joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ad50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0x1c8]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 8], eax
cvttss2si eax, xmm0
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x1d0]
lea esi, [ebp - 0x10]
mov edx, dword [eax + ecx*4 - 4]
not edx
nop word [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a0be8]
sub edi, 1
jne 0x1004adc0
mov eax, dword [0x10105adc]
not edx
pop edi
pop esi
cmp dword [eax + 0x19bc], edx
jne 0x1004adf1
mov dword [eax + 0x19c4], edx
cmp dword [eax + 0x19c0], edx
jne 0x1004ae00
mov byte [eax + 0x19d0], 1
mov eax, edx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004b660
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10099923
push eax
mov dword fs:[0], esp
mov eax, dword [0x10105adc]
push ebx
sub esp, 0x28
push esi
push edi
test eax, eax
je 0x1004b6a0
inc dword [eax + 0x374]
push 0x3ac8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea ecx, [ebp - 0x11]
mov dword [ebp - 0x18], eax
add esp, 4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1004b6d4
push ecx
mov ecx, eax
call fcn.10047510
mov edi, eax
mov dword [ebp - 0x18], eax
jmp 0x1004b6d9
xor edi, edi
mov dword [ebp - 0x18], edi
cmp dword [0x10105adc], 0
jne 0x1004b6e9
mov eax, edi
mov dword [0x10105adc], eax
or edx, 0xffffffff
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], str.Window
mov esi, 0x100c7c85
mov al, 0x57
or edi, 0xffffffff
cmp al, 0x23
jne 0x1004b712
cmp byte [esi], al
jne 0x1004b712
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100a0be8]
test al, al
jne 0x1004b704
mov edi, dword [ebp - 0x18]
not edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 0x10058db0
mov dword [ebp - 0x2c], 0x10058e50
mov esi, dword [edi + 0x2c9c]
mov ecx, dword [edi + 0x2ca0]
mov dword [ebp - 0x28], 0x10058f20
cmp esi, ecx
jne 0x1004b7ef
inc esi
test ecx, ecx
je 0x1004b76c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1004b771
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x1004b7ef
mov eax, dword [0x10105adc]
test eax, eax
je 0x1004b789
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, dword [edi + 0x2ca4]
add esp, 4
mov dword [ebp - 0x18], eax
test edx, edx
je 0x1004b7e3
mov ecx, dword [edi + 0x2c9c]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2ca4]
add esp, 0xc
test ecx, ecx
je 0x1004b7d6
mov eax, dword [0x10105adc]
test eax, eax
je 0x1004b7d6
dec dword [eax + 0x374]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [edi + 0x2ca4], eax
mov dword [edi + 0x2ca0], esi
mov eax, dword [edi + 0x2c9c]
movups xmm0, xmmword [ebp - 0x38]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2ca4]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 0x28]
movq qword [eax + ecx*8 + 0x10], xmm0
mov eax, edi
inc dword [edi + 0x2c9c]
mov ecx, dword [ebp - 0xc]
mov byte [edi], 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1004e630
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1004e66f
cmp bl, 0x23
jne 0x1004e651
cmp byte [esi], bl
jne 0x1004e651
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x100a0be8]
test bl, bl
jne 0x1004e642
mov ecx, dword [0x10105adc]
not eax
mov esi, dword [ecx + 0x198c]
mov edi, dword [ecx + 0x1994]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1004e6ae
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1004e6a8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1004e6aa
mov esi, edx
test esi, esi
jne 0x1004e690
cmp edi, ebx
je 0x1004e6bd
cmp dword [edi], eax
jne 0x1004e6bd
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10053ce0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10105adc]
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [eax + 0x199c]
mov esi, 4
mov eax, dword [edi + 0x1c8]
add edi, 0x1c8
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100a0be8]
sub esi, 1
jne 0x10053d12
mov ecx, dword [edi + 4]
not ebx
mov esi, dword [edi]
cmp esi, ecx
jne 0x10053d59
inc esi
test ecx, ecx
je 0x10053d47
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10053d4c
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.100598a0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100588e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [0x10105adc]
push esi
mov esi, ebx
mov dword [ebp - 4], ecx
push edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov edi, dword [esi + 0x2ca8]
mov ecx, dword [esi + 0x2cac]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 0xc], 0
cmp edi, ecx
jne 0x100589d2
inc edi
test ecx, ecx
je 0x10058946
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1005894b
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x100589d2
test esi, esi
je 0x1005895e
inc dword [esi + 0x374]
lea eax, [edi*8]
sub eax, edi
shl eax, 2
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [esi + 0x2cb0]
test eax, eax
je 0x100589c0
mov ecx, dword [esi + 0x2ca8]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 2
push edx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x2cb0]
add esp, 0xc
test ecx, ecx
je 0x100589b6
mov eax, dword [0x10105adc]
test eax, eax
je 0x100589b6
dec dword [eax + 0x374]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [esi + 0x2cb0], ebx
mov ebx, dword [0x10105adc]
mov dword [esi + 0x2cac], edi
mov eax, dword [esi + 0x2ca8]
mov ecx, dword [esi + 0x2cb0]
movups xmm0, xmmword [ebp - 0x24]
mov edi, dword [ebp - 4]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [ebp - 0xc]
movups xmmword [ecx + edx*4], xmm0
movq xmm0, qword [ebp - 0x14]
movq qword [ecx + edx*4 + 0x10], xmm0
mov dword [ecx + edx*4 + 0x18], eax
inc dword [esi + 0x2ca8]
mov eax, dword [esi + 0x2ca8]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x2cb0]
mov esi, edi
lea eax, [eax + ecx*4]
add eax, 0xffffffe4
lea ecx, [esi + 1]
mov dword [ebp - 8], eax
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10058a30
sub esi, ecx
test ebx, ebx
je 0x10058a43
inc dword [ebx + 0x374]
inc esi
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push esi
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [ebp - 8]
lea esi, [edi + 1]
add esp, 0x10
or edx, 0xffffffff
mov dword [ebx], eax
mov al, byte [edi]
test al, al
je 0x10058a97
or edi, 0xffffffff
nop word [eax + eax]
cmp al, 0x23
jne 0x10058a7e
cmp byte [esi], al
jne 0x10058a7e
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100a0be8]
test al, al
jne 0x10058a70
pop edi
not edx
mov eax, ebx
pop esi
mov dword [ebx + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10058ab0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
mov edx, dword [0x10105adc]
mov dword [ebp - 0xc], edx
push edi
mov edi, ecx
test esi, esi
jne 0x10058ad9
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x10058ad0
sub esi, ecx
test edx, edx
je 0x10058ae3
inc dword [edx + 0x374]
lea eax, [esi + 1]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push esi
push edi
push eax
lea ebx, [eax + esi]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [ebp - 0x10]
xor edx, edx
add esp, 0x10
mov byte [ebx], 0
xor esi, esi
mov dword [ebp - 8], edx
mov ecx, edi
cmp edi, ebx
jae 0x10058c72
nop dword [eax + eax]
mov al, byte [ecx]
cmp al, 0xa
je 0x10058ca0
cmp al, 0xd
je 0x10058ca0
mov edi, ecx
cmp ecx, ebx
jae 0x10058b47
mov al, byte [edi]
cmp al, 0xa
je 0x10058b47
cmp al, 0xd
je 0x10058b47
inc edi
cmp edi, ebx
jb 0x10058b38
mov byte [edi], 0
mov al, byte [ecx]
cmp al, 0x3b
je 0x10058c64
cmp al, 0x5b
jne 0x10058c4b
cmp edi, ecx
jbe 0x10058c4b
cmp byte [edi - 1], 0x5d
lea ebx, [edi - 1]
jne 0x10058c48
lea esi, [ecx + 1]
mov byte [ebx], 0
mov eax, ebx
sub eax, esi
push eax
push 0x5d
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
je 0x10058bb3
lea ecx, [eax + 1]
sub ebx, ecx
push ebx
push 0x5b
push ecx
call sub.VCRUNTIME140.dll_memchr
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x10058bb3
mov eax, dword [ebp - 8]
lea edx, [ecx + 1]
mov dword [ebp - 8], edx
mov byte [eax], 0
jmp 0x10058bbb
mov dword [ebp - 8], esi
mov esi, str.Window
mov cl, byte [esi]
or eax, 0xffffffff
mov ebx, dword [0x10105adc]
inc esi
test cl, cl
je 0x10058bfe
or ebx, 0xffffffff
nop
cmp cl, 0x23
jne 0x10058bdf
cmp byte [esi], cl
jne 0x10058bdf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100a0be8]
test cl, cl
jne 0x10058bd0
mov ebx, dword [0x10105adc]
mov edx, dword [ebx + 0x2c9c]
xor ecx, ecx
not eax
test edx, edx
jle 0x10058c1f
mov esi, dword [ebx + 0x2ca4]
cmp dword [esi + 4], eax
je 0x10058c2b
inc ecx
add esi, 0x18
cmp ecx, edx
jl 0x10058c12
xor esi, esi
mov ebx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x10058c64
test esi, esi
je 0x10058c21
push dword [ebp - 8]
mov eax, dword [esi + 8]
push esi
push dword [ebp - 0xc]
call eax
mov ebx, dword [ebp - 4]
mov edx, eax
add esp, 0xc
mov dword [ebp - 8], edx
jmp 0x10058c64
mov ebx, dword [ebp - 4]
test esi, esi
je 0x10058c64
test edx, edx
je 0x10058c64
mov eax, dword [esi + 0xc]
push ecx
push edx
push esi
push dword [ebp - 0xc]
call eax
mov edx, dword [ebp - 8]
add esp, 0x10
lea ecx, [edi + 1]
cmp ecx, ebx
jb 0x10058b20
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x10058c85
mov eax, dword [0x10105adc]
test eax, eax
je 0x10058c85
dec dword [eax + 0x374]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
mov byte [eax + 0x2c88], 1
pop ebx
mov esp, ebp
pop ebp
ret
inc ecx
jmp 0x10058b20
Function at 0x10058cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x10105adc]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [esi + 0x2c8c], 0
test eax, eax
je 0x10058da1
push edi
lea edi, [esi + 0x2c90]
mov dword [esi + 0x2c8c], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10058d04
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10059ba0
mov dword [edi], 0
cmp dword [edi + 4], 0
jne 0x10058d19
push 8
mov ecx, edi
call fcn.10059ba0
mov eax, dword [edi]
mov ecx, dword [edi + 8]
push ebx
mov dword [ebp - 4], 0
mov byte [ecx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2c9c], 0
jle 0x10058d5c
xor ebx, ebx
mov eax, dword [esi + 0x2ca4]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2c9c]
jl 0x10058d37
mov edi, dword [edi]
mov ebx, 0x101059ac
mov ecx, dword [ebp - 8]
mov edx, 0x100c7d60
lea eax, [edi - 1]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x2c98]
test eax, eax
cmovne ebx, eax
call fcn.10048e00
mov esi, eax
test esi, esi
je 0x10058d9f
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007fd00
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x3c]
add esi, edi
sub eax, 0
je 0x1007fd79
sub eax, 1
jne 0x1007fed4
push edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push edi
push 0x1007fb60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 0xf8
push esi
call edi
mov ecx, 0xf8
mov eax, esi
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x1007fd54
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0xf8
push esi
call edi
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
cmp dword [ebp + 0x10], 0
jne 0x1007fed4
mov ecx, 0x1010eb74
call fcn.1003cf70
mov ecx, 0x1010ec00
call fcn.1003cf70
mov ecx, 0x1010ebd8
call fcn.1003cf70
mov ecx, 0x1010ec14
call fcn.1003cf70
mov ecx, 0x1010ebb0
call fcn.1003cf70
mov ecx, 0x1010ebc4
call fcn.1003cf70
mov ecx, 0x1010ec3c
call fcn.1003cf70
mov ecx, 0x1010ec28
call fcn.1003cf70
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10105654]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101106d0]
cmp eax, dword [ecx + 4]
jle 0x1007fe1c
push 0x101106d0
call fcn.10096a77
add esp, 4
cmp dword [0x101106d0], 0xffffffff
jne 0x1007fe1c
push 0x1009ba60
call fcn.100969ac
push 0x101106d0
call fcn.10096a26
add esp, 8
mov eax, dword [0x1010acc4]
xor edi, edi
cmp dword [eax + 0xc], edi
jle 0x1007fe66
push ebx
xor ebx, ebx
nop dword [eax + eax]
mov esi, dword [eax]
cmp dword [esi + ebx], 0xfffffffe
jne 0x1007fe5c
mov ecx, dword [esi + ebx + 4]
test ecx, ecx
je 0x1007fe5c
mov eax, dword [ecx + 8]
add ecx, 8
mov eax, dword [eax + 0x24]
call eax
test al, al
mov eax, dword [0x1010acc4]
jne 0x1007fe5c
mov dword [esi + ebx + 0x14], 0
inc edi
add ebx, 0x38
cmp edi, dword [eax + 0xc]
jl 0x1007fe30
pop ebx
mov eax, dword [0x101106b4]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ecx + 0x20], eax
call fcn.1003b040
call fcn.1007d3e0
mov esi, dword [0x10105adc]
mov ecx, esi
mov dword [0x1010ab44], 0
mov dword [0x1010ab4c], 0
call fcn.1004cd00
cmp dword [0x10105adc], esi
jne 0x1007feb0
mov dword [0x10105adc], 0
test esi, esi
je 0x1007fed4
mov ecx, esi
call fcn.10059d90
mov eax, dword [0x10105adc]
test eax, eax
je 0x1007feca
dec dword [eax + 0x374]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x10080040
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009808d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x160
push esi
push edi
push ecx
lea ecx, [ebp - 0x2c]
mov edi, edx
call fcn.10025a00
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
push 7
push 0x100c8338
cmp eax, 7
jb 0x100800bd
cmp edx, 0xf
lea esi, [ebp - 0x2c]
lea eax, [ecx + 7]
cmova esi, dword [ebp - 0x2c]
add esi, ecx
mov dword [ebp - 0x1c], eax
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 7], 0
jmp 0x100800ce
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x14]
push 7
call fcn.10039fa0
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x170]
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10080159
nop
mov edx, dword [edi + 4]
lea eax, [ebp - 0x144]
cmp edx, dword [edi + 8]
je 0x10080137
xorps xmm0, xmm0
lea ecx, [eax + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov dword [ebp - 0x14], ecx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10080118
sub eax, dword [ebp - 0x14]
mov ecx, edx
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.100052e0
add dword [edi + 4], 0x18
jmp 0x10080140
push eax
push edx
mov ecx, edi
call fcn.10087db0
lea eax, [ebp - 0x170]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100800f0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x1008018f
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10080185
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10080185
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100969c1
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100892b0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x100893a3
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1008939c
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10089382
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10089382
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10089382
mov edx, dword [esi]
test edx, edx
jne 0x10089348
push 0x200
push edx
push dword [0x10105aec]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1008939c
jmp 0x10089373
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10089373
shl eax, 3
push eax
push edx
push 0
push dword [0x10105aec]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1008939c
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
lea eax, [ecx + 1]
mov dword [esi + 8], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10089307
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x100893e9
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100893e9
nop
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100893e3
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.10089160
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x100893b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100893f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x10110960]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10089436
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10089451
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10089480
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x10110968]
push ebx
push esi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x1008955d
mov eax, dword [0x10110960]
add eax, 0x14
test byte [eax], 2
je 0x100894ba
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x100894a5
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x1008955d
push edi
push 1
or edx, 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100892b0
mov ecx, dword [0x10110968]
add esp, 4
cmp esi, ecx
jae 0x1008950b
imul edi, esi, 0x2c
mov eax, dword [0x10110960]
test byte [edi + eax + 0x14], 2
jne 0x10089500
mov ecx, esi
call fcn.100893f0
mov ebx, eax
test ebx, ebx
jne 0x10089508
mov ecx, dword [0x10110968]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x100894e1
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1008955c
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1008954d
mov ebx, eax
nop dword [eax + eax]
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10089541
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10089520
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x10105aec]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10091740
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009a98d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x134
mov eax, dword [0x100c9f58]
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0xc
movq xmm0, qword [str.kapustahop_]
mov dword [ebp - 0x10], 0xf
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x3c]
call fcn.1003cb30
add esp, 4
mov ecx, 0x1010e9b8
push eax
call fcn.1001f7c0
mov ecx, dword [ebp - 0x28]
cmp ecx, 0xf
jbe 0x100917e3
mov edx, dword [ebp - 0x3c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100917d9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10091822
push ecx
push edx
call fcn.100969c1
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
cmp ecx, 0xf
jbe 0x10091832
mov edx, dword [ebp - 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10091828
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10091828
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100969c1
add esp, 8
cmp dword [0x1010e9cc], 0xf
mov eax, 0x1010e9b8
push 0
cmova eax, dword [0x1010e9b8]
push eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x1010e038
call fcn.1008b6f0
mov ecx, 0x1010e038
call fcn.1008d380
mov ecx, 0x1010e038
call fcn.1008f3f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret