joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11832e0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.01194980
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
cmp byte [ebx + 0x1c], 0
push esi
mov dword [ebx + 0x1020], 0
jne 0x118330e
test al, 4
jne 0x118330e
xor cl, cl
jmp 0x1183310
mov cl, 1
mov edx, eax
shr edx, 1
push edi
and dl, 1
movzx edi, dl
neg edi
sbb edi, edi
and edi, 0xc0000000
add edi, 0x80000000
test al, 1
je 0x1183335
or edi, 0x40000000
shr eax, 3
not eax
and eax, 1
mov dword [ebp + 0xc], eax
test cl, cl
je 0x118334a
or eax, 2
mov dword [ebp + 0xc], eax
xor ecx, ecx
cmp byte [ebx + 0x15], cl
push 0
setne cl
dec ecx
and ecx, 0x8000000
push ecx
push 3
push 0
push eax
mov eax, dword [ebp + 8]
push edi
push eax
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x11833d9
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp + 8]
push 0x800
lea ecx, [ebp - 0x1008]
push ecx
push edx
mov dword [ebp - 4], eax
call fcn.0117d190
test al, al
je 0x11833c9
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push 0
push eax
push 3
push 0
push ecx
push edi
lea edx, [ebp - 0x1008]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x11833c4
mov dword [ebp - 4], eax
cmp esi, 0xffffffff
jne 0x11833d9
cmp dword [ebp - 4], 2
jne 0x11833d9
mov dword [ebx + 0x1020], 1
cmp esi, 0xffffffff
setne al
mov byte [ebx + 0x12], 0
mov dword [ebx + 0xc], 0
mov byte [ebx + 0x10], 0
mov byte [ebp + 0xf], al
pop edi
test al, al
je 0x118341b
mov eax, dword [ebp + 8]
push 0x7ff
mov dword [ebx + 4], esi
push eax
lea esi, [ebx + 0x1e]
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov al, byte [ebp + 0xf]
add esp, 0xc
xor ecx, ecx
mov word [esi + 0xffe], cx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1183590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.01194980
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push ebx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x11835df
push 0x800
lea eax, [ebp - 0x1000]
push eax
push ebx
call fcn.0117d190
test al, al
je 0x11835dd
lea ecx, [ebp - 0x1000]
push ecx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x11835f0
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.01194980
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
push eax
call edi
test eax, eax
setne bl
test bl, bl
jne 0x118364c
mov edx, dword [ebp + 8]
push 0x800
lea ecx, [ebp - 0x1000]
push ecx
push edx
call fcn.0117d190
test al, al
je 0x118364c
push esi
lea eax, [ebp - 0x1000]
push eax
call edi
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1183790
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1250
call fcn.01194980
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp ebx, 0xffffffff
jne 0x1183835
mov edi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [ebp - 0x250]
push eax
push esi
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1183874
push 0x800
lea ecx, [ebp - 0x1250]
push ecx
push esi
call fcn.0117d190
test al, al
je 0x11837f9
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x1250]
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1183874
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x1183815
cmp eax, 3
je 0x1183815
cmp eax, 0x12
je 0x1183815
mov ecx, 1
jmp 0x1183817
xor ecx, ecx
mov eax, dword [ebp + 0x10]
pop edi
mov byte [eax + 0x1044], cl
mov dword [eax + 0x1040], 0
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x250]
push ecx
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x1183874
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x12
mov eax, dword [ebp + 0x10]
setne dl
pop edi
mov byte [eax + 0x1044], dl
mov dword [eax + 0x1040], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x7ff
push esi
mov esi, dword [ebp + 0x10]
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
xor eax, eax
push esi
mov word [esi + 0xffe], ax
call fcn.01176a00
mov ecx, eax
sub ecx, esi
sar ecx, 1
mov edi, 0x800
sub edi, ecx
mov dword [ebp + 0x10], eax
je 0x11838c7
lea edx, [edi - 1]
push edx
lea ecx, [ebp - 0x224]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
mov eax, dword [ebp + 0x10]
add esp, 0xc
xor edx, edx
mov word [eax + edi*2 - 2], dx
mov ecx, dword [ebp - 0x234]
push 1
push 0
push 0
push ecx
call fcn.01194910
mov ecx, dword [ebp - 0x230]
xor edi, edi
add eax, ecx
mov ecx, dword [ebp - 0x248]
adc edx, edi
mov edi, dword [ebp - 0x240]
mov dword [esi + 0x1034], edi
mov edi, dword [ebp - 0x23c]
mov dword [esi + 0x1038], edi
mov edi, dword [ebp - 0x238]
mov dword [esi + 0x1004], edx
mov edx, dword [ebp - 0x250]
mov dword [esi + 0x1000], eax
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0x103c], edi
mov edi, dword [ebp - 0x23c]
mov dword [esi + 0x1008], edx
mov edx, dword [ebp - 0x244]
mov dword [esi + 0x1028], eax
mov dword [esi + 0x102c], ecx
mov dword [esi + 0x1030], edx
mov dword [esi + 0x1010], edi
mov edi, dword [ebp - 0x238]
mov dword [esi + 0x1014], edi
mov dword [esi + 0x1018], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x101c], ecx
mov dword [esi + 0x1024], eax
mov dword [esi + 0x1020], edx
pop edi
mov dword [esi + 0x1040], 0
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1184070
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [edi + 4], 0
mov dword [edi], 0
mov eax, esi
cmp esi, 0x8000
jb 0x1184099
mov eax, 0x8000
mov ebx, dword [ebp + 8]
push eax
mov eax, dword [edi + 0xc]
push ebx
push eax
call sub.msvcrt.dll_memcpy
mov eax, 1
add esp, 0xc
xor cl, cl
cmp esi, eax
jbe 0x11840bd
xor cl, byte [eax + ebx]
inc eax
cmp eax, esi
jb 0x11840b5
mov eax, dword [edi + 4]
mov esi, dword [ebp + 0x10]
add eax, 8
mov edx, eax
shr edx, 3
add dword [edi], edx
and eax, 7
mov dword [edi + 4], eax
mov dword [esi + 0x14], 0
cmp cl, byte [ebx]
jne 0x1184130
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov ecx, edi
call fcn.01172290
mov edi, eax
test edi, edi
je 0x1184130
push 1
mov ecx, esi
call fcn.01182290
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
mov dword [esi + 0x14], ecx
lea edx, [eax + eax*4]
mov eax, dword [esi]
lea eax, [eax + edx*8]
lea ecx, [eax + 0xc]
mov dword [ecx], edi
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
pop edi
mov dword [eax + 0x24], ecx
mov ecx, 3
pop esi
mov dword [eax], 0x28
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
pop ebx
pop ebp
ret 0xc
push 1
mov ecx, esi
call fcn.01182290
mov eax, dword [esi + 0x14]
mov ecx, dword [esi]
lea edx, [eax + 1]
mov dword [esi + 0x14], edx
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
lea ecx, [eax + 0x1c]
mov dword [eax + 0x24], ecx
mov ecx, 3
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
lea edx, [eax + 0xc]
xor ecx, ecx
mov dword [eax], 0x16
mov dword [eax + 0x14], edx
cmp dword [esi + 0x14], ecx
jle 0x1184195
xor edx, edx
mov eax, dword [esi]
add eax, edx
cmp dword [eax + 0x14], 0
jne 0x1184180
lea edi, [eax + 0xc]
mov dword [eax + 0x14], edi
cmp dword [eax + 0x24], 0
jne 0x118418c
lea edi, [eax + 0x1c]
mov dword [eax + 0x24], edi
inc ecx
add edx, 0x28
cmp ecx, dword [esi + 0x14]
jl 0x1184170
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1186cd0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
mov ecx, 0x10000
sub ecx, eax
push edi
cmp ecx, 0x100
jae 0x1186d15
mov edi, dword [esi + 0x40]
mov ecx, dword [esi + 0x10]
sub edi, eax
push edi
lea edx, [ecx + eax]
push edx
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ecx, esi
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], edi
call fcn.0117d3f0
mov eax, dword [esi + 0x44]
lea ecx, [eax + 7]
cmp ecx, dword [esi + 0x40]
jbe 0x1186d2a
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
push ebx
mov ebx, dword [esi + 0x10]
push 7
mov ecx, edi
add ebx, eax
call fcn.01182130
mov eax, dword [edi + 0x14]
add eax, dword [edi]
mov edx, dword [ebx]
mov dword [eax], edx
mov cx, word [ebx + 4]
mov word [eax + 4], cx
mov dl, byte [ebx + 6]
mov byte [eax + 6], dl
mov eax, 7
add dword [edi + 0x14], eax
add dword [esi + 0x44], eax
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
lea edx, [ecx + 3]
cmp edx, eax
jae 0x1186d9a
mov eax, dword [edi]
movzx ebx, byte [ecx + eax + 2]
lea edx, [ecx + eax]
movzx eax, byte [edx + 3]
shl eax, 8
add eax, ebx
movzx ebx, byte [edx + 1]
movzx edx, byte [edx]
shl eax, 8
add eax, ebx
shl eax, 8
add eax, edx
add ecx, 4
mov dword [edi + 0x18], ecx
mov dword [ebp - 4], eax
jmp 0x1186da1
mov dword [ebp - 4], 0
mov eax, 4
cmp dword [edi + 0x14], eax
jbe 0x1186dbc
mov ecx, dword [edi]
lea ecx, [ecx]
test byte [ecx + eax], 0x80
je 0x1186e0b
inc eax
cmp eax, dword [edi + 0x14]
jb 0x1186db0
xor ebx, ebx
mov ecx, edi
call fcn.01177710
lea ecx, [eax + ebx - 3]
mov dword [ebp + 8], ecx
test ecx, ecx
jl 0x1186e74
test ebx, ebx
je 0x1186e74
or eax, edx
je 0x1186e74
mov ebx, dword [esi + 0x40]
sub ebx, dword [esi + 0x44]
mov dword [ebp - 8], ebx
test ecx, ecx
jg 0x1186e16
mov ecx, edi
call fcn.01177860
xor edx, edx
cmp dword [ebp - 4], eax
pop ebx
sete dl
pop edi
mov al, dl
pop esi
mov esp, ebp
pop ebp
ret 4
lea ebx, [eax - 3]
jmp 0x1186dbe
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ebx, ecx
jb 0x1186e1c
mov ebx, ecx
mov eax, dword [esi + 0x10]
add eax, dword [esi + 0x44]
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x1186e4a
push ebx
mov ecx, edi
call fcn.01182130
mov ecx, dword [edi + 0x14]
mov eax, dword [ebp - 0xc]
add ecx, dword [edi]
push ebx
push eax
push ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp + 8]
add esp, 0xc
add dword [edi + 0x14], ebx
add dword [esi + 0x44], ebx
sub ecx, ebx
xor eax, eax
cmp ecx, eax
mov dword [ebp + 8], ecx
jle 0x1186df1
mov ecx, esi
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
call fcn.0117d3f0
test eax, eax
jne 0x1186e10
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
pop ebx
pop edi
mov byte [esi + 0x18], 0
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1186ff0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x1187047
push edi
lea edi, [esi + 4]
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x1184250
push 0x10000
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x118704d
mov dword [edi], eax
inc dword [esi + 0x84]
mov eax, dword [0x11a4c24]
test eax, eax
je 0x118703e
mov ecx, dword [edi]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
inc ebx
add edi, 4
cmp ebx, dword [esi]
jb 0x1187006
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1025250
push 0x11a1484
call fcn.01176250
add esp, 8
push 2
mov ecx, 0x11a1484
call fcn.01171870
push 0x11996fc
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], 2
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x1188400
Capabilities:
Check if file exists
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.01194980
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1188420
sub eax, edx
sar eax, 1
lea eax, [edi + eax*2 - 2]
jne 0x1188437
mov eax, edi
movzx eax, word [eax]
mov esi, dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
cmp ax, 0x2e
je 0x1188455
cmp ax, 0x20
je 0x1188455
push 0
push edi
call esi
test eax, eax
jne 0x1188485
push edi
call fcn.01183590
cmp eax, 0xffffffff
jne 0x118849f
push 0x800
lea eax, [ebp - 0x1000]
push eax
push edi
call fcn.0117d190
test al, al
je 0x118849f
push 0
lea ecx, [ebp - 0x1000]
push ecx
call esi
test eax, eax
je 0x118849f
cmp byte [ebp + 0xc], 0
je 0x1188495
mov edx, dword [ebp + 0x10]
push edx
push edi
call fcn.011835f0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x11884b4
cmp eax, 3
mov eax, 1
jne 0x11884b9
mov eax, 2
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1189ec0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x5024
call fcn.01194980
push edi
mov edi, dword [ebp + 8]
push 0x800
lea eax, [ebp - 0x4024]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetLongPathNameW]
test eax, eax
je 0x118a0af
cmp eax, 0x800
jae 0x118a0af
push 0x800
lea ecx, [ebp - 0x5024]
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
test eax, eax
je 0x118a0af
cmp eax, 0x800
jae 0x118a0af
push ebx
push esi
lea edx, [ebp - 0x4024]
push edx
call fcn.01176a00
mov ebx, eax
lea eax, [ebp - 0x5024]
push eax
mov dword [ebp + 8], ebx
call fcn.01176a00
mov esi, eax
cmp word [esi], 0
je 0x118a0a4
push esi
push ebx
call fcn.01174610
test eax, eax
je 0x118a0a4
push esi
push edi
call fcn.01176a00
push eax
call fcn.01174610
test eax, eax
jne 0x118a0a4
mov ebx, dword [sym.imp.msvcrt.dll_wcsncpy]
mov word [ebp - 0x1000], ax
xor esi, esi
lea ecx, [ecx]
test ax, ax
jne 0x1189ff3
push 0x7ff
lea ecx, [ebp - 0x1000]
push edi
push ecx
call ebx
add esp, 0xc
push esi
push 0x1028df8
push 0x800
lea eax, [ebp - 0x1000]
xor edx, edx
push eax
mov word [ebp - 2], dx
call fcn.01176a00
push eax
call fcn.011952ee
add esp, 0x10
lea ecx, [ebp - 0x1000]
push ecx
call fcn.011869b0
test al, al
je 0x1189fd8
xor eax, eax
mov word [ebp - 0x1000], ax
jmp 0x1189fdf
mov ax, word [ebp - 0x1000]
add esi, 0x7b
cmp esi, 0x2710
jl 0x1189f80
test ax, ax
je 0x118a0a4
push 0x7ff
lea edx, [ebp - 0x2000]
push edi
push edx
call ebx
mov ecx, dword [ebp + 8]
add esp, 0xc
push 0x800
push ecx
lea edx, [ebp - 0x2000]
xor eax, eax
push edx
mov word [ebp - 0x1002], ax
call fcn.01176bc0
mov esi, dword [sym.imp.KERNEL32.DLL_MoveFileW]
lea eax, [ebp - 0x1000]
push eax
lea ecx, [ebp - 0x2000]
push ecx
call esi
test eax, eax
je 0x118a0a4
lea ecx, [ebp - 0x3024]
call fcn.01171a70
push edi
xor bl, bl
call fcn.011869b0
test al, al
jne 0x118a064
push 0x12
push edi
lea ecx, [ebp - 0x3024]
call fcn.01183430
mov bl, al
lea edx, [ebp - 0x2000]
push edx
lea eax, [ebp - 0x1000]
push eax
call esi
test bl, bl
je 0x118a08e
lea ecx, [ebp - 0x3024]
call fcn.0117cc10
lea ecx, [ebp - 0x3024]
call fcn.01186800
lea ecx, [ebp - 0x3024]
call fcn.011883d0
pop esi
pop ebx
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x118a470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.01194980
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x118a489
mov byte [eax], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x118a4d0
push 0x800
lea eax, [ebp - 0x1000]
push eax
push esi
call fcn.0117d190
test al, al
je 0x118a55d
lea ecx, [ebp - 0x1000]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x118a55d
test bl, bl
jne 0x118a4e0
push esi
mov bl, 1
call fcn.01189ec0
test al, al
jne 0x118a494
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
xor edx, edx
xor bl, bl
test edi, edi
sete dl
push edx
mov edx, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push esi
push ecx
call fcn.01187090
test eax, eax
je 0x118a55d
cmp eax, 1
je 0x118a548
cmp eax, 6
jne 0x118a494
cmp byte [0x11a148c], bl
je 0x118a494
cmp dword [0x11a1484], 0
mov eax, 0xff
jne 0x118a531
mov dword [0x11a1484], eax
inc dword [0x11a1488]
push 0x11996fc
lea edx, [ebp + 0x28]
push edx
mov dword [ebp + 0x28], eax
call sub.msvcrt.dll__CxxThrowException
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x118a552
mov byte [eax], 1
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x24
xor ebx, ebx
cmp byte [ebp + 0x28], bl
setne bl
add ebx, 0x11
test edi, edi
je 0x118a584
push ebx
push esi
mov ecx, edi
call fcn.01183430
test al, al
je 0x118a584
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x24
push 1
push esi
call fcn.011884d0
test edi, edi
je 0x118a5a2
push ebx
push esi
mov ecx, edi
call fcn.01183430
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
push esi
call fcn.01183660
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x119487b
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1199908
call fcn.01195824
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x11a7268
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedCompareExchange]
test eax, eax
je 0x1194632
cmp eax, esi
jne 0x1194625
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1194635
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x119460c
xor esi, esi
inc esi
mov eax, dword [0x11a7264]
cmp eax, esi
jne 0x1194648
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1194677
mov eax, dword [0x11a7264]
test eax, eax
jne 0x1194671
mov dword [0x11a7264], esi
push 0x100188c
push 0x100187c
call fcn.01194571
pop ecx
pop ecx
test eax, eax
je 0x1194677
jmp 0x119479f
mov dword [0x11a4f1c], esi
mov eax, dword [0x11a7264]
cmp eax, esi
jne 0x119469b
push 0x1001878
push 0x1001850
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x11a7264], 2
test ebx, ebx
jne 0x11946a7
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp dword [0x11a7278], 0
je 0x11946cb
push 0x11a7278
call fcn.01195799
pop ecx
test eax, eax
je 0x11946cb
push 0
push 2
push 0
call dword [0x11a7278]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1194727
test al, al
je 0x11946e5
cmp dword [ebp - 0x1c], 0
jne 0x1194727
mov al, byte [esi]
test al, al
je 0x11946f5
cmp al, 0x20
ja 0x11946f5
inc esi
mov dword [ebp - 0x20], esi
jmp 0x11946e5
test byte [ebp - 0x3c], 1
je 0x1194701
movzx eax, word [ebp - 0x38]
jmp 0x1194704
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x11a4f18], eax
cmp dword [0x11a4f0c], 0
jne 0x119477b
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1194736
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1194749
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x11946d2
cmp dword [0x11a4f1c], 0
jne 0x119478a
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x11a4f18]
jmp 0x11947ab
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01195869
ret
call fcn.01195971
jmp 0x11945d2
Function at 0x1197c3c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x1197c6b
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.01194fde
add esp, 0x14
jmp 0x1197d49
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x1197d49
test al, 0x40
jne 0x1197d49
test al, 2
je 0x1197c8d
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x1197d49
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x1197c4d
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x1197d39
cmp eax, 0xffffffff
je 0x1197d39
test byte [esi + 0xc], 0x82
jne 0x1197d0e
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x1197cf9
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x1197cf9
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x1197cfe
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x1197d0e
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x1197d2c
mov eax, dword [esi + 0xc]
test al, 8
je 0x1197d2c
test eax, 0x400
jne 0x1197d2c
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x1197d4c
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100038c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100038cf
pop dword [ebp - 0x10]
mov eax, 0xae3e0f20
add eax, 0x61c229af
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x9fdf1021
sub dword [ebp - 0x20], 0x518ccad6
mov dword [ebp - 0x1c], 0x23aa014e
add dword [ebp - 0x1c], 0xe894af7
mov dword [ebp - 0x18], 0x1aa01172
sub dword [ebp - 0x18], 0xce53cd44
mov dword [ebp - 0x14], 0x26cf3048
add dword [ebp - 0x14], 0xd930cfb8
lea eax, [ebp - 0x20]
push eax
mov eax, 0xc792eff9
add eax, 0x486eb00f
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x9dd08db7
sub dword [ebp - 0x20], 0x295e2461
mov dword [ebp - 0x1c], 0x84df054b
sub dword [ebp - 0x1c], 0x4372a3d6
mov dword [ebp - 0x18], 0x5f67a16d
add dword [ebp - 0x18], 0x407caff
mov dword [ebp - 0x14], 0x35e47b1a
sub dword [ebp - 0x14], 0x35e47b1a
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x3b53dab6
add eax, 0xd4adc556
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39207
push 0
call eax
mov ecx, 0x4393
xor edi, edi
add edi, eax
mov ebx, 0xf501d102
sub ebx, 0xe4ff8702
add ebx, dword [ebp - 0x10]
mov edx, 0x9cca2e84
add dword [ebp - 8], esi
mov esi, dword [ebx]
xor dword [ebp - 0xc], edx
add esi, edx
mov dword [edi], esi
sub dword [ebp - 8], 0x379c193c
add edi, 0x81a1cbcb
sub edi, 0x81a1cbc7
add ebx, 0x5af5a32b
sub ebx, 0x5af5a327
loop 0x100039e7
add eax, 0x1011f
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219