joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100867e0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100fc03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000c090
add esp, 4
movzx edx, al
test edx, edx
jne 0x10086834
mov eax, dword [ebp + 0x18]
mov dword [eax], 3
xor al, al
jmp 0x100869e2
mov ecx, dword [ebp + 8]
call fcn.10002cb0
push eax
call fcn.10009480
mov ecx, eax
call fcn.10009570
movzx ecx, al
test ecx, ecx
jne 0x10086860
mov edx, dword [ebp + 0x18]
mov dword [edx], 4
xor al, al
jmp 0x100869e2
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10002dc0
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
je 0x10086967
lea ecx, [ebp - 0x44]
call fcn.10003560
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
push ecx
call fcn.10088ac0
add esp, 4
movzx edx, al
test edx, edx
jne 0x100868cc
mov eax, dword [ebp + 0x18]
mov dword [eax], 5
mov byte [ebp - 0x46], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10002d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10002d10
mov al, byte [ebp - 0x46]
jmp 0x100869e2
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10088db0
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x10086917
mov edx, dword [ebp + 0x18]
mov dword [edx], 5
mov byte [ebp - 0x47], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10002d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10002d10
mov al, byte [ebp - 0x47]
jmp 0x100869e2
cmp dword [ebp + 0x14], 2
jne 0x10086935
lea eax, [ebp - 0x2c]
push eax
call fcn.10088800
add esp, 4
lea ecx, [ebp - 0x2c]
push ecx
call fcn.10088290
add esp, 4
push 4
push 0
lea ecx, [ebp - 0x2c]
call fcn.10002cb0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
lea ecx, [ebp - 0x44]
call fcn.10002cb0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10002d10
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x45], 0
mov edx, dword [ebp + 0x18]
mov dword [edx], 6
cmp dword [ebp + 0x10], 0
jne 0x1008699a
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.1000e0f0
add esp, 0xc
mov byte [ebp - 0x45], al
jmp 0x100869b1
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.1000e0d0
add esp, 0xc
mov byte [ebp - 0x45], al
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x100869ca
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov cl, byte [ebp - 0x45]
mov byte [ebp - 0x48], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10002d10
mov al, byte [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10088f98
mov esp, ebp
pop ebp
ret
Function at 0x10088f00
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jbe 0x10088f4e
cmp dword [ebp + 0xc], 0xffffffff
jbe 0x10088f21
mov dword [ebp - 0xc], 0xffffffff
jmp 0x10088f27
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.dll_SystemFunction036
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 4]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x10088f0c
mov esp, ebp
pop ebp
ret

Function at 0x100a2b3a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a27fa
Function at 0x100b2890
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c8cb6
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.100898c0
mov eax, dword [0x100fc03c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1030], 0
lea ecx, [ebp - 0x102c]
call fcn.10003560
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x1014]
call fcn.10006360
lea ecx, [ebp - 0x1014]
call fcn.100061a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1014]
call fcn.10006ac0
push 0x1000
push 0
lea eax, [ebp - 0x1010]
push eax
call fcn.1008bb90
add esp, 0xc
push 0
push 0x1a
lea ecx, [ebp - 0x1010]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100b2941
lea edx, [ebp - 0x1010]
push edx
lea ecx, [ebp - 0x102c]
call fcn.10002ce0
lea ecx, [ebp - 0x1014]
call fcn.10006dc0
lea eax, [ebp - 0x102c]
push eax
mov ecx, dword [ebp + 8]
call fcn.10003520
mov ecx, dword [ebp - 0x1030]
or ecx, 1
mov dword [ebp - 0x1030], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.10006220
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x102c]
call fcn.10002d10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10088f98
mov esp, ebp
pop ebp
ret
Function at 0x42b3f7
Capabilities:
Send data

Disassembly:
mov ecx, dword [0x4b2d8c]
test ecx, ecx
jne 0x42b41a
xor eax, eax
push eax
push eax
push 0x1427
push dword [0x4bf7b8]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
ret
mov eax, dword [0x4b2d80]
push esi
push edi
push 0x4b2d88
push dword [0x4b2d84]
add eax, ecx
push eax
push dword [0x4b2348]
xor edi, edi
inc edi
mov dword [0x4b4fd8], edi
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x42b472
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp esi, 0x3e5
je 0x42b49b
call fcn.0043714c
test eax, eax
je 0x42b46e
push esi
push 0x4043b0
call main
pop ecx
pop ecx
xor eax, eax
jmp 0x42b49d
xor eax, eax
cmp dword [0x4b2314], 3
mov dword [0x4b4fd8], eax
jne 0x42b488
mov dword [0x4b2304], edi
push eax
push eax
push 0x1427
push dword [0x4bf7b8]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, edi
pop edi
pop esi
ret
Function at 0x44c40e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x44c41d
pop dword [ebp - 0x30]
mov eax, 0xa3f82de7
add eax, 0x5c4c9636
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x1c13c26f
sub dword [ebp - 0x40], 0xcdc17d24
mov dword [ebp - 0x3c], 0x65a13d5a
add dword [ebp - 0x3c], 0xcc920eeb
mov dword [ebp - 0x38], 0x149a5d5d
add dword [ebp - 0x38], 0x37b1e6d1
mov dword [ebp - 0x34], 0x334a3f35
add dword [ebp - 0x34], 0xccb5c0cb
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xb775af8
add dword [ebp - 0x40], 0x68fb0e5e
mov dword [ebp - 0x3c], 0x6a0618b4
sub dword [ebp - 0x3c], 0x2899b73f
mov dword [ebp - 0x38], 0xe5de1675
sub dword [ebp - 0x38], 0x826eaa09
mov dword [ebp - 0x34], 0xaf5f9955
add dword [ebp - 0x34], 0x50a066ab
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x4cf53
push 0
call eax
mov ecx, 0xdb9ca0fe
add ecx, 0x24639d59
xor edx, edx
add edx, eax
mov ebx, 0x44e2b540
sub ebx, 0x4495cd40
add ebx, dword [ebp - 0x30]
mov edi, 0xce26732a
sub edi, 0xf1be2ff3
mov esi, dword [ebx]
add dword [ebp - 0x14], 0xcd0f559e
xor esi, edi
xor dword [ebp - 0x20], 0x920ad5bf
mov dword [edx], esi
mov dword [ebp - 0x1c], 0x585b9598
add edx, 0x1c93e52b
add edx, 0xe36c1ad9
add ebx, 0x3d6bbee1
add ebx, 0xc2944123
loop 0x44c537
add eax, 0x56a3d260
sub eax, 0x56a2e631
mov ebx, eax
add eax, 5
mov ecx, 0xe63e6a67
sub ecx, 0xe5fe6a67
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x45cd7f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a95d0]
jne 0x45d56f
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4c1f10], eax
mov dword [0x4c1f0c], ecx
mov dword [0x4c1f08], edx
mov dword [0x4c1f04], ebx
mov dword [0x4c1f00], esi
mov dword [0x4c1efc], edi
mov word [0x4c1f28], ss
mov word [0x4c1f1c], cs
mov word [0x4c1ef8], ds
mov word [0x4c1ef4], es
mov word [0x4c1ef0], fs
mov word [0x4c1eec], gs
pushfd
pop dword [0x4c1f20]
mov eax, dword [ebp]
mov dword [0x4c1f14], eax
mov eax, dword [ebp + 4]
mov dword [0x4c1f18], eax
lea eax, [ebp + 8]
mov dword [0x4c1f24], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4c1e60], 0x10001
mov eax, dword [0x4c1f18]
mov dword [0x4c1e14], eax
mov dword [0x4c1e08], 0xc0000409
mov dword [0x4c1e0c], 1
mov eax, dword [0x4a95d0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4a95d4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x4c1e58], eax
push 1
call fcn.00461e8e
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x41c780
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x4c1e58], 0
jne 0x45d65b
push 1
call fcn.00461e8e
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x473b89
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x4747a8
call fcn.0045feda
mov esi, dword [ebp + 8]
cmp esi, dword [0x4c2d00]
jne 0x473ba7
xor eax, eax
jmp 0x473d0c
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
or edi, 0xffffffff
test ebx, ebx
jne 0x473bca
cmp dword [0x4c2cfc], ebx
je 0x473ccc
push 2
pop edi
jmp 0x473be4
cmp ebx, 1
jne 0x473ccc
mov eax, esi
call fcn.00473b25
test al, al
je 0x473ccc
xor edi, edi
and dword [ebp - 0x10], 0
lea ecx, [ebp + 0xb]
mov dword [ebp - 0x20], edi
call fcn.00473b47
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, edi
jmp 0x473c8f
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x473c18
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
push dword [esi]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp dword [ebp - 0x18], 2
mov edi, eax
jae 0x473c44
cmp dword [ebp - 0x1c], 1
je 0x473c41
cmp dword [ebp - 0x1c], 2
jne 0x473c44
push 2
pop edi
mov eax, edi
call fcn.004733a7
test eax, eax
je 0x473cac
push 0x1c0496
xor edi, edi
push edi
call main
mov eax, dword [esi + 8]
movzx eax, word [eax + 6]
push dword [ebp - 0x10]
and eax, 0xf
imul eax, eax, 0xc
mov ecx, 0x4c2d08
mov dword [eax + 0x4aa988], edi
call main
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call fcn.00473435
mov edi, eax
test edi, edi
je 0x473c0c
jmp 0x473cbd
push dword [ebp - 0x10]
mov ecx, 0x4c2d08
call main
test edi, edi
je 0x473cd8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.00473b68
mov ecx, dword [ebp - 0x18]
inc ebx
cmp ebx, 2
jl 0x473bb2
jmp 0x473ce7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb]
call fcn.00473b68
mov ecx, dword [ebp - 0x18]
test edi, edi
jne 0x473d02
cmp dword [ebp - 0x1c], 2
je 0x473cfa
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x473d0a
push ecx
call main
jmp 0x473d08
push esi
call main
mov ecx, eax
mov eax, ecx
call fcn.0045ffb2
ret 4
Function at 0x52e090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd7000]
push edi
jmp 0x52e0aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52e0b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e0a0
mov eax, 1
add ebx, ebx
jne 0x52e0c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52e0d4
jne 0x52e0f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e0f3
dec eax
add ebx, ebx
jne 0x52e0e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52e0b8
add ebx, ebx
jne 0x52e0ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52e145
xor ecx, ecx
sub eax, 3
jb 0x52e10b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52e17a
sar eax, 1
mov ebp, eax
jmp 0x52e116
add ebx, ebx
jne 0x52e116
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e0e4
inc ecx
add ebx, ebx
jne 0x52e124
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52e0e4
add ebx, ebx
jne 0x52e131
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52e126
jne 0x52e142
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52e126
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52e164
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52e156
jmp 0x52e0a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52e164
add edi, ecx
jmp 0x52e0a6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52e182
cmp byte [edi], 0x11
jne 0x52e182
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52e187
lea edi, [esi + 0x127000]
mov eax, dword [edi]
or eax, eax
je 0x52e1ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1839e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x183b64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52e1b4
mov ecx, edi
jns 0x52e1e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x183b68]
or eax, eax
je 0x52e1f9
mov dword [ebx], eax
add ebx, 4
jmp 0x52e1d1
call dword [esi + 0x183b78]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x52e230
cmp al, 0xef
ja 0x52e223
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52e205
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x52e212
mov ebp, dword [esi + 0x183b6c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52e264
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x4372e1
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x298]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x4373be
push pe_nt_image_headers32
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.WSOCK32.dll_gethostname]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x4373be
mov eax, dword [eax + 0xc]
xor edx, edx
cmp dword [eax], edx
je 0x43734a
mov ecx, eax
lea ecx, [ecx]
add ecx, 4
inc edx
cmp dword [ecx], 0
jne 0x437341
cmp esi, edx
jle 0x437368
push 0x497814
push edi
call fcn.004127d8
add esp, 8
call dword [sym.imp.WSOCK32.dll_WSACleanup]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + esi*4 - 4]
push 4
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.00412420
mov edx, dword [ebp - 4]
add esp, 0xc
push edx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004136b0
lea ecx, [ebp - 0x108]
push 0xffffffffffffffff
push ecx
call fcn.004368bd
mov esi, eax
push esi
push edi
call fcn.004127d8
push esi
call fcn.00410eb6
add esp, 0x1c
call dword [sym.imp.WSOCK32.dll_WSACleanup]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x4946c4
push edi
call fcn.004127d8
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43741b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x20c
push 0x104
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00437167
lea edx, [ebp - 0x20c]
push edx
call fcn.00412781
add esp, 0x10
test eax, eax
je 0x437463
cmp word [ebp + eax*2 - 0x20e], 0x5c
lea eax, [ebp + eax*2 - 0x20e]
jne 0x437463
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x437509
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x43749d
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4374a2
mov al, 1
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x43750d
push esi
push edi
lea edi, [ebp - 0x20c]
call fcn.004101a0
mov esi, eax
push 0x5c
push esi
call fcn.00413eea
add esp, 8
test eax, eax
jne 0x4374d1
push esi
call fcn.00410eb6
add esp, 4
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.0043741b
push esi
mov bl, al
call fcn.00410eb6
add esp, 8
test bl, bl
je 0x437500
push 0
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test al, 0x10
jne 0x437497
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4377e6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x437800
test al, 0x10
je 0x437800
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100080d6
pop dword [ebp - 0x50]
mov eax, 0x8f7ec5d8
add eax, 0x8081bafe
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x38fee
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x47f9
xor esi, esi
add esi, eax
mov edi, 0x8cffca62
sub edi, 0x7cfe4462
add edi, dword [ebp - 0x50]
mov edx, 0x237e156c
add dword [ebp - 0x38], esi
mov ebx, dword [edi]
xor dword [ebp - 0x48], ebx
add ebx, edx
xor dword [ebp - 0xc], esi
mov dword [esi], ebx
sub dword [ebp - 0x10], 0xed0b95a
add esi, 4
add edi, 0x8347f502
sub edi, 0x8347f4fe
loop 0x10008126
add eax, 0x112b7
xor ebx, ebx
add ebx, eax
add eax, 0xf16fe6b5
add eax, 0xe901950
mov ecx, 0x66c46a24
sub ecx, 0x56c46a24
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1000c871
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp esi, 0x7ff80000
jbe 0x1000c892
lea edi, [esi - 0x7ff80000]
cmp esi, 0x80000000
jb 0x1000c897
mov ebx, 0xfff80000
jmp 0x1000c89d
mov edi, 0x10000
lea ebx, [esi + 0x7ff80000]
mov edx, dword [0x10013e68]
mov eax, dword [0x10013e60]
test edx, edx
jne 0x1000c8b8
test eax, eax
je 0x1000c8cb
mov edx, eax
mov dword [0x10013e68], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x1000c8cb
cmp ecx, edi
jb 0x1000c8cb
cmp ecx, ebx
jbe 0x1000c9ab
mov edx, eax
test eax, eax
jmp 0x1000c8ed
test edx, edx
je 0x1000c8e8
mov eax, dword [edx + 8]
test eax, eax
je 0x1000c8e8
cmp eax, edi
jb 0x1000c8e8
cmp eax, ebx
jbe 0x1000c9ab
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x10013e68], edx
jne 0x1000c8d1
and esi, 0xffff0000
mov eax, 0x40000000
cmp esi, eax
jbe 0x1000c9d0
lea edx, [esi - 0x40000000]
mov ecx, edi
call fcn.100080c7
mov edx, eax
test edx, edx
jne 0x1000c971
mov eax, 0x40000000
cmp esi, eax
jbe 0x1000c93e
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.100080c7
mov edx, eax
test edx, edx
jne 0x1000c971
mov eax, 0x40000000
cmp esi, eax
jae 0x1000c953
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.100080c7
mov edx, eax
test edx, edx
jne 0x1000c971
mov edx, esi
mov ecx, edi
call fcn.100080c7
mov edx, eax
test edx, edx
jne 0x1000c971
mov edx, ebx
mov ecx, esi
call fcn.100080c7
mov edx, eax
test edx, edx
je 0x1000c9ee
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x10013e60]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x10013e68], edx
mov dword [0x10013e60], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x1000c99b
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, edi
jb 0x1000c9ee
cmp esi, ebx
ja 0x1000c9ee
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.1000ec20
add esp, 0xc
mov eax, esi
jmp 0x1000c9f0
jae 0x1000c920
lea ecx, [esi + 0x40000000]
mov edx, ebx
call fcn.100080c7
mov edx, eax
test edx, edx
jne 0x1000c971
jmp 0x1000c940
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1000ca7b
Capabilities:
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [0x10013e58]
xor ebx, ebx
test edi, edi
je 0x1000cab8
push esi
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1000caa9
mov esi, dword [edi]
push edi
call fcn.1000dd99
mov edi, esi
pop ecx
test esi, esi
jne 0x1000ca8a
jmp 0x1000cab7
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
mov dword [0x10013e70], ebx
pop esi
mov dword [0x10013e58], edi
mov eax, ebx
pop edi
pop ebx
ret

Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0