joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61006a40
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0xffff
je 0x61006a53
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 1
jne 0x61006a4f
mov edx, 0x6110d008
mov dword [0x610eda88], edx
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x610eda8c], eax
xor eax, eax
mov dword [0x610eda90], eax
mov eax, 0x6110e120
mov dword [0x610eda88], eax
jmp 0x61006a4f

Function at 0x61006d30
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x65f4]
test esi, esi
jne 0x61006d86
mov ebx, 1
mov dword [edi + 0x65f4], ebx
mov ecx, dword [0x610f08a0]
test ecx, ecx
jne 0x61006e5b
xor esi, esi
mov ebx, edi
lea esi, [esi]
lea edi, [edi]
cmp byte [edi + esi + 0x6590], 0
jne 0x61006d90
inc esi
add ebx, 0x104
cmp esi, 0x63
jle 0x61006d70
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
test eax, eax
je 0x61006dde
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x61006db4
xor eax, eax
mov byte [edi + esi + 0x6590], al
jmp 0x61006d7a
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x61006cc4
mov dword [esp + 8], 0x61006ca0
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61006da9
call sub.KERNEL32.dll_GetLastError
mov edx, eax
xor eax, eax
cmp edx, 0x20
mov dword [edi + 0x65f4], eax
je 0x61006e21
mov eax, dword [0x61148914]
movzx eax, byte [eax + 0xc]
shr al, 2
and eax, 1
test al, al
je 0x61006e0a
cmp edx, 5
je 0x61006e21
mov eax, dword [0x610f08a0]
test eax, eax
je 0x61006da9
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x61006ce0
jmp 0x61006dc0
mov eax, dword [0x610f08a0]
test eax, eax
je 0x61006d7a
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x61006d09
mov dword [esp + 8], 0x61006ca0
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61006d7a
mov dword [esp + 0xc], 0x61006d18
mov dword [esp + 8], 0x61006ca0
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61006d5f
Function at 0x6101c3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edx, dword [ebp + 0xc]
push esi
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x6101c443
lea esi, [esi]
lea edi, [edi]
lea edi, [ecx + 0x38]
mov esi, edx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6101c42a
xor al, byte [eax + 0x610ef1e4]
cmp al, byte [edi - 1]
jne 0x6101c435
test al, al
jne 0x6101c41b
mov eax, 1
jmp 0x6101c437
xor eax, eax
test eax, eax
mov esi, ecx
jne 0x6101c445
mov ecx, dword [ecx]
test ecx, ecx
jne 0x6101c410
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x6101c4a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x128]
push edi
push esi
push ebx
sub esp, 0x19c
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], 0x105
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetModuleFileNameA
mov dword [ebp - 0x17c], eax
sub esp, 0xc
lea ecx, [ebp - 0x128]
mov dword [esp + 4], ecx
mov dword [esp], 0x610edaf0
call fcn.6101c3f0
test eax, eax
mov esi, eax
je 0x6101c4fd
inc dword [eax + 0x2c]
mov edx, esi
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x158]
xor edi, edi
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
mov edx, dword [ebp + 0x10]
sub esp, 4
mov eax, dword [edx + 0x40]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], 0x1c
lea ecx, [ebp - 0x178]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
xor edx, edx
test eax, eax
je 0x6101c4f3
cmp dword [ebp - 0x168], 0x10000
je 0x6101c630
mov eax, dword [ebp - 0x16c]
inc edi
mov edx, dword [ebp - 0x178]
add eax, edx
cmp edi, 0x3e8
jle 0x6101c520
test esi, esi
je 0x6101c616
mov dword [esi + 0x2c], 1
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x128]
mov dword [esi + 0x34], eax
lea eax, [esi + 0x38]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov ecx, dword [ebp + 0xc]
lea edx, [esi + 8]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0x2c]
mov dword [edx + 4], eax
mov eax, dword [ecx + 0x30]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0x34]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x38]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x3c]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x40]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x28]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov dword [esi + 0x30], eax
mov eax, dword [edx]
test eax, eax
jne 0x6101c5e9
mov eax, edx
add eax, 0xc
mov dword [edx], eax
mov dword [eax], esi
mov ecx, dword [ebp + 8]
mov dword [esi], 0
mov eax, dword [ecx]
inc dword [ecx + 0x14c]
cmp dword [ebp + 0x14], 2
mov dword [esi + 4], eax
mov dword [ecx], esi
jne 0x6101c4f1
inc dword [ecx + 0x150]
jmp 0x6101c4f1
mov edx, 0x9e
mov eax, 0x6101c460
call fcn.61022e70
xor edx, edx
jmp 0x6101c4f3
cmp edi, 0x3e8
je 0x6101c4f3
mov eax, dword [ebp - 0x13c]
xor edx, edx
mov ebx, dword [ebp - 0x178]
mov dword [ebp - 0x18c], eax
mov eax, ebx
div dword [ebp - 0x18c]
test edx, edx
je 0x6101c669
mov ecx, dword [ebp - 0x18c]
mov eax, ebx
sub eax, edx
lea ebx, [ecx + eax]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x2000
mov dword [esp + 4], 0x140
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
test eax, eax
jne 0x6101c6a0
test esi, esi
je 0x6101c553
jmp 0x6101c572
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x140
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov esi, eax
jmp 0x6101c690
Function at 0x61021090
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x2c
mov dword [ebp - 0x18], ecx
lea ecx, [edx - 1]
lea edx, [edx + 0xe]
mov dword [ebp - 0x14], eax
and edx, 0xfffffff0
mov eax, edx
mov dword [ebp - 0x1c], esp
call sym.cygwin1.dll__alloca
mov dword [esp + 8], ecx
lea edi, [esp + 0x14]
mov eax, dword [ebp - 0x14]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym.cygwin1.dll__memcpy
mov byte [edi + esi - 1], 0
lea eax, [ebp - 0xd]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov ebx, eax
test eax, eax
jle 0x61021188
inc ebx
cmp dword [ebp - 0x18], 9
je 0x610211e0
xor esi, esi
mov eax, dword [ebp - 0x18]
mov edx, ebx
call fcn.61002990
mov dword [ebp - 0x20], eax
test esi, esi
jne 0x610211c5
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x20]
mov dword [esp], edi
add eax, esi
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
test eax, eax
je 0x61021180
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x61021150
mov esp, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x61021020
mov dword [esp + 8], 0x61020fe0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6102113c
mov eax, dword [ebp - 0x20]
call fcn.61002b30
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x61021198
mov esp, dword [ebp - 0x1c]
xor eax, eax
jmp 0x61021142
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], 0x61021060
mov dword [esp + 8], 0x61020fe0
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61021191
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
jmp 0x61021116
add ebx, esi
jmp 0x61021101
Function at 0x610212f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, ecx
mov dword [ebp - 0x10], eax
test ecx, ecx
mov byte [ebp - 0x11], dl
je 0x6102133b
mov edi, dword [eax]
mov esi, ebx
xor edx, edx
mov ecx, dword [eax + 4]
cld
and eax, 0xff
dec ecx
js 0x6102132a
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x61021326
xor al, byte [eax + 0x610ef1e4]
cmp al, byte [edi - 1]
jne 0x61021331
test al, al
jne 0x61021314
mov eax, 1
jmp 0x61021333
xor eax, eax
test eax, eax
je 0x61021468
mov ecx, dword [0x610f08a0]
test ecx, ecx
jne 0x610214f0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
test edx, edx
je 0x610214c8
test ebx, ebx
je 0x610214bd
mov esi, dword [0x610ed768]
cmp dword [esi + 0x154], 0xffffffff
jne 0x610213c0
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x6102138e
nop
lea esi, [esi]
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.61002cc0
mov eax, dword [eax]
mov dword [esp + 0xc], 0x610212a0
mov dword [esp + 8], 0x61021260
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61021380
mov ecx, dword [ebp - 0x10]
movzx eax, byte [ecx + 8]
xor al, 1
and al, 1
test al, al
je 0x610214a7
mov ecx, dword [ecx + 0xc]
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi]
mov dword [esp + 4], eax
lea eax, [ecx + esi + 0x88]
mov dword [esp], eax
call edx
test eax, eax
mov esi, eax
je 0x610214a0
cmp byte [ebp - 0x11], 0
je 0x6102140a
test ebx, ebx
je 0x610214a0
cmp esi, 0x610edac9
je 0x610214a0
mov dword [esp], esi
call sym.cygwin1.dll__strlen
mov edx, dword [ebp - 0x10]
mov edi, dword [edx + 4]
add eax, edi
