joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4732a8
Capabilities:
Query or enumerate registry value

Disassembly:
push 4
mov eax, 0x474752
call fcn.0045feda
mov esi, dword [ebp + 8]
cmp esi, dword [0x4c2d00]
jne 0x4732c6
xor al, al
jmp 0x47339f
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x4732d7
xor ecx, ecx
cmp dword [0x4c2cfc], ecx
jmp 0x4732e2
mov eax, esi
call fcn.00473b25
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x4732bf
xor edi, edi
lea ecx, [ebp + 0xf]
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], edi
call fcn.00473b47
mov dword [ebp - 4], edi
movzx edi, bl
neg edi
sbb edi, edi
and edi, 2
xor ebx, ebx
jmp 0x473360
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x473316
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ebx, eax
call fcn.004733a7
test eax, eax
je 0x473385
push 0x1c04c2
xor ebx, ebx
push ebx
call main
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp + 8]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x4c2d08
mov dword [eax + 0x4aa988], ebx
call main
mov dword [ebp + 8], ebx
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
push ebx
or eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.00473435
mov ebx, eax
test ebx, ebx
je 0x47330a
jmp 0x473392
push dword [ebp + 8]
mov ecx, 0x4c2d08
call main
lea ecx, [ebp + 0xf]
call fcn.00473b68
test ebx, ebx
sete al
call fcn.0045ffb2
ret 8
Function at 0x473b89
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4747a8
call fcn.0045feda
mov esi, dword [ebp + 8]
cmp esi, dword [0x4c2d00]
jne 0x473ba7
xor eax, eax
jmp 0x473d0c
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
or edi, 0xffffffff
test ebx, ebx
jne 0x473bca
cmp dword [0x4c2cfc], ebx
je 0x473ccc
push 2
pop edi
jmp 0x473be4
cmp ebx, 1
jne 0x473ccc
mov eax, esi
call fcn.00473b25
test al, al
je 0x473ccc
xor edi, edi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x20], edi
call fcn.00473b47
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, edi
jmp 0x473c8f
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x473c18
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 2
mov edi, eax
jae 0x473c44
cmp dword [ebp - 0x1c], 1
je 0x473c41
cmp dword [ebp - 0x1c], 2
jne 0x473c44
push 2
pop edi
mov eax, edi
call fcn.004733a7
test eax, eax
je 0x473cac
push 0x1c0496
xor edi, edi
push edi
call main
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp - 0x10]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x4c2d08
mov dword [eax + 0x4aa988], edi
call main
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call fcn.00473435
mov edi, eax
test edi, edi
je 0x473c0c
jmp 0x473cbd
push dword [ebp - 0x10]
mov ecx, 0x4c2d08
call main
test edi, edi
je 0x473cd8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.00473b68
mov ecx, dword [ebp - 0x18]
inc ebx
cmp ebx, 2
jl 0x473bb2
jmp 0x473ce7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.00473b68
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x473d02
cmp dword [ebp - 0x1c], 2
je 0x473cfa
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x473d0a
push ecx
call main
jmp 0x473d08
push esi
call main
mov ecx, eax
mov eax, ecx
call fcn.0045ffb2
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10902080
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x109020a8
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esi + ecx*4]
sub edx, esi
mov esi, dword [edx + eax - 4]
xor dword [eax - 4], esi
sub eax, 4
sub ecx, 1
test ecx, ecx
jne 0x10902096
pop esi
ret

Function at 0x1090c260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
mov ebx, ecx
lea eax, [ebp - 0xa8]
push edi
push eax
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x3bc]
push eax
push dword [ebp + 8]
call fcn.1090bd10
lea edi, [ebx + 0x63c0]
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x1c], edi
lea esi, [ebp - 0x9a]
lea ecx, [ecx]
lea ecx, [ebp - 0xc]
lea eax, [esi - 0xa]
push ecx
push eax
call fcn.1090bf00
mov al, byte [edi - 1]
xor al, byte [ebp - 9]
mov dl, byte [edi + 1]
mov cl, byte [edi - 3]
xor cl, byte [ebp - 0xb]
xor dl, byte [ebp - 7]
mov bl, byte [edi - 4]
mov bh, byte [edi - 2]
xor bl, byte [ebp - 0xc]
mov byte [ebp + 0xb], al
mov al, byte [edi]
xor al, byte [ebp - 8]
xor bh, byte [ebp - 0xa]
movsx edi, al
mov byte [ebp - 1], dl
movsx edx, cl
mov eax, edx
movsx ecx, bl
sar eax, 4
and eax, 0xf
shl ecx, 4
or ecx, eax
shl edx, 8
mov eax, dword [ebp - 0x18]
and ecx, 0xfff
movzx eax, byte [ecx + eax + 0x13bc]
movsx ecx, byte [ebp + 0xb]
mov byte [ebp - 0x10], al
movzx eax, bh
mov ebx, dword [ebp - 0x18]
or edx, eax
and edx, 0xfff
shl ecx, 4
movzx eax, byte [edx + ebx + 0x23bc]
mov byte [ebp - 0xf], al
mov eax, edi
sar eax, 4
and eax, 0xf
shl edi, 8
or ecx, eax
and ecx, 0xfff
movzx eax, byte [ecx + ebx + 0x33bc]
mov ecx, ebx
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 1]
or edi, eax
and edi, 0xfff
movzx eax, byte [edi + ebx + 0x43bc]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1090be20
movzx eax, byte [esi - 0xa]
lea esi, [esi + 8]
mov byte [esi - 0xe], al
movzx eax, byte [esi - 0x11]
mov byte [esi - 0xd], al
movzx eax, byte [esi - 0x10]
mov byte [esi - 0xc], al
movzx eax, byte [esi - 0xf]
mov byte [esi - 0xb], al
movzx ecx, byte [esi - 0x16]
mov eax, dword [ebp - 0x14]
xor cl, al
mov byte [esi - 0xa], cl
movzx ecx, byte [esi - 0x15]
xor cl, ah
mov byte [esi - 9], cl
movzx eax, byte [esi - 0x14]
xor al, byte [ebp - 0x12]
mov byte [esi - 8], al
movzx eax, byte [esi - 0x13]
xor al, byte [ebp - 0x11]
mov byte [esi - 7], al
mov edi, dword [ebp - 0x1c]
add edi, 6
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
jne 0x1090c2a0
movzx eax, byte [ebp - 0x24]
push dword [ebp + 0xc]
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 0x23]
mov byte [ebp - 0xb], al
movzx eax, byte [ebp - 0x22]
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0x21]
mov byte [ebp - 9], al
movzx eax, byte [ebp - 0x28]
mov byte [ebp - 8], al
movzx eax, byte [ebp - 0x27]
mov byte [ebp - 7], al
movzx eax, byte [ebp - 0x26]
mov byte [ebp - 6], al
movzx eax, byte [ebp - 0x25]
mov byte [ebp - 5], al
lea eax, [ebx + 0xbbc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1090bd10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1090c420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
mov ebx, ecx
lea eax, [ebp - 0xa8]
push edi
push eax
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x3bc]
push eax
push dword [ebp + 8]
call fcn.1090bd10
lea edi, [ebx + 0x641a]
mov dword [ebp - 0x20], 0x10
lea esi, [ebp - 0x9a]
mov dword [ebp - 0x1c], edi
lea ecx, [ecx]
lea ecx, [ebp - 0xc]
lea eax, [esi - 0xa]
push ecx
push eax
call fcn.1090bf00
mov al, byte [edi - 1]
xor al, byte [ebp - 9]
mov dl, byte [edi + 1]
mov cl, byte [edi - 3]
xor cl, byte [ebp - 0xb]
xor dl, byte [ebp - 7]
mov bl, byte [edi - 4]
mov bh, byte [edi - 2]
xor bl, byte [ebp - 0xc]
mov byte [ebp + 0xb], al
mov al, byte [edi]
xor al, byte [ebp - 8]
xor bh, byte [ebp - 0xa]
movsx edi, al
mov byte [ebp - 1], dl
movsx edx, cl
mov eax, edx
movsx ecx, bl
sar eax, 4
and eax, 0xf
shl ecx, 4
or ecx, eax
shl edx, 8
mov eax, dword [ebp - 0x18]
and ecx, 0xfff
movzx eax, byte [ecx + eax + 0x13bc]
movsx ecx, byte [ebp + 0xb]
mov byte [ebp - 0x10], al
movzx eax, bh
mov ebx, dword [ebp - 0x18]
or edx, eax
and edx, 0xfff
shl ecx, 4
movzx eax, byte [edx + ebx + 0x23bc]
mov byte [ebp - 0xf], al
mov eax, edi
sar eax, 4
and eax, 0xf
shl edi, 8
or ecx, eax
and ecx, 0xfff
movzx eax, byte [ecx + ebx + 0x33bc]
mov ecx, ebx
mov byte [ebp - 0xe], al
movzx eax, byte [ebp - 1]
or edi, eax
and edi, 0xfff
movzx eax, byte [edi + ebx + 0x43bc]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1090be20
movzx eax, byte [esi - 0xa]
lea esi, [esi + 8]
mov byte [esi - 0xe], al
movzx eax, byte [esi - 0x11]
mov byte [esi - 0xd], al
movzx eax, byte [esi - 0x10]
mov byte [esi - 0xc], al
movzx eax, byte [esi - 0xf]
mov byte [esi - 0xb], al
movzx ecx, byte [esi - 0x16]
mov eax, dword [ebp - 0x14]
xor cl, al
mov byte [esi - 0xa], cl
movzx ecx, byte [esi - 0x15]
xor cl, ah
mov byte [esi - 9], cl
movzx eax, byte [esi - 0x14]
xor al, byte [ebp - 0x12]
mov byte [esi - 8], al
movzx eax, byte [esi - 0x13]
xor al, byte [ebp - 0x11]
mov byte [esi - 7], al
mov edi, dword [ebp - 0x1c]
sub edi, 6
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
jne 0x1090c460
movzx eax, byte [ebp - 0x24]
push dword [ebp + 0xc]
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 0x23]
mov byte [ebp - 0xb], al
movzx eax, byte [ebp - 0x22]
mov byte [ebp - 0xa], al
movzx eax, byte [ebp - 0x21]
mov byte [ebp - 9], al
movzx eax, byte [ebp - 0x28]
mov byte [ebp - 8], al
movzx eax, byte [ebp - 0x27]
mov byte [ebp - 7], al
movzx eax, byte [ebp - 0x26]
mov byte [ebp - 6], al
movzx eax, byte [ebp - 0x25]
mov byte [ebp - 5], al
lea eax, [ebx + 0xbbc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1090bd10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1090d2c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1092b249
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x1c], edi
call dword [sym.imp.Core.dll_public:_void___thiscall_FArchive::constructor_void_]
mov dword [ebp - 4], 0
mov dword [edi], 0x10934310
mov byte [ebp - 4], 1
mov dword [edi + 0x1c], 1
mov dword [edi + 0x10], 1
mov dword [edi + 0x40], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x44], 0
mov byte [edi + 0x48], 0xac
mov eax, dword [sym.imp.Core.dll_class_FMalloc__GMalloc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push 0x10935ed8
push 0x458
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x1090d359
push 0
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
push eax
push dword [ebp + 0xc]
push esi
mov ecx, ebx
call fcn.1090cd50
jmp 0x1090d35b
xor eax, eax
mov dword [edi + 0x3c], eax
test eax, eax
jne 0x1090d36a
mov byte [ebp - 4], al
jmp 0x1090d425
mov ebx, 1
cmp dword [ebp + 0x10], 0x18
jbe 0x1090d414
xor esi, esi
mov dword [ebp - 0x14], esi
cmp esi, 0xb
jae 0x1090d3a3
push 2
lea eax, [ebp + 8]
push eax
mov ecx, dword [edi + 0x3c]
call dword [sym.imp.Core.dll_public:_class_FArchive____thiscall_FArchive::ByteOrderSerialize_void___int_]
mov ax, word [ebp + 8]
cmp ax, word [esi*2 + 0x10933100]
jne 0x1090d414
inc esi
jmp 0x1090d37b
test ebx, ebx
je 0x1090d414
push 2
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [edi + 0x3c]
call dword [sym.imp.Core.dll_public:_class_FArchive____thiscall_FArchive::ByteOrderSerialize_void___int_]
push 2
lea eax, [ebp - 0x26]
push eax
mov ecx, dword [edi + 0x3c]
call dword [sym.imp.Core.dll_public:_class_FArchive____thiscall_FArchive::ByteOrderSerialize_void___int_]
push 2
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [edi + 0x3c]
call dword [sym.imp.Core.dll_public:_class_FArchive____thiscall_FArchive::ByteOrderSerialize_void___int_]
xor eax, eax
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.Core.dll_int___cdecl_appAtoi_wchar_t_const__]
add esp, 4
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 0x1c
cmp eax, 0x6f
jne 0x1090d3fc
mov byte [edi + 0x48], 0xac
jmp 0x1090d41e
cmp eax, 0x79
jne 0x1090d40e
mov ecx, dword [ebp + 0x14]
call fcn.10929640
mov byte [edi + 0x48], al
jmp 0x1090d41e
mov byte [edi + 0x48], 0
jmp 0x1090d41e
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx]
push 0
call dword [eax + 0x3c]
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1090e880
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1092b2e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp dword [ebp + 0x10], 0
je 0x1090e8c7
mov eax, dword [sym.imp.Core.dll_int_GUnicodeOS]
cmp dword [eax], 0
je 0x1090e8e3
push 0x80
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov edi, dword [sym.imp.Core.dll_int___cdecl_winGetSizeANSI_wchar_t_const__]
mov eax, dword [sym.imp.Core.dll_int_GUnicodeOS]
push esi
cmp dword [eax], 0
je 0x1090e92a
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1090e963
push esi
mov edi, dword [sym.imp.Core.dll_int___cdecl_winGetSizeANSI_wchar_t_const__]
call edi
add esp, 4
test eax, eax
jne 0x1090e8f7
xor ebx, ebx
jmp 0x1090e90d
push esi
call edi
add esp, 4
add eax, 7
and eax, 0xfffffff8
call fcn.10924db0
mov dword [ebp - 0x10], esp
mov ebx, esp
push 0x80
push esi
call edi
push eax
push esi
push ebx
call dword [sym.imp.Core.dll_char____cdecl_winToANSI_char___wchar_t_const___int_]
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
jmp 0x1090e8cd
call edi
add esp, 4
test eax, eax
jne 0x1090e937
xor ebx, ebx
jmp 0x1090e94d
push esi
call edi
add esp, 4
add eax, 7
and eax, 0xfffffff8
call fcn.10924db0
mov dword [ebp - 0x10], esp
mov ebx, esp
push esi
call edi
push eax
push esi
push ebx
call dword [sym.imp.Core.dll_char____cdecl_winToANSI_char___wchar_t_const___int_]
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x1090e994
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
cmp dword [ebp + 0xc], eax
jne 0x1090e979
call edi
cmp eax, 2
je 0x1090e994
xor ebx, ebx
call edi
push eax
push esi
push 0x1093631c
push 0x2ff
call dword [sym.imp.Core.dll_void___cdecl_debugf_enum_EName__wchar_t_const__]
add esp, 0x10
jmp 0x1090e999
mov ebx, 1
xor eax, eax
test ebx, ebx
setne al
lea esp, [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1090ec90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1092b300
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1090ecde
push eax
push dword [ebp + 8]
call fcn.1090b490
lea esp, [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [sym.imp.Core.dll_int_GUnicodeOS]
cmp dword [eax], 0
je 0x1090ecf5
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
jmp 0x1090ed3a
mov esi, dword [ebp + 8]
push esi
mov edi, dword [sym.imp.Core.dll_int___cdecl_winGetSizeANSI_wchar_t_const__]
call edi
add esp, 4
test eax, eax
jne 0x1090ed0c
xor ebx, ebx
jmp 0x1090ed22
push esi
call edi
add esp, 4
add eax, 7
and eax, 0xfffffff8
call fcn.10924db0
mov dword [ebp - 0x10], esp
mov ebx, esp
push 0
push esi
call edi
push eax
push esi
push ebx
call dword [sym.imp.Core.dll_char____cdecl_winToANSI_char___wchar_t_const___int_]
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x1090ed52
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x1090ed52
xor eax, eax
jmp 0x1090ecc8
mov eax, 1
jmp 0x1090ecc8

Function at 0x1090edc0
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1092b310
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1090ee11
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1090b630
lea esp, [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [sym.imp.Core.dll_int_GUnicodeOS]
cmp dword [eax], 0
je 0x1090ee26
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
jmp 0x1090ee69
mov esi, dword [ebp + 8]
push esi
mov edi, dword [sym.imp.Core.dll_int___cdecl_winGetSizeANSI_wchar_t_const__]
call edi
add esp, 4
test eax, eax
jne 0x1090ee3d
xor ebx, ebx
jmp 0x1090ee53
push esi
call edi
add esp, 4
add eax, 7
and eax, 0xfffffff8
call fcn.10924db0
mov dword [ebp - 0x10], esp
mov ebx, esp
push esi
call edi
push eax
push esi
push ebx
call dword [sym.imp.Core.dll_char____cdecl_winToANSI_char___wchar_t_const___int_]
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1090ee84
cmp dword [ebp + 0xc], eax
jne 0x1090ee7d
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x1090ee84
xor eax, eax
jmp 0x1090edfb
mov eax, 1
jmp 0x1090edfb
Function at 0x10911090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x24]
lea ecx, [ecx]
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x64]
sub edx, ecx
mov eax, dword [edi + 0x6c]
sub edx, eax
mov dword [ebp + 8], edx
jne 0x109110be
test ecx, ecx
jne 0x109110ca
test eax, eax
jne 0x109110ca
mov edx, esi
jmp 0x1091113c
cmp edx, 0xffffffff
jne 0x109110ca
mov edx, 0xfffffffe
jmp 0x1091113c
mov eax, dword [edi + 0x24]
add eax, 0xfffffefa
add eax, esi
cmp ecx, eax
jb 0x1091113c
mov ecx, dword [edi + 0x30]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.10916960
mov edx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], esi
sub dword [edi + 0x64], esi
sub dword [edi + 0x54], esi
lea ecx, [eax + edx*2]
jmp 0x10911100
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x1091110f
sub eax, esi
jmp 0x10911111
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x10911100
mov eax, dword [edi + 0x38]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x1091112f
sub eax, esi
jmp 0x10911131
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x10911120
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x109111dd
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x10911169
xor eax, eax
jmp 0x109111a1
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
cmp dword [eax + 0x18], 0
jne 0x1091118b
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.10911480
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.10916960
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x6c], eax
mov ebx, dword [edi + 0x6c]
cmp ebx, 3
jb 0x109111c9
mov eax, dword [edi + 0x30]
add eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x50]
movzx edx, byte [eax]
mov dword [edi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4c]
mov dword [edi + 0x40], edx
cmp ebx, 0x106
jae 0x109111dd
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x109110a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10911480
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x1091149c
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1091159d
jmp 0x109114b0
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x10911562
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
dec ebx
jne 0x109114d6
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x10911571
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
dec edx
jne 0x10911566
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x109114b0
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret