joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4220c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x4220e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4220e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4220d8
mov eax, 1
add ebx, ebx
jne 0x4220fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4220f0
jne 0x42210c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4220f0
xor ecx, ecx
sub eax, 3
jb 0x422120
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x422192
mov ebp, eax
add ebx, ebx
jne 0x42212b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x422138
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42215c
inc ecx
add ebx, ebx
jne 0x422148
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42213d
jne 0x422159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42213d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42217c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42216d
jmp 0x4220de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42217c
add edi, ecx
jmp 0x4220de
pop esi
mov edi, esi
mov ecx, 0x4b8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42219a
cmp byte [edi], 2
jne 0x42219a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42219f
lea edi, [esi + 0x20000]
mov eax, dword [edi]
or eax, eax
je 0x422217
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22690]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2276c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4221cc
mov ecx, edi
jns 0x4221fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22770]
or eax, eax
je 0x422211
mov dword [ebx], eax
add ebx, 4
jmp 0x4221e9
call dword [esi + 0x22778]
mov ebp, dword [esi + 0x22774]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42224b
sub esp, 0xffffff80
jmp 0x40796e
Function at 0x401f82
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x4a7140
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x4d47f8], 1
jge 0x4a71af
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x4a7185
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x4a7185
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4a7162
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x4a719b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x4a71a2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x4a729f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x4a7270
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x4a7265
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x4a7259
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x4a7260
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x4a729f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x4a729a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x4a7283
mov eax, dword [ebx + 8]
jmp 0x4a729f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4a7291
xor eax, eax
jmp 0x4a729f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4a71cf
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x403ddc
Capabilities:
Query environment variable

Disassembly:
jmp 0x486dd7
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x486deb
xor edi, edi
jmp 0x486e2f
push ebx
push esi
call fcn.00486cce
sub eax, esi
sar eax, 1
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
lea ebx, [eax + eax]
push ebx
call fcn.004029dc
mov edi, eax
add esp, 0x14
test edi, edi
je 0x486e1c
push ebx
push esi
push edi
call fcn.00401e10
add esp, 0xc
push 2
push 0
call fcn.00401852
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x481b50
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.00401456
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x481b8e
cmp dword [ebp + 8], 0
je 0x481b7c
lea eax, [ebp + 8]
push eax
call fcn.00403cc9
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x481b8e
mov eax, 4
jmp 0x481cbe
call fcn.00402351
movzx edx, al
test edx, edx
jne 0x481bbc
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x481bad
mov dword [ebp - 0xc], 4
jmp 0x481bb4
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x481cbe
movzx eax, byte [ebp - 1]
test eax, eax
je 0x481c65
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x482010
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.0040326f
lea ecx, [ebp - 8]
call fcn.004016ef
movzx edx, al
test edx, edx
jne 0x481c27
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.0040243c
mov eax, dword [ebp - 0x10]
jmp 0x481cbe
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00403972
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x481c52
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.0040243c
mov eax, dword [ebp - 0x14]
jmp 0x481cbe
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.0040243c
mov eax, dword [ebp - 0x18]
jmp 0x481cbe
call fcn.00401410
movzx ecx, al
test ecx, ecx
jne 0x481c9e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.0040238d
add esp, 0x10
jmp 0x481cbe
call fcn.00403e1d
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00403f3f
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x481d20
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.00401456
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x481d5e
cmp dword [ebp + 8], 0
je 0x481d4c
lea eax, [ebp + 8]
push eax
call fcn.00402e91
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x481d5e
mov eax, 4
jmp 0x481e8e
call fcn.00402351
movzx edx, al
test edx, edx
jne 0x481d8c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x481d7d
mov dword [ebp - 0xc], 4
jmp 0x481d84
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x481e8e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x481e35
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x482070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.0040326f
lea ecx, [ebp - 8]
call fcn.004016ef
movzx edx, al
test edx, edx
jne 0x481df7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.0040243c
mov eax, dword [ebp - 0x10]
jmp 0x481e8e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00403972
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x481e22
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.0040243c
mov eax, dword [ebp - 0x14]
jmp 0x481e8e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.0040243c
mov eax, dword [ebp - 0x18]
jmp 0x481e8e
call fcn.00401410
movzx ecx, al
test ecx, ecx
jne 0x481e6e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.0040254f
add esp, 0x10
jmp 0x481e8e
call fcn.00403e1d
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0040280b
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x402c00
pop dword [ebp - 8]
mov eax, 0x402c00
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x7d7af2c4
add dword [ebp - 0x18], 0xd0d75287
mov dword [ebp - 0x14], 0x430b996b
add dword [ebp - 0x14], 0xef27b2da
mov dword [ebp - 0x10], 0xb97c6453
sub dword [ebp - 0x10], 0x6d302025
mov dword [ebp - 0xc], 0x54bf0cf2
sub dword [ebp - 0xc], 0x54bf0cf2
lea eax, [ebp - 0x18]
push eax
mov eax, 0x81ce8fc2
sub eax, 0x818e1f5e
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x5524358e
add dword [ebp - 0x18], 0x1f4e33c8
mov dword [ebp - 0x14], 0x72a565f6
add dword [ebp - 0x14], 0xcec6fb7f
mov dword [ebp - 0x10], 0xaef7b064
add dword [ebp - 0x10], 0xb477bc08
mov dword [ebp - 0xc], 0xae580de8
sub dword [ebp - 0xc], 0xae580de8
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xca5eaa5f
sub eax, 0xca1e39b7
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x34992
push 0
call eax
mov ecx, 0x3fa3
mov edx, eax
mov esi, 0x410000
add esi, dword [ebp - 8]
mov ebx, 0x62e9a003
sub ebx, 0xa0733a6d
xor dword [ebp - 4], ecx
mov edi, dword [esi]
sub dword [ebp - 4], ebx
sub edi, ebx
sub dword [ebp - 4], ecx
mov dword [edx], edi
sub dword [ebp - 4], ecx
add edx, 0xc1709793
sub edx, 0xc170978f
add esi, 0x9a6bd015
add esi, 0x65942fef
loop 0x402d11
add eax, 0x3d70081f
add eax, 0xc290e940
mov ebx, eax
add eax, 0x753dc72b
add eax, 0x8ac238da
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10001ff0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
mov eax, ecx
shr eax, 1
test cl, 1
je 0x10002000
xor eax, 0xedb88320
test al, 1
je 0x1000200d
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000200f
shr eax, 1
test al, 1
je 0x1000201c
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000201e
shr eax, 1
test al, 1
je 0x1000202b
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000202d
shr eax, 1
test al, 1
je 0x1000203a
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000203c
shr eax, 1
test al, 1
je 0x10002049
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000204b
shr eax, 1
test al, 1
je 0x10002058
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000205a
shr eax, 1
test al, 1
je 0x10002067
shr eax, 1
xor eax, 0xedb88320
jmp 0x10002069
shr eax, 1
mov dword [ecx*4 + 0x10134fa0], eax
inc ecx
cmp ecx, 0x100
jb 0x10001ff2
push esi
xor esi, esi
mov ecx, dword [esi + 0x10134fa0]
movzx eax, cl
shr ecx, 8
mov edx, dword [eax*4 + 0x10134fa0]
xor edx, ecx
mov dword [esi + 0x101353a0], edx
movzx eax, dl
shr edx, 8
mov ecx, dword [eax*4 + 0x10134fa0]
xor ecx, edx
mov dword [esi + 0x101357a0], ecx
movzx eax, cl
shr ecx, 8
mov edx, dword [eax*4 + 0x10134fa0]
xor edx, ecx
mov dword [esi + 0x10135ba0], edx
movzx eax, dl
shr edx, 8
mov ecx, dword [eax*4 + 0x10134fa0]
xor ecx, edx
mov dword [esi + 0x10135fa0], ecx
movzx eax, cl
shr ecx, 8
mov edx, dword [eax*4 + 0x10134fa0]
xor edx, ecx
mov dword [esi + 0x101363a0], edx
movzx eax, dl
shr edx, 8
mov ecx, dword [eax*4 + 0x10134fa0]
xor ecx, edx
movzx eax, cl
mov dword [esi + 0x101367a0], ecx
shr ecx, 8
mov edx, dword [eax*4 + 0x10134fa0]
xor edx, ecx
mov dword [esi + 0x10136ba0], edx
movzx eax, dl
shr edx, 8
mov ecx, dword [eax*4 + 0x10134fa0]
xor ecx, edx
movzx eax, cl
mov dword [esi + 0x10136fa0], ecx
shr ecx, 8
mov edx, dword [eax*4 + 0x10134fa0]
xor edx, ecx
movzx eax, dl
mov dword [esi + 0x101373a0], edx
shr edx, 8
mov ecx, dword [eax*4 + 0x10134fa0]
xor ecx, edx
movzx eax, cl
mov dword [esi + 0x101377a0], ecx
shr ecx, 8
mov edx, dword [eax*4 + 0x10134fa0]
xor edx, ecx
movzx eax, dl
mov dword [esi + 0x10137ba0], edx
shr edx, 8
mov ecx, dword [eax*4 + 0x10134fa0]
xor ecx, edx
movzx eax, cl
mov dword [esi + 0x10137fa0], ecx
shr ecx, 8
mov edx, dword [eax*4 + 0x10134fa0]
xor edx, ecx
movzx eax, dl
mov dword [esi + 0x101383a0], edx
shr edx, 8
mov ecx, dword [eax*4 + 0x10134fa0]
xor ecx, edx
movzx eax, cl
mov dword [esi + 0x101387a0], ecx
shr ecx, 8
xor ecx, dword [eax*4 + 0x10134fa0]
mov dword [esi + 0x10138ba0], ecx
add esi, 4
cmp esi, 0x400
jb 0x10002080
pop esi
ret
Function at 0x100021d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xedcba987
mov dword [ebp - 8], edx
push edi
mov edi, edx
cmp ebx, 0x10
jb 0x100022fb
shr ebx, 4
mov dword [ebp - 0xc], ebx
push esi
mov ebx, dword [edi + 0xc]
mov ecx, dword [edi]
xor ecx, eax
mov esi, dword [edi + 4]
mov dword [ebp - 4], ecx
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
shr eax, 8
movzx ecx, al
mov eax, dword [edx*4 + 0x101353a0]
mov edx, dword [edi + 8]
xor eax, dword [ecx*4 + 0x101357a0]
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
mov edi, dword [ebp - 4]
xor eax, dword [ecx*4 + 0x101363a0]
mov ecx, edx
shr ecx, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101367a0]
mov ecx, esi
shr ecx, 0x10
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101373a0]
mov ecx, esi
shr ecx, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101377a0]
mov ecx, edi
shr ecx, 0x10
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101383a0]
mov ecx, edi
shr ecx, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101387a0]
mov ecx, ebx
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x10134fa0]
mov ecx, edx
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x10135fa0]
mov ecx, esi
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x10136fa0]
mov ecx, edi
mov edi, dword [ebp - 8]
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x10137fa0]
movzx ecx, bl
mov ebx, dword [ebp + 8]
sub ebx, 0x10
mov dword [ebp + 8], ebx
xor eax, dword [ecx*4 + 0x10135ba0]
movzx ecx, dl
xor eax, dword [ecx*4 + 0x10136ba0]
mov ecx, dword [edi + 4]
add edi, 0x10
movzx ecx, cl
mov dword [ebp - 8], edi
xor eax, dword [ecx*4 + 0x10137ba0]
mov ecx, dword [ebp - 4]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x10138ba0]
sub dword [ebp - 0xc], 1
jne 0x100021f5
pop esi
test ebx, ebx
je 0x1000231a
nop
movzx ecx, byte [edi]
lea edi, [edi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10134fa0]
sub ebx, 1
jne 0x10002300
pop edi
not eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10005d50
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
xor esi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
lea ebx, [edi - 2]
test ebx, ebx
jle 0x10005ddf
mov edi, edx
nop
movzx ecx, byte [edi + esi]
shr ecx, 2
movzx ecx, byte [ecx + 0x100eec70]
mov byte [eax], cl
movsx edx, byte [edi + esi]
movzx ecx, byte [edi + esi + 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + 0x100eec70]
mov byte [eax + 1], cl
movsx ecx, byte [edi + esi + 1]
movzx edx, byte [edi + esi + 2]
and ecx, 0xf
shl ecx, 2
shr edx, 6
or edx, ecx
movzx ecx, byte [edx + 0x100eec70]
mov byte [eax + 2], cl
movsx ecx, byte [edi + esi + 2]
add esi, 3
and ecx, 0x3f
movzx ecx, byte [ecx + 0x100eec70]
mov byte [eax + 3], cl
add eax, 4
cmp esi, ebx
jl 0x10005d70
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 4]
cmp esi, edi
jge 0x10005e4d
movzx ecx, byte [esi + edx]
shr ecx, 2
mov cl, byte [ecx + 0x100eec70]
mov byte [eax], cl
lea ecx, [edi - 1]
cmp esi, ecx
jne 0x10005e12
movsx ecx, byte [esi + edx]
and ecx, 3
shl ecx, 4
mov cl, byte [ecx + 0x100eec70]
mov byte [eax + 1], cl
mov byte [eax + 2], 0x3d
jmp 0x10005e46
movsx edx, byte [esi + edx]
mov edi, dword [ebp - 4]
and edx, 3
shl edx, 4
movzx ecx, byte [esi + edi + 1]
shr ecx, 4
or edx, ecx
movzx ecx, byte [edx + 0x100eec70]
mov byte [eax + 1], cl
movsx ecx, byte [esi + edi + 1]
and ecx, 0xf
movzx ecx, byte [ecx*4 + 0x100eec70]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
add eax, 4
pop edi
mov byte [eax], 0
sub eax, dword [ebp - 8]
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007620
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x18
and eax, 0x17
mov dword [ecx + 0xc], eax
mov ecx, dword [ecx + 0x10]
and ecx, eax
je 0x1000764b
cmp byte [ebp + 0xc], 0
jne 0x10007651
test cl, 4
jne 0x1000765a
test cl, 2
jne 0x10007687
jmp 0x100076b4
mov esp, ebp
pop ebp
ret 8
push 0
push 0
call fcn.1009e33b
call fcn.10009e80
push eax
push 1
push 0x100effb0
lea ecx, [esp + 0x10]
call fcn.10007490
push 0x10102f04
lea eax, [esp + 8]
mov dword [esp + 8], 0x100f012c
push eax
call fcn.1009e33b
call fcn.10009e80
push eax
push 1
push 0x100effc8
lea ecx, [esp + 0x10]
call fcn.10007490
push 0x10102f04
lea eax, [esp + 8]
mov dword [esp + 8], 0x100f012c
push eax
call fcn.1009e33b
call fcn.10009e80
push eax
push 1
push 0x100effe0
lea ecx, [esp + 0x10]
call fcn.10007490
push 0x10102f04
lea eax, [esp + 8]
mov dword [esp + 8], 0x100f012c
push eax
call fcn.1009e33b
int3

Function at 0x10007b30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cefa1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x101050c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10007a40
push 1
push str._cBzW
mov ecx, esi
mov dword [ebp - 0x10], 1
call fcn.10001a00
push 0xffffffffffffffff
push 0
lea eax, [ebp + 8]
mov ecx, esi
push eax
call fcn.10001b30
cmp dword [esi + 0x14], 0x10
jb 0x10007b9f
mov eax, dword [esi]
jmp 0x10007ba1
mov eax, esi
push 0
push eax
call fcn.100a3b0c
add esp, 8
cmp eax, 0xffffffff
jne 0x10007bc6
cmp dword [esi + 0x14], 0x10
jb 0x10007bbb
mov eax, dword [esi]
jmp 0x10007bbd
mov eax, esi
push eax
call fcn.100a4254
add esp, 4
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x10007bdb
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.10001ca0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100095c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cf148
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101050c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100096ee
cmp byte [ebx + 0x3d], 0
je 0x100096ee
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10009619
xor al, al
jmp 0x100096f0
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.100093f0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1000967f
sub eax, 1
je 0x10009683
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x100096d6
xor bl, bl
jmp 0x100096d8
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x100096b8
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.100a3db5
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x1000967b
cmp byte [ebx + 0x3d], 0
je 0x100096d6
test esi, esi
jne 0x10009641
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.100039a0
jmp 0x1000963e
mov bl, 1
cmp ecx, 0x10
jb 0x100096ea
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10001ca0
mov al, bl
jmp 0x100096f0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009a83f
mov esp, ebp
pop ebp
ret

Function at 0x10009bd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ceec6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101050c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x100f001c
call fcn.1009a850
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100999fb
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret