edx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
push edx
push eax
push esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0
call fcn.0108f500
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10cbe90
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x894
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
push 0x40
call fcn.0101c4b0
lea eax, [eax*4 + 8]
mov dword [ebp - 0xc], eax
add eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x40
push edi
call fcn.01087c30
push 0x2c
lea eax, [ebp - 0x48]
push 0
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [ebp + 0xc]
push 0x48
lea ecx, [ebp - 0x90]
push 0
push ecx
mov dword [ebp - 0x48], ebx
call sub.msvcrt.dll_memset
mov edx, dword [esi]
add esp, 0x18
push 0
mov ecx, ebx
and cl, 8
lea eax, [ebp - 4]
push eax
movzx eax, cl
neg eax
sbb eax, eax
and eax, 0x10000
push 0
add eax, 0x10000
push eax
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x90], 0x44
mov ecx, dword [edx + 0x4fc]
push 2
call ecx
test eax, eax
je 0x10cc053
mov edx, dword [esi]
mov ecx, dword [ebp - 4]
mov edx, dword [edx + 0x500]
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0
push ecx
call edx
test eax, eax
je 0x10cc045
test bl, 0x40
jne 0x10cbf69
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
push eax
push ecx
call fcn.0101ca40
jmp 0x10cbf7a
test bl, 0x20
jne 0x10cbf7a
mov edx, dword [ebp + 8]
mov eax, dword [esi]
push edx
push eax
call fcn.0101caa0
lea ecx, [ebp - 0x48]
push ecx
push esi
call fcn.010368a0
push 0x802
lea edx, [ebp - 0x894]
push 0
push edx
mov edi, eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
push eax
push ebx
push 0x1009a0c
lea ecx, [ebp - 0x894]
push 0x3ff
push ecx
call fcn.0101e760
mov eax, dword [esi]
add esp, 0x20
cmp dword [eax + 0x26b28], 0
je 0x10cbfd5
mov eax, dword [eax + 0x58c]
lea edx, [ebp - 8]
push edx
call eax
test eax, eax
je 0x10cc045
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x90]
push edx
push 0
push 0
push 0x14
push 0
push 0
push 0
lea eax, [ebp - 0x894]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x10cc039
mov edx, dword [ebp - 0x1c]
push edx
push edi
call dword [sym.imp.KERNEL32.DLL_AssignProcessToJobObject]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x48]
push eax
push ebx
push ecx
push esi
call fcn.010b9a70
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov eax, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call edi
mov ecx, dword [ebp - 0x18]
push ecx
call edi
mov edx, dword [ebp - 8]
mov eax, dword [esi]
push edx
push eax
call fcn.0101bed0
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x508]
push edx
call eax
mov ecx, dword [esi]
add ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10ce020
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebp + 0x10]
xor eax, eax
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x803
push 8
xor esi, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10ce161
push ebx
push 9
push 0x100bfb4
push edi
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
add esp, 0xc
lea edx, [edi + 0x12]
push edx
push eax
call fcn.0101c710
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
push ecx
push edi
push ebx
call fcn.010cded0
mov esi, eax
test esi, esi
jne 0x10ce0d8
mov edi, edi
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push eax
push ecx
push edx
push edi
push ebx
call fcn.010cded0
mov esi, eax
test esi, esi
je 0x10ce0b0
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 0x28]
push ecx
push 0
mov dword [edx], edi
lea edx, [ebp - 0x20]
push edx
push 0x109d120
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
push 0
push 0
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp + 0x2c], eax
test eax, eax
je 0x10ce150
cmp eax, 0xffffffff
je 0x10ce150
push esi
push ebx
call fcn.010bb150
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.0101cb50
mov edx, dword [ebx]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [edx + 0x1bc]
push eax
call ecx
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x1c]
mov dword [edx], 0
mov dword [eax], 0
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x28

Function at 0x10cecc0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x10cecf7
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10cec70
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10ced1a
mov ecx, dword [esi + 0x1bc]
push eax
call ecx
pop esi
pop ebp
ret 8
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x10a1ee0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10ced1a
push eax
mov eax, dword [esi + 0x1bc]
call eax
pop esi
pop ebp
ret 8
Function at 0x10cf460
Capabilities:
Get file size
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
test esi, esi
je 0x10cf5af
cmp esi, 0xffffffff
je 0x10cf5af
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
test edi, edi
je 0x10cf594
mov dword [ebp - 4], edi
cmp edi, 0x100000
jb 0x10cf4c3
mov dword [ebp - 4], 0x100000
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x10cf507
mov edx, dword [ebp - 4]
push edx
push 0xcc
push ebx
call sub.msvcrt.dll_memset
mov ecx, dword [ebp - 4]
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
call fcn.010608a0
mov ebx, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
push 0
dec edi
push edi
push esi
call ebx
push 0
lea edx, [ebp - 8]
push edx
push 1
push 0x100e464
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x10cf594
push 0
push 0
push 0
push esi
call ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp edi, 0x280000
jbe 0x10cf54b
mov edi, 0x280000
jmp 0x10cf54f
test edi, edi
jbe 0x10cf594
xor eax, eax
cmp dword [ebp + 0x10], 1
setne al
lea eax, [eax + eax + 1]
mov dword [ebp + 0x10], eax
nop
mov eax, edi
sub eax, ecx
mov ebx, eax
cmp eax, 0x40000
jb 0x10cf572
mov ebx, 0x40000
mov ecx, dword [ebp + 0x10]
push ecx
push ebx
push esi
call fcn.01047380
test eax, eax
je 0x10cf588
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 8]
add ecx, ebx
mov dword [ebp - 8], ecx
cmp ecx, edi
jb 0x10cf560
mov ebx, dword [ebp + 8]
mov edx, dword [ebx]
mov eax, dword [edx + 0x204]
push esi
call eax
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x1bc]
push esi
call edx
jmp 0x10cf5b2
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebx]
push 1
push 0x80
push 2
push 0
push 0xc0000000
push eax
push edi
call fcn.010c8140
mov esi, eax
test esi, esi
je 0x10cf5f8
cmp esi, 0xffffffff
je 0x10cf5f8
mov edx, dword [edi + 0x260]
push 0
lea ecx, [ebp + 8]
push ecx
push 0xe
push 0x1017224
push esi
call edx
mov eax, dword [edi + 0x1bc]
push esi
call eax
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x10cf609
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.010bc3d0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10cf620
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push eax
call fcn.010c82b0
test eax, eax
je 0x10cf65c
push 0x20
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov edi, eax
test edi, edi
jne 0x10cf661
push esi
push ebx
call fcn.010b94d0
test eax, eax
je 0x10cf661
mov edi, 1
push esi
push ebx
call fcn.01034e30
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10d06c0
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 0x10172b8
push 0x1009bc4
add eax, 0x237a4
push eax
call fcn.01061570
mov esi, eax
test esi, esi
je 0x10d0740
cmp dword [ebp + 0xc], 0
je 0x10d0740
mov eax, dword [edi]
push esi
push eax
call fcn.010c82b0
test eax, eax
jne 0x10d0746
push ebx
push 0x10172a4
push 0x1009bc4
lea ecx, [edi + 0x68c]
push ecx
call fcn.01061570
mov ebx, eax
test ebx, ebx
je 0x10d073d
mov edx, dword [edi]
push ebx
push edx
call fcn.010c82b0
test eax, eax
je 0x10d0737
mov eax, dword [edi]
push esi
push eax
call fcn.01088210
push 0
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push ebx
call fcn.010608a0
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x10d1770
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xe8]
cmp ecx, 8
je 0x10d179a
cmp ecx, 0x11
jne 0x10d17c2
mov eax, dword [eax]
mov ecx, dword [eax + 0x24678]
push ecx
call fcn.010c4580
pop ebp
ret 4
push esi
mov esi, dword [eax + 4]
lea edx, [ebp + 8]
push edx
push 0
push eax
push 0x10c2cb0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x10d17c1
push eax
mov eax, dword [esi + 0x1bc]
call eax
pop esi
pop ebp
ret 4
Function at 0x10d31b0
Capabilities:
Create directory
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x298
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x2fd08]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
mov ecx, dword [edx + 0x23110]
lea ebx, [ebp - 8]
push ebx
push eax
push 0x104eea0
push 0
lea esi, [eax + 0x28350]
lea eax, [ebp - 4]
push eax
add ecx, 0x7dc
push ecx
push esi
push edx
mov dword [ebp - 4], 0
call fcn.0108b390
mov dword [ebp - 8], eax
test eax, eax
je 0x10d33a1
cmp dword [ebp - 4], 0
je 0x10d33a1
push 0x20a
lea ecx, [ebp - 0x298]
push 0
push ecx
call sub.msvcrt.dll_memset
push 0x82
lea edx, [ebp - 0x8c]
push 0
push edx
call sub.msvcrt.dll_memset
mov eax, dword [edi + 0x2fd08]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x298]
add esp, 0x18
call eax
push eax
push 0x10172d4
lea ecx, [ebp - 0x8c]
push 0x3f
push ecx
call fcn.0101e760
mov edx, dword [edi + 0x2fd08]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x294]
add esp, 0x10
lea edx, [ebp - 0x298]
push edx
push 0x103
call eax
push 0
lea ecx, [ebp - 0x298]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
cmp word [ebp - 0x8c], 0
lea eax, [ebp - 0x8c]
je 0x10d32ae
add eax, 2
cmp word [eax], 0
jne 0x10d32a5
lea edx, [ebp - 0x8c]
sub eax, edx
sar eax, 1
cmp word [ebp - 0x298], 0
mov ecx, eax
lea eax, [ebp - 0x298]
je 0x10d32d9
lea ebx, [ebx]
add eax, 2
cmp word [eax], 0
jne 0x10d32d0
lea ebx, [ecx + ecx]
lea ecx, [ebp - 0x298]
sub eax, ecx
sar eax, 1
add eax, eax
mov edi, eax
lea eax, [edi + ebx + 2]
test eax, eax
je 0x10d33a1
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10d33a1
push edi
lea edx, [ebp - 0x298]
push edx
push esi
call fcn.0101c010
lea eax, [esi + edi]
test eax, eax
je 0x10d3334
push ebx
lea ecx, [ebp - 0x8c]
push ecx
push eax
call fcn.0101c010
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x2fd08]
mov ebx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov eax, dword [eax]
push 1
push 0
push ecx
push ebx
push esi
push eax
call fcn.010c8310
test eax, eax
je 0x10d3391
mov edx, dword [edi + 0x2fd08]
mov eax, dword [edx + 8]
mov ecx, dword [eax]
push 0
push 5
push 0
push 0x64
push 0x1001868
push esi
push ecx
call fcn.01088d00
test eax, eax
je 0x10d338b
push 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push ebx
call fcn.010608a0
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10d4430
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x29c]
push ebx
push edi
call ecx
push eax
call dword [sym.imp.msvcrt.dll_srand]
mov ebx, dword [ebp + 0x14]
add esp, 4
test ebx, ebx
jne 0x10d4457
xor eax, eax
jmp 0x10d446d
cmp word [ebx], 0
mov eax, ebx
je 0x10d4469
nop
add eax, 2
cmp word [eax], 0
jne 0x10d4460
sub eax, ebx
sar eax, 1
lea edi, [eax + eax]
test edi, edi
je 0x10d44e4
lea eax, [edi + 1]
mov dword [ebp + 0x14], eax
test eax, eax
je 0x10d44e4
push esi
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10d44e3
call dword [sym.imp.msvcrt.dll_rand]
cdq
mov ecx, 0xff
idiv ecx
xor eax, eax
mov byte [esi], dl
test edi, edi
jbe 0x10d44bd
lea esp, [esp]
mov dl, byte [eax + ebx]
xor dl, byte [esi]
inc eax
mov byte [esi + eax], dl
cmp eax, edi
jb 0x10d44b0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push esi
push ecx
push edx
push eax
call fcn.010d4340
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10