joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100271a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x46
xor eax, eax
nop
mov dl, byte [edi + eax - 0xc5704]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100271cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100271b0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100274c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x6a
xor eax, eax
nop
mov dl, byte [edi + eax - 0x9a3f37]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100274ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x100274d0
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret 4

Function at 0x10027600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x21
xor eax, eax
nop
mov dl, byte [edi + eax - 0x220b2e2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002762d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10027610
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret 4

Function at 0x10027d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x5d
xor eax, eax
nop
mov dl, byte [edi + eax - 0xe3c6be]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10027d2d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10027d10
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10027fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x28
xor eax, eax
nop
mov dl, byte [edi + eax - 0x918e56]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002800d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x10027ff0
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x10028020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x46
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2438fd0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002804d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x12
jl 0x10028030
pop edi
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret 4

Function at 0x100282f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x4e
xor eax, eax
nop
mov dl, byte [edi + eax - 0x25f116]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002831d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10028300
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x100285e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x6e
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1409ac8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002860d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x100285f0
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x10028aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x34
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2108a51]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10028acd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xf
jl 0x10028ab0
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret 4

Function at 0x10028b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x6c
xor eax, eax
nop
mov dl, byte [edi + eax - 0xb23d0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10028b6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x10028b50
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x10028c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x70
xor eax, eax
nop
mov dl, byte [edi + eax - 0x94a55c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10028c6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10028c50
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10028c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x22
xor eax, eax
nop
mov dl, byte [edi + eax - 0x509bf9]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10028cad
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10028c90
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10028de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x73
xor eax, eax
nop
mov dl, byte [edi + eax - 0x178c420]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10028e0d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10028df0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10029120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x34
xor eax, eax
nop
mov dl, byte [edi + eax - 0x17a4af8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002914d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10029130
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x10029160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x39
xor eax, eax
nop
mov dl, byte [edi + eax - 0xe481d5]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002918d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10029170
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x100299d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x68
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1244006]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100299fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100299e0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10029a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x1b
xor eax, eax
nop
mov dl, byte [edi + eax - 0x11d1fbf]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10029a3d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x16
jl 0x10029a20
pop edi
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret 4

Function at 0x10029a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x4c
xor eax, eax
nop
mov dl, byte [edi + eax - 0x3f27520]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10029a7d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x14
jl 0x10029a60
pop edi
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret 4

Function at 0x10029b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x44
xor eax, eax
nop
mov dl, byte [edi + eax - 0xe627e0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10029b9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10029b80
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10029bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 5
xor eax, eax
nop
mov dl, byte [edi + eax - 0x160e018]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10029bdd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1c
jl 0x10029bc0
pop edi
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
ret 4

Function at 0x10029d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x11
xor eax, eax
nop
mov dl, byte [edi + eax - 0x188ff2b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10029d9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10029d80
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4
Function at 0x1002c4b0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x20
mov eax, dword [0x1004c040]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0
push 0
push 0x8003
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c510
push 0
sub ecx, edx
push ecx
push esi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x10
push eax
lea eax, [esp + 0x20]
push eax
push 2
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x21
call fcn.1003c667
mov ebx, eax
add esp, 4
xor esi, esi
mov edi, ebx
nop dword [eax]
movzx ecx, byte [esp + esi + 0x18]
push ecx
push str._02x
push edi
call fcn.1002c320
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x10
jl 0x1002c570
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c1fe
add esp, 0x20
ret

Function at 0x1002c5b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x400
mov esi, ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [esp + 0x10], 0x3369952f
mov edi, eax
xor dword [esp + 0x10], 0xded1160f
mov ebp, dword [esp + 0x10]
xor ebx, ebx
nop
mov ecx, ebx
shr ecx, 1
mov eax, ecx
xor eax, ebp
test bl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, ebp
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, ebp
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, ebp
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, ebp
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, ebp
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, ebp
test dl, 1
cmovne ecx, eax
mov dword [esp + 0x14], ecx
shr ecx, 1
mov eax, ecx
xor eax, ebp
test byte [esp + 0x14], 1
cmovne ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, 0x100
jl 0x1002c5e0
mov al, byte [esi]
mov ebx, 0xffffffff
test al, al
je 0x1002c687
nop dword [eax + eax]
movzx ecx, bl
lea esi, [esi + 1]
movsx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [esi]
xor ebx, dword [edi + ecx*4]
test al, al
jne 0x1002c670
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
not ebx
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1002cf00
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x1004c040]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x28], 1
push ebx
mov ebx, dword [esp + 0x28]
jne 0x1002d07e
call fcn.1002c6a0
xor ecx, ecx
nop word [eax + eax]
cmp eax, dword [ecx + 0x1004c144]
je 0x1002d07e
add ecx, 4
cmp ecx, 8
jb 0x1002cf30
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push ebx
call esi
mov ecx, 0xa4
xor edx, edx
mov al, byte [edx + 0x100467a0]
xor al, cl
inc ecx
mov byte [esp + edx + 0x14], al
and ecx, 0x800000ff
jns 0x1002cf72
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1002cf55
push 0x1002c340
lea eax, [esp + 0x18]
mov byte [esp + 0x24], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x72657375
push eax
mov dword [esp + 0x18], 0x642e3233
mov word [esp + 0x1c], 0x6c6c
mov byte [esp + 0x1e], 0
call fcn.10001750
push eax
call fcn.100010f0
mov dword [0x1004d5a4], eax
mov ecx, 0x10
xor edx, edx
nop
mov al, byte [edx + str.WtfPagexjIuh]
xor al, cl
inc ecx
mov byte [esp + edx + 0x14], al
and ecx, 0x800000ff
jns 0x1002cfdd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1002cfc0
push 0x1002c390
lea eax, [esp + 0x18]
mov byte [esp + 0x24], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x72657375
push eax
mov dword [esp + 0x18], 0x642e3233
mov word [esp + 0x1c], 0x6c6c
mov byte [esp + 0x1e], 0
call fcn.10001750
push eax
call fcn.100010f0
push 0x104
push 0x1004d5a8
push ebx
mov dword [0x1004d5a0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
call esi
push 0
push 0
push 0
push 0x1002c470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
push 0
push ebx
push 0x1002a4e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1004c6c4], ebx
pop esi
mov ecx, dword [esp + 0x20]
mov eax, 1
pop ebx
xor ecx, esp
call fcn.1003c1fe
add esp, 0x20
ret 0xc
Function at 0x100347a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
mov dword [edi + 0xd60], 0
mov dword [0x2438ff74], 0xffffffff
mov dword [0x243b2ef8], 0
cmp byte [0x10f6d7b5], 0
je 0x100347ea
push 0x45
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x100347ea
cmp byte [0x10f6d7b5], 0
jne 0x100348fb
mov ecx, dword [esi + 0x3578]
cmp ecx, dword [esi + 0x3570]
jne 0x1003480f
mov eax, dword [esi + 0x3574]
inc eax
mov dword [esi + 0x3574], eax
add eax, ecx
mov dword [esi + 0x3578], eax
jmp 0x10034819
mov dword [esi + 0x3574], 0
mov ecx, dword [0x1004c8e0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x120]
call eax
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
call eax
mov ecx, dword [0x1004c8e0]
fstp dword [esp + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x120]
call eax
mov ecx, eax
push 0
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
call eax
mov eax, dword [0x1004c8e8]
fstp dword [esp + 0x14]
movss xmm0, dword [esp + 0x14]
addss xmm0, dword [esp + 8]
mov edx, dword [esi + 0x3578]
divss xmm0, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
inc eax
addss xmm0, dword [0x10047318]
cvttss2si ecx, xmm0
add eax, ecx
cmp edx, eax
jle 0x100348f5
mov ecx, dword [0x1004c8e0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x120]
call eax
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
call eax
mov ecx, dword [0x1004c8e0]
fstp dword [esp + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 0x120]
call eax
mov ecx, eax
push 0
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
call eax
movss xmm0, dword [esp + 0x14]
mov eax, dword [0x1004c8e8]
fstp dword [esp + 8]
addss xmm0, dword [esp + 8]
mov edx, dword [eax + 0x18]
inc edx
divss xmm0, dword [eax + 0x1c]
addss xmm0, dword [0x10047318]
cvttss2si ecx, xmm0
add edx, ecx
mov dword [esi + 0x3578], edx
mov dword [edi + 0xe08], edx
mov eax, dword [esp + 0x10]
pop edi
mov dword [esi + 0x35a0], eax
pop esi
pop ecx
ret 8
Function at 0x100013eb
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x410
mov esi, dword [esp + 0x424]
mov ebp, 0x208
xor eax, eax
lea ebx, [esp + 0x208]
push ebp
push eax
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, esp
push ebp
xor eax, eax
push eax
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 4
push 0x10014170
push esi
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x10001450
push esi
push edi
call sub.msvcrt.dll_wcscpy
add esp, 8
jmp 0x10001465
add esi, 8
mov eax, 0x10
mov ecx, esp
push eax
push esi
push eax
push ebx
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRelativePathToW]
mov esi, dword [esp + 0x428]
movzx eax, word [edi]
cmp eax, 0x5c
je 0x1000147a
test eax, eax
jne 0x1000147f
jmp 0x10001484
mov word [edi], 0x2f
add edi, 2
jmp 0x1000146c
movzx eax, word [esp]
cmp ax, 0x2f
jne 0x10001493
xor ebx, ebx
inc ebx
jmp 0x100014a8
xor eax, 0x2e
movzx ecx, word [esp + 2]
xor ecx, 0x2f
xor ebx, ebx
or cx, ax
sete bl
add ebx, ebx
lea ebp, [esp + ebx*2]
mov edi, esp
push edi
call sub.msvcrt.dll_wcslen
add esp, 4
sub eax, ebx
inc eax
push eax
push ebp
push edi
call sub.msvcrt.dll_wcsncpy
add esp, 0xc
xor eax, eax
push eax
push eax
push 0x104
push esi
push 0xffffffffffffffff
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x410
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10004e92
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
mov ebp, esp
push ebp
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
test eax, eax
je 0x10004ecd
push ebx
push dword [esp + 0x20]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebp
push dword [esp + 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10004ed7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov eax, dword [eax + 0x3c]
mov ebp, dword [edi + eax + 0x80]
mov dword [esp], 0
mov ecx, dword [ebp + edi + 0xc]
xor eax, eax
test ecx, ecx
je 0x10004f6a
mov ebx, dword [esp + 0x20]
add ebp, edi
add ecx, edi
push dword [esp + 0x18]
push ecx
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
je 0x10004f29
mov ecx, dword [ebp + 0x20]
add ebp, 0x14
test ecx, ecx
jne 0x10004f09
jmp 0x10004f72
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + edi]
test eax, eax
je 0x10004f1d
add esi, edi
cmp eax, ebx
je 0x10004f45
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x10004f35
jmp 0x10004f1d
mov ebp, esp
mov ebx, 4
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push 0x40
push ebx
push esi
call edi
mov eax, dword [esp + 0x24]
mov dword [esi], eax
push ebp
push dword [ebp]
push ebx
push esi
call edi
xor eax, eax
inc eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x10004f6a
Function at 0x10007c08
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x18]
movzx ebx, cx
shr ecx, 0x10
test ebp, ebp
je 0x10007cf0
mov esi, edx
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edi, ebp
sub edi, eax
xor eax, eax
cmp edi, 8
mov dword [esp], ebp
jb 0x10007c9f
mov eax, edi
and eax, 0x1ff8
xor ebp, ebp
mov edx, ebp
movzx ebp, byte [esi + ebp]
add ebp, ebx
add ecx, ebp
movzx ebx, byte [esi + edx + 1]
add ebx, ebp
add ecx, ebx
movzx ebp, byte [esi + edx + 2]
add ebp, ebx
add ecx, ebp
movzx ebx, byte [esi + edx + 3]
add ebx, ebp
add ecx, ebx
movzx ebp, byte [esi + edx + 4]
add ebp, ebx
add ecx, ebp
movzx ebx, byte [esi + edx + 5]
add ebx, ebp
add ecx, ebx
movzx ebp, byte [esi + edx + 6]
add ebp, ebx
add ecx, ebp
movzx ebx, byte [esi + edx + 7]
add ebx, ebp
add ecx, ebx
lea ebp, [edx + 8]
add edx, 0xf
cmp edx, edi
jb 0x10007c4a
add esi, ebp
mov edx, edi
sub edx, eax
jbe 0x10007cb6
xor eax, eax
movzx ebp, byte [esi + eax]
add ebx, ebp
add ecx, ebx
inc eax
cmp edx, eax
jne 0x10007ca7
add esi, edx
mov eax, ebx
mov edx, 0x80078071
mul edx
mov ebp, edx
shr ebp, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebp, 0xfff1
sub ebx, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebp, dword [esp]
sub ebp, edi
mov edi, 0x15b0
jne 0x10007c37
shl ecx, 0x10
or ecx, ebx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100091fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ecx, ecx
je 0x100092ea
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x460
mov esi, ecx
cmp dword [ecx + 0x14], 1
jne 0x100092e3
mov edi, edx
test edx, edx
js 0x100092e3
cmp dword [esi + 0x10], edi
jbe 0x100092e3
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx]
test eax, eax
je 0x100092e3
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + edi*4]
lea ebx, [eax + ecx]
add ebx, 0x2e
movzx edx, word [ebx - 0x12]
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1000926d
push eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_free
mov edx, dword [esp + 8]
add esp, 4
mov dword [esi + 0x5c], 0
mov ecx, ebx
call fcn.1000649a
mov dword [esi + 0x5c], eax
test eax, eax
je 0x100092e3
lea eax, [esp + 8]
mov ecx, esi
mov edx, edi
push eax
call fcn.100064d4
add esp, 4
test eax, eax
je 0x100092e3
mov dword [esi + 0x58], edi
movdqu xmm0, xmmword [esp + 0x28]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [esi + 0x60], xmm0
mov eax, dword [esp + 0x24]
mov dword [esi + 0x70], eax
movsd xmm0, qword [esp + 0x10]
movsd qword [esi + 0x78], xmm0
movsd xmm0, qword [esp + 0x40]
movsd qword [esi + 0xa0], xmm0
movzx eax, word [esp + 0x1e]
mov word [esi + 0xa8], ax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x4e008], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x4e00c], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100092eb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
xor ebx, ebx
dec ebx
cmp edx, 4
jb 0x10009348
mov eax, ebx
xor bl, byte [ecx]
shr eax, 8
movzx esi, bl
xor eax, dword [esi*4 + 0x100152c4]
mov ebx, eax
xor al, byte [ecx + 1]
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x100152c4]
mov eax, ebx
xor bl, byte [ecx + 2]
shr eax, 8
movzx esi, bl
xor eax, dword [esi*4 + 0x100152c4]
mov ebx, eax
xor al, byte [ecx + 3]
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x100152c4]
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x100092f6
test edx, edx
je 0x10009369
xor esi, esi
mov eax, ebx
xor bl, byte [ecx + esi]
shr eax, 8
movzx edi, bl
xor eax, dword [edi*4 + 0x100152c4]
inc esi
mov ebx, eax
cmp edx, esi
jne 0x10009350
jmp 0x1000936b
mov eax, ebx
not eax
pop esi
pop edi
pop ebx
ret