joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412ca7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x170
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0xc], 0xb4bcac96
push edi
mov ebp, ecx
mov dword [esp + 0x14], 0xb4bcf6b4
mov edi, edx
mov byte [esp + 0x18], 0xb4
mov ecx, ebx
mov al, byte [esp + ecx + 0x10]
xor al, 0xd8
mov byte [esp + ecx + 0xfea8], al
inc ecx
cmp ecx, 9
jl 0x412cce
mov byte [esp + 0xb1], bl
mov ecx, ebx
mov dword [esp + 0x2c], 0xaab6a18f
mov dword [esp + 0x30], 0xf6f7a8a1
mov dword [esp + 0x34], 0xa8a8a0ea
mov al, byte [esp + ecx + 0x2c]
xor al, 0xc4
mov byte [esp + ecx + 0xf0], al
inc ecx
cmp ecx, 0xc
jl 0x412d02
push 0xb
mov byte [esp + 0x100], bl
mov ecx, ebx
mov dword [esp + 0x24], 0x40904f2
mov dword [esp + 0x28], 0xd20f0009
leave
mov dword [esp + 0x2c], 0x44c607ff
and al, 0x2e
pop es
pop edx
mov al, byte [esp + ecx + 0x20]
add al, 0x65
mov byte [esp + ecx + 0xc0], al
inc ecx
cmp ecx, edx
jl 0x412d3d
mov byte [esp + 0xcb], bl
mov ecx, ebx
mov dword [esp + 0x20], 0x919a9364
mov dword [esp + 0x24], 0x4f535495
leave
mov dword [esp + 0x28], 0x44c68d85
and al, 0x2a
lea ecx, [edx + 0x2c200c44]
and dword [eax + 0xcc0c84], ecx
add byte [eax], al
mov al, byte [esp + ecx + 0x20]
sub al, 0x21
mov byte [esp + ecx + 0xcc], al
inc ecx
cmp ecx, edx
jl 0x412d74
mov byte [esp + 0xd7], bl
mov ecx, ebx
mov dword [esp + 0x2c], 0x9bb09e7b
mov dword [esp + 0x30], 0x6c6da3aa
mov dword [esp + 0x34], 0xa6a69e68
mov al, byte [esp + ecx + 0x2c]
sub al, 0x3a
mov byte [esp + ecx + 0x100], al
inc ecx
cmp ecx, 0xc
jl 0x412da7
mov byte [esp + 0x10c], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x27302600
mov dword [esp + 0x14], 0x317b6766
leave
mov dword [esp + 0x18], 0x448a3939
or al, 0x10
mov al, byte [esp + ecx + 0x10]
xor al, 0x55
mov byte [esp + ecx + 0x2c], al
inc ecx
cmp ecx, 0xa
jl 0x412dda
mov byte [esp + 0x36], bl
mov ecx, ebx
mov dword [esp + 0x20], 0xb8b1ac8f
mov dword [esp + 0x24], 0x76bbbdb4
leave
mov dword [esp + 0x28], 0x44c6b4ac
and al, 0x2a
mov ah, 0x8a
inc esp
or al, 0x20
mov al, byte [esp + ecx + 0x20]
sub al, 0x48
mov byte [esp + ecx + 0xd8], al
inc ecx
cmp ecx, edx
jl 0x412e0c
mov byte [esp + 0xe3], bl
mov ecx, ebx
mov dword [esp + 0x10], 0x92c8c3a6
mov dword [esp + 0x14], 0xcbc38d91
mov byte [esp + 0x18], 0xcb
mov al, byte [esp + ecx + 0x10]
sub al, 0x5f
mov byte [esp + ecx + 0xfeb4], al
inc ecx
cmp ecx, 9
jl 0x412e3c
mov byte [esp + 0xbd], bl
mov ecx, ebx
mov dword [esp + 0x10], 0xacdee5c8
mov dword [esp + 0x14], 0xe5dda7ab
mov byte [esp + 0x18], 0xe5
mov al, byte [esp + ecx + 0x10]
sub al, 0x79
mov byte [esp + ecx + 0x20], al
inc ecx
cmp ecx, 9
jl 0x412e6d
mov byte [esp + 0x29], bl
mov ecx, ebx
mov dword [esp + 0x10], 0xc3d8dce7
mov dword [esp + 0x14], 0x9addc4d5
leave
mov dword [esp + 0x18], 0x44c6d8d0
and al, 0x1a
fmul dword [edx + 0x34100c44]
mov ah, 0x88
test byte [esp], cl
add byte [eax], al
add byte [ecx + 0x3b], al
retf 0xee7c

Function at 0x415501
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x180
push ebx
push ebp
push esi
call 0x8ccb4f9a
and al, 0xe4
inc byte [eax]
add al, ch
invalid
Function at 0x417dc4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ecx
sbb dword [eax], 0x53
push ebp
push esi
push edi
mov ebp, edx
mov edi, ecx
mov ecx, dword [ebx + 0x548d304c]
and al, 0x10
xor bl, bl
call fcn.0041b9ff
test al, dh
test esi, esi
je 0x417e5c
mov dword [esp + 0x14], 0xb8b1b4bb
xor ecx, ecx
mov dword [esp + 0x18], 0xb8b0bcb3
mov al, byte [esp + ecx + 0x14]
xor al, 0xdd
mov byte [esp + ecx + 0x1c], al
inc ecx
cmp ecx, 8
jl 0x417df6
push dword [esp + 0x10]
lea edx, [esp + 0x20]
mov byte [esp + 0x28], bl
push esi
mov ecx, edi
call 0x647687b
mov bl, al
pop ecx
pop ecx
ret
pop edi
pop esi
pop esi
mov al, bl
pop ebx
test al, ch
sbb bl, al
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov edi, edx
mov edx, dword [esp + 0x1c]
