joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100115e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
push ebx
push esi
push edi
mov ecx, dword [edx]
cmp word [ecx], ax
jne 0x1001163e
mov esi, dword [ecx + 0x3c]
add esi, ecx
cmp dword [esi], 0x4550
jne 0x1001163e
mov edx, dword [edx + 4]
mov edi, dword [esi + 0xa8]
sub edx, ecx
cmp edi, edx
ja 0x1001163e
mov ebx, dword [esi + 0xac]
lea eax, [ebx + edi]
cmp eax, edx
ja 0x1001163e
push ebx
lea eax, [ecx + edi]
push 0
push eax
call fcn.1008e330
add esp, 0xc
mov dword [esi + 0xac], 0
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret

Function at 0x10011650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b642d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100dcdc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jne 0x10011692
xor al, al
jmp 0x10011729
push 0x100ba764
push ecx
lea eax, [ebp - 0x40]
xor bl, bl
push eax
call fcn.1000c0d0
push edi
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.1000e810
add esp, 0x18
lea ecx, [ebp - 0x40]
call fcn.100076d0
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
push 0
cmova eax, dword [ebp - 0x28]
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001171f
mov edx, dword [esi]
lea eax, [ebp - 0x44]
mov ecx, dword [esi + 4]
push 0
push eax
sub ecx, edx
mov dword [ebp - 0x44], 0
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 4]
mov eax, 1
sub ecx, dword [esi]
cmp dword [ebp - 0x44], ecx
movzx ebx, bl
cmove ebx, eax
lea ecx, [ebp - 0x28]
call fcn.100076d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008c563
mov esp, ebp
pop ebp
ret
Function at 0x10011750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b647b
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x100dcdc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x450], esi
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jne 0x1001179b
xor al, al
jmp 0x10011938
push 0x100ba764
push ecx
lea eax, [ebp - 0x440]
xor bl, bl
push eax
call fcn.1000c0d0
push edi
push eax
lea eax, [ebp - 0x428]
mov dword [ebp - 4], 0
push eax
call fcn.1000e810
add esp, 0x18
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 2
call fcn.100076d0
cmp dword [ebp - 0x414], 7
lea eax, [ebp - 0x428]
push 0
cmova eax, dword [ebp - 0x428]
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, eax
mov dword [ebp - 0x448], edx
cmp edx, 0xffffffff
je 0x1001192b
mov eax, dword [esi + 4]
mov ecx, dword [esi]
sub eax, ecx
je 0x10011954
add ecx, dword [ecx + 0x3c]
mov eax, 0x8664
mov ebx, dword [ebp + 0x14]
cmp word [ecx + 4], ax
jne 0x10011849
cmp dword [ecx], 0x4550
jne 0x10011849
mov eax, dword [ecx + 0xac]
test eax, eax
je 0x10011849
add eax, ebx
mov dword [ecx + 0xac], eax
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 0x444], 0
sub eax, ecx
je 0x10011954
push 0
lea edi, [ebp - 0x444]
push edi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.1008e330
add esp, 0xc
test ebx, ebx
je 0x10011911
mov eax, 0x400
nop word [eax + eax]
cmp ebx, 0x400
mov dword [ebp - 0x44c], 0
mov edi, ebx
push 0
cmova edi, eax
call fcn.10097044
push eax
call fcn.100970c3
add esp, 8
xor esi, esi
test edi, edi
je 0x100118e5
nop dword [eax + eax]
call fcn.100970a2
and al, 0x7f
add al, 0x80
mov byte [ebp + esi - 0x410], al
inc esi
cmp esi, edi
jb 0x100118d0
push 0
lea eax, [ebp - 0x44c]
push eax
push edi
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x448]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 0x400
sub ebx, edi
jne 0x100118a0
mov esi, dword [ebp - 0x450]
mov eax, dword [esi + 4]
sub eax, dword [esi]
cmp dword [ebp - 0x444], eax
push dword [ebp - 0x448]
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x428]
call fcn.100076d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008c563
mov esp, ebp
pop ebp
ret
call fcn.100119e0
int3
Function at 0x10012500
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b6555
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100dcdc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x38], edi
mov eax, dword [edi]
test eax, eax
je 0x10012663
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10012663
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push dword [ebp - 0x34]
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10012659
mov ecx, dword [esi + 0x3c]
add ecx, esi
je 0x10012659
movzx eax, word [ecx + 0x14]
xor ebx, ebx
add eax, 0x28
add eax, ecx
movzx ecx, word [ecx + 6]
test ecx, ecx
je 0x100125b4
mov ebx, dword [eax + 4]
lea eax, [eax + 0x28]
add ebx, dword [eax - 0x28]
sub ecx, 1
jne 0x100125a6
push esi
push 0
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
cmp byte [edi + 0x1c], 0
je 0x10012654
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.1002f220
lea eax, [ebp - 0x28]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.100130e0
add esp, 0x10
push ebx
sub esp, 0xc
mov byte [ebp - 4], 1
mov esi, esp
mov dword [ebp - 0x2c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x44]
je 0x1001263b
push eax
mov ecx, esi
call fcn.10002400
mov edi, dword [esi]
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
sub esi, eax
push esi
push eax
push edi
call fcn.1008ddb0
mov ecx, dword [ebp - 0x2c]
lea eax, [esi + edi]
mov edi, dword [ebp - 0x38]
add esp, 0xc
mov dword [ecx + 4], eax
mov ecx, edi
call fcn.10012ea0
lea ecx, [ebp - 0x44]
mov esi, eax
call fcn.100024b0
lea ecx, [ebp - 0x28]
call fcn.100013f0
lea eax, [esi + ebx]
jmp 0x10012666
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapFree]
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008c563
mov esp, ebp
pop ebp
ret
Function at 0x10013220
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x1001325c
cmp dword [esi + 0x18], 0xf
lea eax, [esi + 4]
jbe 0x1001323b
mov eax, dword [eax]
push 0
push 0
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x100133d2
mov ecx, esi
call fcn.10012500
mov ecx, dword [esi]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
jns 0x1001327d
cmp ecx, 0xffffffff
je 0x100133d2
push ecx
jmp 0x100133c6
mov byte [ebp - 1], 0
cmp ecx, 0xffffffff
je 0x100133be
push 0
push 0
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100133be
cmp dword [ebp - 8], 1
jne 0x100133be
mov eax, dword [ebp + 8]
inc ebx
mov cl, byte [ebp - 1]
lea edx, [eax + 4]
push edi
movzx edi, cl
mov byte [eax], cl
inc edi
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ebp + 8], ecx
sub ecx, eax
sar ecx, 2
mov byte [ebp - 2], 0
mov dword [ebp - 0xc], edx
cmp edi, ecx
jae 0x100132f4
lea eax, [eax + edi*4]
mov dword [edx + 4], eax
jmp 0x1001332e
jbe 0x1001332e
mov eax, dword [edx + 8]
sub eax, dword [edx]
sar eax, 2
cmp edi, eax
jbe 0x10013310
lea eax, [ebp + 0xb]
mov ecx, edx
push eax
push edi
call fcn.10011d80
jmp 0x1001332e
sub edi, ecx
shl edi, 2
push edi
push 0
push dword [ebp + 8]
call fcn.1008e330
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, edi
mov dword [ecx + 4], eax
xor edi, edi
mov eax, dword [esi]
mov dword [ebp - 8], 0
cmp eax, 0xffffffff
je 0x1001339a
push 0
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001339a
cmp dword [ebp + 8], 4
jne 0x1001339a
mov eax, dword [ebp - 0xc]
add ebx, 4
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [eax + edi*4], ecx
inc edi
movzx eax, byte [ebp - 1]
cmp edi, eax
jbe 0x10013330
mov bl, byte [ebp - 2]
pop edi
xor bl, 1
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
mov bl, 1
cmp eax, 0xffffffff
je 0x100133b0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
pop edi
xor bl, 1
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x100133d2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10026850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b810d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100dcdc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1008c525
mov edi, eax
add esp, 4
test edi, edi
je 0x100268ed
push 1
mov dword [ebp - 4], 0
call fcn.1008b0c6
add esp, 4
mov dword [edi + 4], eax
jmp 0x100268ef
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.1001afd0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x1002694a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x1002694a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10026966
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10026989
cmp byte [ebp + 0xc], 0
je 0x10026975
push esi
call fcn.1008b5cf
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10026995
mov esi, str.ios_base::badbit_set
jmp 0x100269a5
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.100269d0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.1001c190
push 0x100d5544
lea eax, [ebp - 0x28]
push eax
call fcn.1008d986
int3
Function at 0x1002a370
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b86bd
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x100dcdc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
jne 0x1002a3b8
xor al, al
jmp 0x1002a54b
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push ecx
push eax
mov dword [ebp - 0x278], 0
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1002a539
mov esi, dword [ebp + 8]
nop dword [eax]
nop dword [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x248]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002a410
sub eax, edx
lea ecx, [ebp - 0x28]
sar eax, 1
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.10007490
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10029ef0
add esp, 8
cmp dword [eax + 0x14], 7
mov edi, dword [eax + 0x10]
jbe 0x1002a451
mov eax, dword [eax]
cmp dword [esi + 0x14], 7
mov edx, esi
mov ecx, dword [esi + 0x10]
jbe 0x1002a45e
mov edx, dword [esi]
cmp ecx, edi
jne 0x1002a478
push ecx
push eax
push edx
call fcn.1002a570
add esp, 0xc
mov byte [ebp - 0x26d], 1
test eax, eax
je 0x1002a47f
mov byte [ebp - 0x26d], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 7
jbe 0x1002a4b9
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1002a4af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a566
push ecx
push edx
call fcn.1008c555
add esp, 8
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xffffffff
cmp ecx, 7
jbe 0x1002a50a
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1002a500
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a566
push ecx
push edx
call fcn.1008c555
add esp, 8
cmp byte [ebp - 0x26d], 0
jne 0x1002a52f
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1002a3f0
jmp 0x1002a539
mov dword [ebp - 0x278], 1
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x278]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008c563
mov esp, ebp
pop ebp
ret
call fcn.10091a2f
int3
Function at 0x10032bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100dcdc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], esi
mov word [ebp - 0xe], 0x6635
lea edx, [ecx + 1]
mov word [ebp - 0x24], 0x3135
movups xmmword [esi], xmm0
mov word [ebp - 0x27], 0x7973
mov word [ebp - 0x16], 0x5333
mov dword [ebp - 0x1d], 0x63473953
mov word [ebp - 0x1f], 0x4636
mov dword [ebp - 0xb], 0x55396d
mov word [ebp - 0x22], 0x305a
mov word [ebp - 0x19], 0x666d
mov dword [ebp - 0x12], 0x4f664139
mov byte [ebp - 0xc], 0x33
mov word [ebp - 0x14], 0x3274
mov byte [ebp - 0x25], 0x30
mov byte [ebp - 0x17], 0x4e
mov byte [ebp - 0x28], 0x79
mov byte [ebp - 0x20], 0x57
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10032c50
sub ecx, edx
lea eax, [ebp - 0x28]
push ecx
push eax
mov ecx, esi
call fcn.10003b70
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1008c563
mov esp, ebp
pop ebp
ret

Function at 0x10032c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100dcdc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x17], 0x32363137
lea edx, [ecx + 1]
mov word [ebp - 0x10], 0x3732
movups xmmword [esi], xmm0
mov dword [ebp - 0xb], 0x303030
mov word [ebp - 0x13], 0x3039
mov byte [ebp - 0x18], 0x31
mov word [ebp - 0xe], 0x3030
mov byte [ebp - 0x11], 0x30
mov byte [ebp - 0xc], 0x30
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10032ce0
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, esi
call fcn.10003b70
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1008c563
mov esp, ebp
pop ebp
ret
Function at 0x10034fc0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
cmp dword [esi + 0x14], 7
jbe 0x10034fd3
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003502c
mov eax, 0x10624dd3
mov edi, 1
imul dword [ebp + 0xc]
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
cmp ebx, edi
jle 0x10035025
nop dword [eax]
cmp dword [esi + 0x14], 7
mov eax, esi
jbe 0x1003500a
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1003502c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, ebx
jl 0x10035000
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
Function at 0x10039910
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [0x100dcdc0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x234]
push 0x1ab
push eax
mov dword [0x100dcd70], 0x927c0
call fcn.1002f510
add esp, 8
cmp dword [eax + 0x14], 7
jbe 0x1003994d
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0x21c]
push str._s___s_
push eax
call fcn.1000e620
mov ecx, dword [ebp - 0x220]
add esp, 0x10
cmp ecx, 7
jbe 0x100399a3
mov edx, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10039999
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039b3f
push ecx
push edx
call fcn.1008c555
add esp, 8
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.1008e330
lea eax, [ebp - 0x234]
push 0x1ad
push eax
call fcn.1002f510
add esp, 0x14
cmp dword [eax + 0x14], 7
jbe 0x100399d2
mov eax, dword [eax]
push 0x100
lea ecx, [ebp - 0x204]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0x220]
cmp ecx, 7
jbe 0x10039a25
mov edx, dword [ebp - 0x234]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10039a1b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039b44
push ecx
push edx
call fcn.1008c555
add esp, 8
lea ecx, [ebp - 0x244]
mov dword [0x100dcd70], 0x92ba8
push ecx
lea ecx, [ebp - 0x288]
mov dword [ebp - 0x288], 0x44
push ecx
push 0
push 0
xor eax, eax
mov dword [ebp - 0x25c], 1
cmp dword [ebp - 0x208], 7
xorps xmm0, xmm0
push 0
push 0
mov word [ebp - 0x246], ax
mov word [ebp - 0x258], ax
lea eax, [ebp - 0x21c]
cmova eax, dword [ebp - 0x21c]
push 0
push 0
push eax
lea eax, [ebp - 0x204]
movlpd qword [ebp - 0x284], xmm0
push eax
movlpd qword [ebp - 0x27c], xmm0
movlpd qword [ebp - 0x274], xmm0
movlpd qword [ebp - 0x26c], xmm0
movlpd qword [ebp - 0x264], xmm0
movlpd qword [ebp - 0x256], xmm0
movlpd qword [ebp - 0x24e], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x240]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100dcd70], 0x92f90
call esi
push dword [ebp - 0x244]
call esi
mov ecx, dword [ebp - 0x208]
mov dword [0x100dcd70], 0x93378
cmp ecx, 7
jbe 0x10039b30
mov edx, dword [ebp - 0x21c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10039b26
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10039b49
push ecx
push edx
call fcn.1008c555
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1008c563
mov esp, ebp
pop ebp
ret
call fcn.10091a2f
call fcn.10091a2f
call fcn.10091a2f
int3
Function at 0x10042b20
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10042bb6
push esi
call fcn.10052e40
add esp, 4
test al, al
jne 0x10042bb6
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x10042b45
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.100607b0
add esp, 0xc
test eax, eax
je 0x10042b79
sub eax, esi
push eax
push 0x2e
push esi
call fcn.100607b0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10042b7b
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x10042bae
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.10051200
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x10042b90
pop edi
movzx eax, bl
pop ebx
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1004caf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x6f9], 0
je 0x1004cb84
cmp dword [edi + 0x1a8], 0
je 0x1004cb41
push esi
push 1
push edi
call fcn.1003dc30
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1a8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.1003dc30
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov ecx, edx
sub ecx, 0
je 0x1004cb55
sub ecx, 1
je 0x1004cb55
sub ecx, 1
jne 0x1004cb84
push dword [edi + 0x148]
lea eax, [edx*2 + 0x100bce88]
push 1
add eax, edx
push 2
push eax
call fcn.1009cd3a
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.1009cd3a
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret