joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi + 0x960]
mov dword [ebp - 4], eax
cmp esi, eax
ja 0x10001d76
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp esi, 0x1dc0
ja 0x10001d0f
je 0x10001d76
mov eax, esi
sub eax, 0x1d48
je 0x10001d02
sub eax, 0x28
je 0x10001ce5
sub eax, 0x28
jne 0x10001d6a
cmp dword [0x1009a120], eax
setne byte [ebp + 8]
jmp 0x10001d6a
push 0
push 0
push dword [ebp + 0x10]
push 0x10038c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1009a120], eax
jmp 0x10001d6a
mov eax, dword [ebp + 0x10]
mov dword [0x1009a130], eax
mov dword [eax + 0x38], ebx
jmp 0x10001d6a
mov eax, esi
sub eax, 0x3436
je 0x10001d26
sub eax, 0x28
jne 0x10001d6a
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0x14]
test edi, edi
je 0x10001d65
mov ecx, dword [edi + 4]
mov eax, ebx
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10001d55
test dl, dl
je 0x10001d51
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10001d55
add ecx, 2
add eax, 2
test dl, dl
jne 0x10001d35
xor eax, eax
jmp 0x10001d5a
sbb eax, eax
or eax, 1
test eax, eax
je 0x10001d65
mov edi, dword [edi + 8]
test edi, edi
jne 0x10001d30
mov esi, 0x3436
add esi, 0x28
cmp esi, dword [ebp - 4]
jbe 0x10001cb1
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007df0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080d08
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x10098070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
lea esi, [ebx + 0x117]
mov dword [ebp - 0x68], esi
cmp ebx, esi
ja 0x10008038
mov eax, 0x2c
mov dword [ebp - 0x6c], 0x22
mov ecx, 0x7022
mov dword [ebp - 0x70], 0x3a
lea edx, [eax + 0x40]
nop word [eax + eax]
cmp ebx, 0x70d9
ja 0x10007fbc
je 0x10007fb2
mov eax, ebx
sub eax, 0x10c9
je 0x10007ec3
sub eax, 0x3436
je 0x10007ea2
sub eax, 9
jne 0x10007fe7
mov bl, 1
jmp 0x1000803b
cmp byte [edi + 0x11], 0
je 0x10007e9b
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x10008024
mov byte [edi + 0x11], 0
jmp 0x10007fdd
push dword [0x1009a130]
push 0x6d18
call fcn.100353b0
add esp, 8
test al, al
je 0x10007fdd
nop
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
mov byte [ebp - 4], 2
mov esi, 0x4700
nop dword [eax]
mov eax, esi
sub eax, 0x4700
je 0x10007f56
sub eax, 0x48
je 0x10007f34
sub eax, 0x48
jne 0x10007f73
push dword [edi + 0x24]
lea eax, [ebp - 0x48]
push eax
mov eax, dword [edi + 0x20]
call eax
add esp, 8
jmp 0x10007f6b
cmp dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x48]
push eax
push dword [edi + 0x38]
push 0x71e0
call fcn.100411f0
add esp, 0x10
jmp 0x10007f73
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x4b7a
call fcn.10038190
add esp, 0xc
test al, al
je 0x10008028
add esi, 0x48
cmp esi, 0x4790
jbe 0x10007f10
lea ecx, [ebp - 0x48]
call fcn.1005b950
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.1005b950
push dword [0x1009a130]
push 0x6d18
call fcn.100353b0
add esp, 8
test al, al
jne 0x10007ee0
mov esi, dword [ebp - 0x68]
jmp 0x10007fdd
mov word [ebp - 0x18], ax
mov word [ebp - 0x17], cx
jmp 0x10007fec
mov eax, ebx
sub eax, 0x70e2
je 0x10008010
sub eax, 9
je 0x10007ff9
sub eax, 9
jne 0x10007fe7
push 2
push 0x1008e258
mov ecx, edi
call fcn.1005b3d0
mov ecx, 0x7022
mov edx, 0x6c
mov eax, 0x2c
add ebx, 9
cmp ebx, esi
jbe 0x10007e70
jmp 0x10008038
lea ecx, [ebp - 0x18]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008000
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
jmp 0x10007fd6
mov eax, dword [ebp - 0x6c]
mov word [ebp - 0x15], dx
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 0x70]
mov word [ebp - 0x13], ax
jmp 0x10007fe7
xor bl, bl
jmp 0x1000803b
lea ecx, [ebp - 0x48]
call fcn.1005b950
lea ecx, [ebp - 0x30]
call fcn.1005b950
mov bl, byte [ebp - 0x61]
lea ecx, [ebp - 0x60]
call fcn.1005b950
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100685c5
mov esp, ebp
pop ebp
ret
Function at 0x100107c0
Capabilities:
Create process on windows
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2bc0
call fcn.10069860
mov eax, dword [0x10098070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1e50], eax
jmp 0x100107f3

Function at 0x10020300
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x10098070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x148], eax
jmp 0x10020330
Function at 0x100301e0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea esi, [ebx + 0x90]
mov dword [ebp - 8], esi
cmp ebx, esi
ja 0x10030292
nop dword [eax]
cmp ebx, 0x538f
ja 0x10030260
je 0x1003025b
mov eax, ebx
sub eax, 0x392
je 0x10030253
sub eax, 3
je 0x10030247
sub eax, 0x43e5
jne 0x10030284
mov eax, dword [ebp + 8]
push dword [eax + 0x104]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10030284
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 4]
mov byte [eax + 0x13e], 1
jmp 0x10030284
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x10030284
mov ecx, dword [ebp + 8]
jmp 0x10030284
mov eax, ebx
sub eax, 0x5392
je 0x1003027f
sub eax, 3
jne 0x10030284
out 0xdd, al
pop edx
push cs
push eax
pop ebp
ret 4
call fcn.10052590
add ebx, 3
mov dword [ebp + 0xc], ebx
cmp ebx, esi
jbe 0x10030200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031820
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov al, byte [esp + 3]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea ebx, [edi + 0x1ef]
cmp edi, ebx
ja 0x10031a3e
mov esi, dword [ebp + 8]
mov byte [esp + 0xf], al
nop dword [eax + eax]
cmp edi, 0x5567
ja 0x10031926
je 0x1003190a
mov eax, edi
sub eax, 0x397b
je 0x100318ee
sub eax, 0x63
je 0x100318cd
sub eax, 0x63
jne 0x1003197b
push esi
push dword [esi]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10010790
push 0x554
push eax
call fcn.1000aa60
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
cmp byte [esi + 0x13e], 0
je 0x10031991
push esi
push 0
push 0x6780
call fcn.1003c3a0
add esp, 0xc
mov byte [esi + 0x13e], 0
push 0xfa
call edi
jmp 0x100318a0
push 0
push 0x12e0
push esi
call fcn.10002540
add esp, 0xc
test al, al
mov al, byte [esp + 0xf]
je 0x10031a3e
jmp 0x1003197f
push esi
push 0x7d54
call fcn.100281a0
add esp, 8
test al, al
mov al, byte [esp + 0xf]
je 0x10031a3e
jmp 0x1003197f
cmp dword [esi + 0x1c], 0
jne 0x10031a3c
mov ecx, esi
call fcn.10002430
test al, al
jne 0x1003197b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
sub eax, 0x55ca
je 0x1003194b
sub eax, 0x63
je 0x10031943
sub eax, 0x63
mov al, byte [esp + 0xf]
je 0x10031a3e
jmp 0x1003197f
mov al, 1
mov byte [esp + 0xf], al
jmp 0x1003197f
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov dword [esi + 0x20], eax
mov edx, 0x30
add eax, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10068ec6
add esp, 4
mov dword [esi + 8], eax
mov al, byte [esp + 0xf]
add edi, 0x63
cmp edi, ebx
jbe 0x10031850
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x151e
call fcn.10049290
add esp, 8
test al, al
jne 0x100319cc
cmp byte [esi + 0x13c], al
je 0x10031a30
push esi
push 0
push 0x6780
call fcn.1003c3a0
add esp, 0xc
push 0xfa
call edi
jmp 0x100318a0
push 0
push 0
push esi
push 0
push 0x4434
push 0
call fcn.1003b470
add esp, 0x18
test al, al
je 0x10031a09
cmp byte [esi + 0x13d], 0
jne 0x10031a30
push esi
push 0x3afb
call fcn.10029380
add esp, 8
push 0xfa
call edi
jmp 0x100318a0
cmp byte [esi + 0x13d], 0
je 0x10031a22
push 0
push esi
push 0x2b65
call fcn.100057c0
add esp, 0xc
push 0x2d20
push esi
call fcn.100579b0
add esp, 8
push 0xfa
call edi
jmp 0x100318a0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10040ad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002eaa0
Function at 0x10049fc0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
jmp 0x10049fda
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
add edx, 0x7b8
cmp dword [ebp - 0x10], edx
ja 0x1004a160
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x4b77
ja 0x1004a032
cmp dword [ebp - 8], 0x4b77
je 0x1004a0a9
mov ecx, dword [ebp - 8]
sub ecx, 0x4a73
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xd0
ja case.0x1004a02b.1
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x1004a184]
jmp dword [eax*4 + 0x1004a16c]
cmp dword [ebp - 8], 0x7ba5
ja 0x1004a062
cmp dword [ebp - 8], 0x7ba5
je 0x1004a0b2
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
sub dword [ebp - 0xc], 0x4bab
je 0x1004a074
sub dword [ebp - 0xc], 0x34
je 0x1004a13c
jmp case.0x1004a02b.1
cmp dword [ebp - 8], 0x7bd9
je 0x1004a14b
jmp case.0x1004a02b.1
je case.0x1004a02b.208
call fcn.10059f30
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
jmp case.0x1004a02b.1
push ebx
push esi
test dl, dl
je 0x1004a13c
jmp case.0x1004a02b.1
add esp, 0xfffffff0
jmp case.0x1004a02b.1
mov eax, esi
test bl, bl
jmp case.0x1004a02b.1
mov dword [ebp - 0x38], 0
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov ecx, 9
lea esi, [ebp - 0x38]
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 9
lea esi, [ebp - 0x5c]
mov edi, 0x1009a2cc
rep movsd dword es:[edi], dword [esi]
movzx eax, word [0x1009a2cc]
test eax, eax
jne 0x1004a105
push 0x1009a2cc
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [0x1009a2cc]
cmp ecx, 9
je 0x1004a126
movzx edx, word [0x1009a2cc]
cmp edx, 6
je 0x1004a126
mov dword [ebp - 0x14], 0
jmp 0x1004a12d
mov dword [ebp - 0x14], 1
mov al, byte [ebp - 0x14]
mov byte [ebp - 1], al
jmp case.0x1004a02b.1
call fcn.10048e30
jmp case.0x1004a02b.1
ret
mov ebx, edx
mov esi, eax
push 1
push 0
push 0
jmp case.0x1004a02b.1
mov al, byte [ebp - 1]
jmp 0x1004a163
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.10044c80
jmp 0x10049fd1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005cd80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1005cdb1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1005cda0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1006d200
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1008519c
push 0x10085194
push str.FlsAlloc
push 0
call fcn.1006d180
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1006d232
push dword [ebp + 8]
mov ecx, esi
call fcn.1006920f
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1006d274
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x100851ac
push 0x100851a4
push str.FlsGetValue
push 2
call fcn.1006d180
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x1006d2a5
mov ecx, esi
call fcn.1006920f
call esi
jmp 0x1006d2ab
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x1006d2ae
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x100851b4
push 0x100851ac
push str.FlsSetValue
push 3
call fcn.1006d180
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x1006d2e2
mov ecx, esi
call fcn.1006920f
call esi
jmp 0x1006d2e8
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x402fe6
Capabilities:
Create pipe
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.0040b470
mov eax, dword [0x245310c]
mov ecx, dword [0x2452b9c]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x4030c4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov ebx, ecx
mov dword [esp + 0xc], eax
cmp dword [0x245310c], 0x959
jne 0x4030b1
push esi
lea eax, [esp + 0x814]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0x402c34
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
push esi
call edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call edi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
lea eax, [esp + 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
call fcn.00402dc7
add ebx, 8
dec dword [esp + 0xc]
jne 0x40301d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407cde
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43abd0]
jne 0x407ce8
repz ret
jmp fcn.0040ad4c

Function at 0x4085eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43abd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405326
and dword [ebp - 0x14], 0
cmp dword [0x4406dc], 0
mov dword [ebp - 0x18], eax
jne 0x40869e
push 0x4029fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408746
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4029f0
push ebx
call edi
test eax, eax
je 0x408746
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4029e0
push ebx
mov dword [0x4406dc], eax
call edi
push eax
call esi
push 0x4029cc
push ebx
mov dword [0x4406e0], eax
call edi
push eax
call esi
push 0x4029b0
push ebx
mov dword [0x4406e4], eax
call edi
push eax
call esi
mov dword [0x4406ec], eax
test eax, eax
je 0x40869e
push 0x402998
push ebx
call edi
push eax
call esi
mov dword [0x4406e8], eax
mov eax, dword [0x4406e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4086f7
cmp dword [0x4406ec], ecx
je 0x4086f7
push eax
call esi
push dword [0x4406ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4086f7
test ebx, ebx
je 0x4086f7
call edi
test eax, eax
je 0x4086ee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4086ee
test byte [ebp - 8], 1
jne 0x4086f7
or dword [ebp + 0x10], 0x200000
jmp 0x40872a
mov eax, dword [0x4406e0]
cmp eax, dword [ebp - 0x18]
je 0x40872a
push eax
call esi
test eax, eax
je 0x40872a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40872a
mov eax, dword [0x4406e4]
cmp eax, dword [ebp - 0x18]
je 0x40872a
push eax
call esi
test eax, eax
je 0x40872a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4406dc]
call esi
test eax, eax
je 0x408746
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408748
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407cde
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4a694a69
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x31910e84
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1002a96
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x100b2d0]
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov dword [ebp - 4], eax
je 0x1002bda
cmp byte [edi], 0
je 0x1002bda
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0100160f
push 0x100134c
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.010021e6
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x24c], eax
je 0x1002bd9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push edi
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0100160f
test byte [ebp - 0x248], 0x10
lea eax, [ebp - 0x21c]
je 0x1002b7d
push 0x1001348
push eax
call ebx
test eax, eax
je 0x1002baa
push 0x1001344
lea eax, [ebp - 0x21c]
push eax
call ebx
test eax, eax
je 0x1002baa
lea eax, [ebp - 0x21c]
push eax
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.010021e6
push 0x1001271
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.010066cf
lea eax, [ebp - 0x108]
push eax
call fcn.01002a96
jmp 0x1002baa
push eax
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.010021e6
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002b0e
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop ebx
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.010064de
leave
ret 4

Function at 0x1002e55
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push edi
push 0xa
push dword [ebp + 8]
xor edi, edi
push edi
call esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, dword [ebp + 0x10]
ja 0x1002ec0
cmp dword [ebp + 0xc], edi
je 0x1002ec0
cmp ebx, edi
je 0x1002ea0
push 0xa
push dword [ebp + 8]
push edi
call esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, edi
jne 0x1002ea4
xor eax, eax
jmp 0x1002ec2
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1002f6b
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
mov cl, byte [edi]
xor ebx, ebx
cmp cl, bl
je 0x1002fda
push esi
lea esi, [edi + 1]
mov al, byte [esi]
cmp al, 0x3a
mov dword [ebp + 8], ebx
jne 0x1002f95
cmp byte [edi + 2], 0x5c
jne 0x1002f95
lea esi, [edi + 3]
jmp 0x1002fd5
cmp cl, 0x5c
jne 0x1002fd5
cmp al, cl
jne 0x1002fd5
lea esi, [edi + 2]
mov dword [ebp + 8], 2
jmp 0x1002fd5
cmp byte [esi], 0x5c
jne 0x1002fcc
cmp byte [esi - 1], 0x3a
je 0x1002fcc
cmp dword [ebp + 8], ebx
je 0x1002fbf
dec dword [ebp + 8]
jmp 0x1002fcc
push ebx
push edi
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
cmp byte [esi], bl
jne 0x1002faa
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1003346
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b2d0]
push ebx
push esi
mov esi, dword [0x100bc40]
test esi, esi
mov dword [ebp - 4], eax
mov ebx, esi
je 0x10033a6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100c884], 0
jne 0x1003395
cmp dword [0x100c490], 0
jne 0x1003395
push 0x80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebx]
mov esi, dword [esi + 4]
call edi
push ebx
call edi
test esi, esi
mov ebx, esi
jne 0x100336e
pop edi
xor eax, eax
cmp dword [0x100c880], eax
pop esi
pop ebx
je 0x1003400
cmp dword [0x100c884], eax
jne 0x1003400
cmp dword [0x100c490], eax
jne 0x1003400
push 0x100bc44
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100c494], 0x20
je 0x10033e9
lea eax, [ebp - 0x108]
push eax
call fcn.01006666
push 0x1001344
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x108]
push eax
call fcn.01002a96
cmp word [0x100ba64], 1
je 0x1003418
cmp dword [0x100c880], 0
je 0x1003418
call fcn.01001a5b
mov ecx, dword [ebp - 4]
and dword [0x100c880], 0
call fcn.010064de
leave
ret