lea edx, [eax + 1]
mov eax, 9
call fcn.61002990
mov ecx, dword [ebp - 0x10]
mov ebx, eax
mov eax, dword [ecx]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym.cygwin1.dll__strcpy
mov dword [esp + 4], esi
mov eax, ebx
mov edi, dword [ebp - 0x10]
mov esi, dword [edi + 4]
add eax, esi
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov ecx, dword [0x610f08a0]
test ecx, ecx
jne 0x61021472
mov edx, ebx
add esp, 0x1c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi]
mov dword [esp + 0xc], 0x610212bf
mov dword [esp + 8], 0x61021260
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61021466
mov edx, 0x610edac9
jmp 0x61021468
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + esi + 0x88]
mov edx, dword [edx + eax - 1]
jmp 0x610213d6
mov esi, dword [0x610ed768]
jmp 0x610213c0
test ebx, ebx
jne 0x61021380
mov eax, dword [ebp - 0x10]
mov ecx, 9
mov edx, dword [eax + 4]
mov eax, dword [eax]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.61021090
movzx eax, byte [ebp - 0x11]
mov dword [esp + 0xc], 0x610212dd
mov dword [esp + 8], 0x61021260
mov dword [esp + 4], 0x40
mov dword [esp + 0x10], eax
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61021349
Function at 0x61024580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edx, dword [0x610e9770]
movzx ebx, byte [ebp + 0x10]
mov esi, dword [ebp + 8]
test edx, edx
mov eax, dword [ebp + 0xc]
je 0x6102468d
test eax, eax
jne 0x61024683
mov dword [esp + 8], 1
xor bl, 1
xor edi, edi
mov dword [esp + 4], esi
movzx eax, bl
mov dword [esp + 0xc], eax
mov dword [esp], 0x610ee70c
call fcn.61024430
mov dword [esp], 0x610244e0
call fcn.6108c640
lea esi, [esi]
mov dword [esp], 0x610ee70c
call fcn.61024490
test eax, eax
je 0x6102465e
mov dword [esp], 0x61024509
mov eax, dword [0x610ee714]
xor ebx, ebx
mov esi, 0x610ee73c
mov dword [esp + 8], eax
mov eax, dword [0x610ee72c]
mov dword [esp + 4], eax
call fcn.6108c640
lea esi, [esi]
lea edi, [edi]
mov eax, dword [esi + ebx*4 + 0xc]
test ebx, ebx
mov dword [esp + 8], eax
mov eax, 0x61024515
je 0x61024636
mov eax, 0x61024518
mov dword [esp + 4], eax
inc ebx
mov dword [esp], 0x6102451b
call fcn.6108c640
cmp ebx, 3
jbe 0x61024620
mov dword [esp], 0x61024522
inc edi
call fcn.6108c640
cmp edi, 0xf
jle 0x610245e0
cmp edi, 0x10
mov eax, 0x61024540
je 0x6102466d
mov eax, 0x61024564
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], 0x61024565
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.6108c640
call fcn.610240c0
jmp 0x610245a9
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x61025490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
mov ecx, 7
lea edi, [ebp - 0x38]
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
cld
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
jne 0x610254d4
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x610255c0
mov ecx, dword [0x61110fa0]
mov edx, dword [ebp - 0x34]
lea eax, [ecx + 0x13]
and eax, 0xfffffff0
call sym.cygwin1.dll__alloca
mov dword [esp + 0x1c], 0
test edx, edx
lea edi, [esp + 0x1c]
je 0x61025501
cmp dword [ebp - 0x28], 0x1000
je 0x61025555
xor esi, esi
mov edi, dword [0x610f08a0]
test edi, edi
jne 0x61025520
xor eax, eax
test esi, esi
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x18], esi
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x61025426
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x61025400
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6102550d
cmp edx, dword [0x610e909c]
je 0x610255b6
mov dword [esp + 4], edi
lea eax, [ecx + 2]
xor esi, esi
mov dword [esp + 8], eax
mov dword [esp], edx
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
test eax, eax
je 0x61025503
mov esi, 0x61110ba0
mov ecx, dword [0x61110fa0]
cld
and eax, 0xff
dec ecx
js 0x610255a0
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6102559c
xor al, byte [eax + 0x610ef1e4]
cmp al, byte [edi - 1]
jne 0x610255a7
test al, al
jne 0x6102558a
mov eax, 1
jmp 0x610255a9
xor eax, eax
test eax, eax
sete al
movzx esi, al
jmp 0x61025503
mov esi, 1
jmp 0x61025503
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x61025460
mov dword [esp + 8], 0x61025400
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x610254d4

Function at 0x61025840
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword fs:[4]
mov eax, dword [edx - 0x404]
test eax, eax
jne 0x61025860
mov esp, ebp
pop ebp
jmp fcn.61089fb0
xor eax, eax
mov dword [edx - 0x404], eax
lea eax, [edx - 0x3fc]
mov dword [edx - 0x408], eax
mov eax, dword [0x610ef740]
mov eax, dword [eax + 0x1e0]
mov dword [esp + 4], eax
mov eax, dword [edx - 0xfe0]
mov dword [esp], eax
call fcn.61025fb0
sub esp, 8
jmp 0x61025857
Function at 0x61026730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 0x610ee790
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, dword [0x610ee5ec]
sub esp, 4
shl ebx, 8
or ebx, 0x10000
inc eax
mov dword [0x610ee5ec], eax
dec eax
je 0x61026775
mov dword [esp], 0
mov eax, dword [0x610ef740]
mov edx, ebx
call fcn.61069e80
mov dword [esp + 4], 0xfffffff1
mov eax, dword [0x610eda84]
mov dword [esp], eax
call sub.KERNEL32.dll_SetThreadPriority
sub esp, 8
call sub.KERNEL32.dll_GetCurrentThread
mov dword [esp], eax
mov dword [esp + 4], 0xf
call sub.KERNEL32.dll_SetThreadPriority
mov eax, dword [0x610e90bc]
sub esp, 8
mov dword [esp], eax
call fcn.6109ae80
mov eax, dword [0x610e90bc]
mov dword [esp], eax
call fcn.6109add0
mov eax, dword [0x61147130]
test eax, eax
je 0x610267e1
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x6102682b
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x61026801
mov eax, dword [0x610ef820]
mov dword [esp], eax
call sub.KERNEL32.dll_SetEvent
sub esp, 4
mov eax, ebx
call fcn.61006160
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x610266f6
mov dword [esp + 8], 0x610266e0
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x610267ea
mov dword [esp + 0xc], 0x61026711
mov dword [esp + 8], 0x610266e0
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
mov eax, dword [0x61147130]
jmp 0x610267d2

Function at 0x61026970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x118]
push ebx
sub esp, 0x134
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6102686c
mov dword [esp], eax
call fcn.61084380
sub esp, 0xc
mov ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x610ef7a0
call sub.KERNEL32.dll_CreateMutexA
mov dword [0x610ee7a8], eax
sub esp, 0xc
test eax, eax
je 0x61026a82
mov edx, 0x61026878
mov eax, 0x6110b078
mov ebx, 0x61110ba0
call fcn.61090770
mov dword [0x610ee5f0], eax
mov dword [esp], ebx
mov byte [0x61110ba0], 0
mov dword [esp + 4], 0x3fe
call sub.KERNEL32.dll_GetSystemDirectoryA
xor edx, edx
sub esp, 8
mov eax, edx
mov ah, al
mov al, byte [ebx]
cmp al, ah
je 0x61026a0b
inc ebx
test al, al
jne 0x610269fe
xor ebx, ebx
mov eax, ebx
cmp eax, 0x61110ba0
mov edx, eax
je 0x61026a92
cmp byte [eax - 1], 0x5c
je 0x61026a24
mov byte [eax], 0x5c
inc eax
mov byte [edx + 1], 0
mov ecx, dword [0x610f08a0]
sub eax, 0x61110ba0
mov dword [0x61110fa0], eax
test ecx, ecx
jne 0x61026a50
mov dword [esp], 0x610ee790
call sub.KERNEL32.dll_InitializeCriticalSection
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x61110ba0
mov dword [esp + 0xc], 0x610268a0
mov dword [esp + 8], 0x61026859
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61026a38
mov dword [esp + 4], ebx
mov dword [esp], 0x61026900
call fcn.610065d0
mov dword [esp], 0x61026940
call fcn.610065d0
mov esi, esi
Function at 0x61027c00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], esi
lea eax, [ebp - 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov ebx, eax
cmp eax, 0xffffffff
je 0x61027c80
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
cmp eax, ebx
je 0x61027c71
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_SetLastError
sub esp, 4
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
jne 0x61027c55
mov eax, 1
jmp 0x61027c65
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x61027c55
jmp 0x61027c28

Function at 0x61028240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x610e9044]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [0x611111e0]
test eax, eax
jne 0x61028267
mov eax, dword [ebp - 0x10]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x280]
mov dword [esp], eax
call sym.cygwin1.dll__strlen
mov dword [ebp - 0x14], eax
mov ebx, dword [0x611111e0]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx]
and ecx, 3
mov dword [ebp - 0x18], ecx
test edx, edx
je 0x6102825c
cmp byte [edx], 0
jne 0x610282a6
mov ecx, dword [ebx + 4]
mov eax, ecx
and eax, 3
cmp eax, dword [ebp - 0x18]
je 0x6102832a
mov dword [esp], edx
call sym.cygwin1.dll__strlen
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x280]
mov ecx, dword [ebp - 0x14]
lea esi, [ecx + edx]
sub esi, eax
cmp eax, ecx
jbe 0x610282d0
add ebx, 8
mov eax, dword [ebx]
test eax, eax
mov edx, eax
jne 0x61028290
jmp 0x6102825c
cmp esi, edx
je 0x610282e6
movzx eax, byte [esi - 1]
xor edx, edx
cmp al, 0x2f
je 0x61028326
cmp al, 0x5c
je 0x61028326
test dl, dl
je 0x610282c3
mov edx, dword [ebx + 4]
mov eax, edx
and eax, 3
cmp eax, dword [ebp - 0x18]
jne 0x610282c3
mov edi, dword [ebx]
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6102830a
xor al, byte [eax + 0x610ef1e4]
cmp al, byte [edi - 1]
jne 0x61028315
test al, al
jne 0x610282fb
mov eax, 1
jmp 0x61028317
xor eax, eax
test eax, eax
je 0x610282c3
and edx, 0xfffffffc
mov dword [ebp - 0x10], edx
jmp 0x6102825c
mov dl, 1
jmp 0x610282e2
and ecx, 0xfffffffc
mov dword [ebp - 0x10], ecx
jmp 0x6102825c
Function at 0x61029e00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], esi
mov esi, eax
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x61029ef2
mov eax, dword [esi + 0x26c]
xor edx, edx
test eax, eax
je 0x61029e40
cmp eax, 0xf7
je 0x61029e40
cmp byte [esi + 0x278], 0
je 0x61029e40
mov edx, 1
mov esi, esi
test edx, edx
jne 0x61029ee0
mov eax, dword [esi + 0x26c]
cmp eax, 0xfe
je 0x61029ed0
cmp eax, 0xfe
ja 0x61029ec0
cmp eax, 0xfd
je 0x61029eb3
mov dword [ebx + 0x10], 0x21b6
call sym.cygwin1.dll__geteuid32
mov dword [ebx + 0x18], eax
call sym.cygwin1.dll__getegid32
mov dword [ebx + 0x1c], eax
lea eax, [ebx + 0x40]
mov word [ebx + 0x14], 1
mov dword [ebx + 0x48], 0x400
mov dword [esp], eax
call fcn.610a3490
mov eax, dword [ebx + 0x40]
sub esp, 4
mov edx, dword [ebx + 0x44]
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x34], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [ebx + 0x10], 0x1092
jmp 0x61029e6a
cmp eax, 0xff
jne 0x61029e63
mov dword [ebx + 0x10], 0x11b6
jmp 0x61029e6a
mov dword [ebx + 0x10], 0x1124
jmp 0x61029e6a
mov edx, ebx
mov eax, esi
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp fcn.61030380
mov dword [esp + 0xc], 0x61029dec
mov dword [esp + 8], 0x61029dc0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61029e1d

Function at 0x6102da00
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
movzx eax, byte [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov dword [esp], edi
mov byte [ebp - 0x11], al
call fcn.6102c7a0
mov edx, dword [0x610ee7b4]
movsx eax, word [edx + 0x46a]
cmp ebx, eax
jle 0x6102da80
mov ebx, eax
movsx eax, word [edx + 0x46c]
cmp esi, eax
jle 0x6102da71
lea esi, [eax - 1]
mov word [ebp - 0x10], si
mov eax, dword [edi]
mov word [ebp - 0xe], bx
mov dword [esp], edi
call dword [eax + 0xc8]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_SetConsoleCursorPosition
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
shr eax, 0x1f
dec eax
and esi, eax
jmp 0x6102da42
test ebx, ebx
js 0x6102da95
cmp byte [ebp - 0x11], 0
je 0x6102da34
movsx eax, word [edx + 0x468]
add ebx, eax
jmp 0x6102da34
xor ebx, ebx
jmp 0x6102da34
Function at 0x6102f8d0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x118]
mov dword [esp + 8], 0x100
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.cygwin1.dll__strncpy
mov byte [ebp - 0x18], 0
mov eax, dword [0x610ee7a8]
mov dword [esp + 4], 0x3a98
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
test eax, eax
je 0x6102f923
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x6102f980
mov dword [esp], ebx
call sub.KERNEL32.dll_SetConsoleTitleA
mov eax, dword [0x610ee7a8]
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [0x610f08a0]
sub esp, 4
test eax, eax
jne 0x6102f950
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6102f884
mov dword [esp + 8], 0x6102f866
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6102f947
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6102f8a0
mov dword [esp + 8], 0x6102f866
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6102f923