mov ebp, ecx
adc al, 0x8b
dec esp
sbb byte [edx], dh
fist dword [eax - 0x18]
stc
jns 0x417e81
invalid
inc dword [ebx + ecx*4 - 0x93fa610]
sbb edi, edi
je 0x417eb1
adc byte [ebx + 0x56cd8bd7], cl
push esi
aas
int3
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x10], 0x70a140b
mov esi, ecx
mov ebp, edx
push edi
mov ecx, ebx
mov al, byte [esp + ecx + 0x14]
xor al, 0x63
mov byte [esp + ecx + 0xc0], al
inc ecx
cmp ecx, 4
jl 0x417ec5
mov byte [esp + 0xc4], bl
mov ecx, ebx
mov dword [esp + 0x18], 0xdedbc7d0
mov byte [esp + 0x1c], 0xd6
mov al, byte [esp + ecx + 0x18]
xor al, 0xb2
mov byte [esp + ecx + 0xfec8], al
inc ecx
cmp ecx, 5
jl 0x417eee
push esi
mov byte [esp + 0xd1], bl
call 0x1044649
pop ecx
mov ecx, ebx
cmp byte [eax + esi - 1], 0x2f
jne 0x417f7b
mov dword [esp + 0x14], 0x27712771
mov al, byte [esp + ecx + 0x14]
xor al, 0x54
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 4
jl 0x417f20
mov byte [esp + 0x1c], bl
mov ecx, ebx
mov dword [esp + 0x24], 0x98979f9c
mov dword [esp + 0x28], 0x9ddf9285
mov dword [esp + 0x2c], 0x95848391
mov byte [esp + 0x30], 0x82
mov al, byte [esp + ecx + 0x24]
xor al, 0xf0
mov byte [esp + ecx + 0xfea8], al
inc ecx
cmp ecx, 0xd
jl 0x417f53
lea eax, [esp + 0xfea8]
mov byte [esp + 0xfeb5], bl
push eax
lea eax, [esp + 0x1c]
jmp 0x417fe7
mov dword [esp + 0x18], 0x5f69ad5f
mov byte [esp + 0x1c], 0xad
mov al, byte [esp + ecx + 0x18]
sub al, 0x3a
mov byte [esp + ecx + 0x24], al
inc ecx
cmp ecx, 5
jl 0x417f88
mov byte [esp + 0x29], bl
mov ecx, ebx
mov dword [esp + 0xfea8], 0x505f5754
mov dword [esp + 0xfeac], 0x55175a4d
mov dword [esp + 0xfeb0], 0x5d4c4b59
mov byte [esp + 0xfeb4], 0x4a
mov al, byte [esp + ecx + 0xfea8]
xor al, 0x38
mov byte [esp + ecx + 0x58], al
inc ecx
cmp ecx, 0xd
jl 0x417fc7
lea eax, [esp + 0x58]
mov byte [esp + 0x65], bl
push eax
lea eax, [esp + 0x28]
push esi
push eax
push 0x104
push 0x424ba8
mov edx, 0x534fbfb6
xor edx, edx
call 0x6a118a1
or al, 0xd0
xor eax, eax
mov dword [0x424db0], 0x1f4
lea edi, [esp + 0x38]
test al, ch
adc al, 0xab
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push eax
retf 0x70a
Function at 0x1002b94
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], 0x1a17143f
mov dword [ebp - 0x10], 0x3c241419
mov dword [ebp - 0xc], 0x2c3d2b3c
mov word [ebp - 8], 0x282d
mov byte [ebp - 6], bl
mov eax, ebx
mov cl, byte [ebp + eax - 0x14]
test cl, cl
je 0x1002be3
xor cl, 0x78
mov byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 7
jl 0x1002bce
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x1002c09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1002c09
mov ebx, 0x652
jmp 0x1002c2b
mov ecx, edi
call fcn.010034da
test eax, eax
je 0x1002c2b
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1002c23
cmp byte [eax], 0x71
jne 0x1002c23
xor ebx, ebx
inc ebx
push ebx
call fcn.01002d16
mov ebx, eax
test esi, esi
je 0x1002c36
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1008670
call fcn.01002fda
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01006dd6
leave
ret 0x10

Function at 0x1002c58
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], 0x2f33242a
mov dword [ebp - 0xc], 0x73722d24
mov byte [ebp - 8], bl
mov dword [ebp - 0x20], 0x2b13370d
mov dword [ebp - 0x1c], 0x14707233
mov dword [ebp - 0x18], 0x21272b36
mov word [ebp - 0x14], 0x3737
mov byte [ebp - 0x12], bl
mov eax, ebx
mov cl, byte [ebp + eax - 0x10]
test cl, cl
je 0x1002cb6
xor cl, 0x41
mov byte [ebp + eax - 0x10], cl
inc eax
cmp eax, 9
jb 0x1002ca1
mov eax, ebx
mov cl, byte [ebp + eax - 0x20]
test cl, cl
je 0x1002ccd
xor cl, 0x44
mov byte [ebp + eax - 0x20], cl
inc eax
cmp eax, 0xf
jb 0x1002cb8
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1002d04
push esi
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1002cfe
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x1002d01
mov ebx, dword [ebp - 0x24]
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01006dd6
leave
ret
Function at 0x1002fda
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x364
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
lea edx, [esp + 0x25c]
push edi
mov dword [esp + 0x14], ebx
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x100300b
lea edi, [esp + 0x260]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100301d
mov esi, 0x10012ac
movsw word es:[edi], word [esi]
lea edx, [esp + 0x158]
movsb byte es:[edi], byte [esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x1003038
lea edi, [esp + 0x158]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100304a
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x264]
mov esi, 0x10012b0
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10031c4
xor ecx, ecx
mov al, byte [esp + ecx + 0x158]
mov byte [esp + ecx + 0x260], al
inc ecx
test al, al
jne 0x1003079
mov byte [esp + 0x13], 1
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x10031a4
push 2
lea eax, [esp + 0x48]
push 0x10012a4
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1003146
push 3
lea eax, [esp + 0x48]
push 0x10012a8
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1003146
lea edx, [esp + 0x44]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x10030df
lea edi, [esp + 0x158]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10030f0
mov eax, dword [esp + 0x18]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test al, 0x10
je 0x1003165
lea eax, [esp + 0x158]
push eax
call fcn.01002fda
test eax, eax
je 0x10031bd
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor ecx, ecx
mov al, byte [esp + ecx + 0x260]
mov byte [esp + ecx + 0x158], al
inc ecx
test al, al
jne 0x1003133
mov al, byte [esp + 0x13]
test al, al
jne 0x1003091
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x10031c6
test al, 1
je 0x100317b
and eax, 0xfffffffe
push eax
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x10031b7
xor ecx, ecx
mov al, byte [esp + ecx + 0x260]
mov byte [esp + ecx + 0x158], al
inc ecx
test al, al
jne 0x100318f
jmp 0x1003146
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10031bd
xor al, al
mov byte [esp + 0x13], al
jmp 0x100314a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [esp + 0x36c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.01006dd6
mov esp, ebp
pop ebp
ret 4
Function at 0x10031e2
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x5c
push edi
call dword [sym.imp.msvcrt.dll_strrchr]
mov esi, eax
sub esi, edi
mov eax, 0x103
pop ecx
pop ecx
cmp esi, eax
jbe 0x1003213
mov esi, eax
test esi, esi
je 0x1003229
push esi
lea eax, [ebp - 0x108]
push edi
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
cmp esi, 0x104
jae 0x100326a
xor ebx, ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push ebx
mov byte [ebp + esi - 0x108], bl
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
sub eax, ebx
je 0x1003257
sub eax, 0x50
je 0x1003257
sub eax, 0x67
jne 0x100325a
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01006dd6
leave
ret
call fcn.01006deb
int3

Function at 0x1003275
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x12c
lea eax, [ebp - 0x234]
push 0
push eax
mov esi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
call fcn.0100694b
mov ebx, eax
test ebx, ebx
je 0x10033b7
push 0xffffffffffffffff
lea edx, [ebp - 0x234]
mov ecx, ebx
call fcn.010069fe
test eax, eax
jne 0x10033b2
push edi
mov edi, dword [ebp - 0x234]
xor esi, esi
mov dword [ebp - 0x238], edi
test edi, edi
jle 0x10033b1
push 0x12c
lea eax, [ebp - 0x234]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea edx, [ebp - 0x234]
mov ecx, ebx
call fcn.010069fe
test eax, eax
jne 0x10033b1
xor ecx, ecx
mov al, byte [ecx + 0x1008670]
mov byte [ebp + ecx - 0x108], al
inc ecx
test al, al
jne 0x1003310
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
je 0x10033b1
test byte [ebp - 0x12c], 0x10
je 0x1003365
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10033b1
jmp 0x100339c
test byte [ebp - 0x12c], 0x80
je 0x100337f
lea edi, [ebp - 0x108]
call fcn.010031e2
mov edi, dword [ebp - 0x238]
cmp dword [ebx], 1
jne 0x10033a7
mov ecx, dword [ebx + 4]
push esi
lea edx, [ebp - 0x108]
call fcn.010066f8
mov dword [0x1008778], eax
test eax, eax
jne 0x10033b1
inc esi
cmp esi, edi
jl 0x10032e2
jmp 0x10033b1
mov dword [0x1008778], 0x80000
pop edi
call fcn.01006a33
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.01006dd6
leave
ret
Function at 0x10033cc
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x320]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
mov edi, 0x104
push edi
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x310]
push eax
push 0x10012b4
mov eax, edi
lea ebx, [ebp - 0x108]
call fcn.01002f7d
pop ecx
pop ecx
mov ebx, 0x1008670
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, ebx
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x1003444
sub edx, ecx
lea ecx, [ebp - 0x108]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003456
sub ecx, esi
lea eax, [ecx + edx]
cmp eax, edi
jbe 0x100347c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathStripToRootA]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea edx, [ebp - 0x108]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x1003484
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003490
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
push esi
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
sub eax, esi
je 0x10034c3
sub eax, 0x50
je 0x10034c3
sub eax, 0x67
je 0x10034c3
mov eax, esi
jmp 0x10034c6
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01006dd6
leave
ret
Function at 0x10034da
Capabilities:
Extract resource via kernel32 functions
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
call fcn.010033cc
test eax, eax
je 0x100362a
push edi
push 0xa
push 0x6b
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1003629
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
xor eax, eax
push 0x102
mov word [ebp - 0x114], ax
lea eax, [ebp - 0x112]
push ebx
push eax
mov dword [ebp - 0x120], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x10], 0x14121d1d
mov dword [ebp - 0xc], 0x1003571d
mov word [ebp - 8], 9
mov eax, ebx
mov cl, byte [ebp + eax - 0x10]
test cl, cl
je 0x1003586
xor cl, 0x79
mov byte [ebp + eax - 0x10], cl
inc eax
cmp eax, 0xa
jb 0x1003571
mov ecx, ebx
mov al, byte [ecx + 0x1008670]
mov byte [ebp + ecx - 0x114], al
inc ecx
test al, al
jne 0x1003588
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push ebx
push 0x800
push 2
push ebx
push ebx
push 0x12019f
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
test eax, eax
je 0x1003629
push ebx
push esi
push ebx
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
push ebx
push ebx
mov edi, eax
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp - 0x120]
mov esi, eax
push dword [ebp - 0x11c]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x118]
call esi
lea ecx, [ebp - 0x114]
call fcn.01003275
xor ebx, ebx
inc ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01006dd6
leave
ret
Function at 0x1004f26
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push esi
mov esi, eax
test edx, edx
jne 0x1004f33
xor eax, eax
pop esi
ret
push ebx
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x1004fe7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x10023c8]
movzx eax, byte [edx + 1]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x10023c8]
movzx eax, byte [edx + 2]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x10023c8]
movzx eax, byte [edx + 3]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x10023c8]
movzx eax, byte [edx + 4]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x10023c8]
movzx eax, byte [edx + 5]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x10023c8]
movzx eax, byte [edx + 6]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x10023c8]
movzx eax, byte [edx + 7]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x10023c8]
add edx, 8
sub esi, 8
dec edi
jne 0x1004f4a
pop edi
test esi, esi
je 0x1005000
movzx eax, byte [edx]
xor eax, ecx
and eax, ebx
shr ecx, 8
xor ecx, dword [eax*4 + 0x10023c8]
inc edx
dec esi
jne 0x1004feb
not ecx
pop ebx
mov eax, ecx
pop esi
ret

Function at 0x10056ce
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
cmp byte [edi], 0
je 0x1005700
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10056fb
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x1005729
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
push ebx
cmp eax, dword [edi + 0x14]
jbe 0x1005711
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
add esp, 0xc
add dword [edi + 0x18], esi
mov eax, esi
pop ebx
xor edx, edx
div dword [ebp + 0xc]
pop esi
pop ebp
ret 0xc
Function at 0x1006619
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x10066dd
mov al, byte [ebx]
test al, al
je 0x10066dd
push esi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x1006655
cmp al, 0x5c
jne 0x1006657
mov esi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x100664d
cmp esi, ebx
je 0x1006693
sub esi, ebx
push esi
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
cmp esi, 0x104
jae 0x10066ed
lea eax, [ebp - 0x108]
push eax
push edi
mov byte [ebp + esi - 0x108], 0
call fcn.01006619
lea ecx, [ebp - 0x20c]
sub ecx, edi
mov al, byte [edi]
mov byte [ecx + edi], al
inc edi
test al, al
jne 0x100669b
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10066a7
lea edi, [ebp - 0x20c]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10066b7
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 0
lea eax, [ebp - 0x20c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01006dd6
leave
ret 8
call fcn.01006deb
int3
Function at 0x1006dc7
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1007728
call fcn.0100750c
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
mov esi, ebx
push ebx
push edi
push 0x1008784
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1006c3e
cmp eax, edi
jne 0x1006c31
xor edi, edi
inc edi
mov esi, edi
jmp 0x1006c41
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1006c15
xor edi, edi
inc edi
cmp dword [0x1008788], edi
jne 0x1006c53
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1006c81
cmp dword [0x1008788], ebx
jne 0x1006c7b
mov dword [0x1008788], edi
push 0x1001180
push 0x1001174
call fcn.01006bb5
pop ecx
pop ecx
test eax, eax
je 0x1006c81
jmp 0x1006db0
mov dword [0x1008324], edi
cmp dword [0x1008788], edi
jne 0x1006ca4
push 0x1001170
push 0x1001168
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1008788], 2
test esi, esi
jne 0x1006cb4
push ebx
push 0x1008784
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1008790], 0
je 0x1006cd6
push 0x1008790
call fcn.01007380
pop ecx
test eax, eax
je 0x1006cd6
push ebx
push 2
push ebx
call dword [0x1008790]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x1006d33
test cl, cl
je 0x1006cf2
test edi, edi
jne 0x1006d33
mov al, byte [esi]
test al, al
je 0x1006d02
cmp al, 0x20
ja 0x1006d02
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1006cf2
test byte [ebp - 0x3c], 1
je 0x1006d0e
movzx eax, word [ebp - 0x38]
jmp 0x1006d11
push 0xa
pop eax
push eax
push esi
push ebx
push 0x1000000
call main
mov dword [0x1008320], eax
cmp dword [0x1008338], 0
jne 0x1006d8c
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x1006d44
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1006d57
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1006ce3
cmp dword [0x1008324], 0
jne 0x1006da0
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1008320]
mov dword [ebp - 4], 0xfffffffe
jmp 0x1006dbc
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01007551
ret
call fcn.01007441
jmp 0x1006bde