joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100059e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x5e9
mov dword [0x10011414], 0x8d0
mov dword [0x10011418], 0
mov dword [0x1001141c], 0
mov dword [0x10011428], 0
mov dword [0x10011410], 0xeb
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x10005ba0
xor eax, eax
mov ecx, 0xeb
mov edx, eax
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
jmp 0x10005a71
mov eax, dword [0x10011414]
add eax, 0xfffffd19
mov dword [ebp - 0x20], eax
jmp 0x10005ba0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, 0x100
add edx, 1
mov ebx, ecx
add ebx, 1
mov dword [ebp - 0x34], eax
add eax, 0xffffddca
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
add eax, 0xffffeaaa
mov dword [0x10011410], eax
mov eax, edx
cdq
idiv edi
mov dword [0x10011418], edx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ecx + edx]
add ecx, esi
mov eax, ecx
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x1001141c], edx
mov ecx, dword [ebp - 0x38]
mov dword [0x10011410], ecx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x40]
mov cl, byte [ecx + esi]
mov byte [0x10011420], cl
mov dword [0x10011414], 0x12a6
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x10011420]
mov edx, dword [0x1001141c]
mov byte [edi + edx], cl
mov edx, dword [0x10011418]
movzx edx, byte [edi + edx]
mov ecx, dword [0x1001141c]
movzx ecx, byte [edi + ecx]
add ecx, edx
mov edx, dword [0x10011414]
mov esi, edx
add esi, 0x1316
mov dword [0x10011410], esi
and ecx, 0xff
mov dword [0x10011428], ecx
mov dword [0x10011414], 0xa75
mov cl, byte [edi + ecx]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x3c]
mov ch, byte [esi + edi]
add edx, 0xfffff7f7
mov dword [0x10011410], edx
xor ch, cl
mov byte [0x1001142c], ch
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], ch
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x44], ebx
je 0x10005a5f
mov eax, dword [0x1001141c]
mov ecx, dword [0x10011410]
mov edx, dword [0x10011418]
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], ecx
jmp 0x10005a71
mov eax, dword [ebp - 0x20]
mov dword [0x10011410], eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10005bb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x10011410], 0x42a
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10004cd0
lea ecx, [0x10004240]
mov dword [0x10011410], 0x8ad
mov edx, dword [esp + 0x28]
mov dword [esp + 0x8c], edx
mov dword [esp + 0x90], 0x12dc00
mov edx, dword [0x100113fc]
mov dword [esp + 0x88], edx
mov edx, dword [0x10011400]
mov dword [esp + 0x48], edx
mov edx, dword [0x10011404]
mov dword [esp + 0x54], edx
mov edx, dword [0x10011408]
mov dword [esp + 0x3c], edx
mov edx, dword [0x1001140c]
mov dword [esp + 0x6c], edx
mov dword [0x10011414], 0xffffef27
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x10005c88
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x44], ecx
mov dword [0x10011414], 0x1275
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x7c], eax
mov dword [0x10011410], 0x234f
call fcn.100040f0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x10005ccd
jmp 0x10005d0b
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x10005caf
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
je 0x10005c49
mov dword [0x10011410], 0x592
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x10005c88
lea eax, [esp + 0x38]
mov dword [0x10011410], 0x23c1
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10005330
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x10011414], 0x554
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x401da4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412284]
jne 0x401dae
repz ret
jmp fcn.00403bf3

Function at 0x40660a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x14]
call fcn.0040454a
add esp, 0xc
mov dword [ebp - 0x37c], eax
Function at 0x403cec
Capabilities:
Encode data using xor

Disassembly:
push 0x4a2fc8
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dh
out 0xee, eax
in al, 0xb3
xor byte [ebx], bl
inc edi
mov bl, 0xc6
fdivp st(5)
jbe 0x403d85
and byte [ebp], dl
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub eax, 0x30303043
sub eax, 0x6a6f7250
arpl word gs:[ecx + esi], si
push eax
jb 0x403d9a
push 0x65
arpl word [ecx + esi], si
xor dword [eax], eax
xor byte [esi + esi], dh
jge 0x403d59
xor ch, byte [esi]
add byte [eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
jo 0x403db1
popal
test byte [edx + 5], ah
pop esi
xchg esp, eax
dec ebp
scasb al, byte es:[edi]
jp 0x403d28
out dx, eax
sbb byte [ebx - 0x51], 0x41
stc
aad 0x10
jp 0x403d2f
bound edx, qword [eax]
dec ecx
test al, 0xa0
and ebp, edx
mov ebp, 0x3a1689b4
dec edi
lodsd eax, dword [esi]
xor ebx, dword [ecx - 0x48ee309a]
or al, 0
stosb byte es:[edi], al
add byte [eax - 0x2d], ah
xchg ebx, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
dec ebx
int1
or dword [eax], eax
xor dword [ecx], ecx
add byte [eax], al
add byte [eax + eax], cl
or dword [eax], eax
add byte [eax], al
or al, 0
inc ebp
insd dword es:[edi], dx
popal
imul ebp, dword [ebx + eax*2 + 0x6f], 0x6361706d
je 0x403dad
or eax, 0x4e000d01
dec esi
outsd dx, dword [esi]
jbe 0x403dd5
xor dword [eax], edi
je 0x403e21
and byte [edx], dh
xor byte [ecx], dh
xor al, 0
add al, 0xc0
rol al, 0
sbb dword [ecx], eax
add byte [edx], al
and al, byte [eax]
and eax, esi
or byte [eax], al
add byte [esp + esi*2], ch
add byte [esi + 8], bh
or byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ecx], al
add byte [eax], ah
and bh, bh
add byte [eax], al
add byte [eax], al
add byte [eax + 0x16000008], ch
add byte [eax], al
add byte [eax], ch
add byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
or byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
faddp st(3)
stosd dword es:[edi], eax
add dh, ah
rol al, cl
add dh, ch
loope 0x403df6
inc eax
add byte [eax], al
add byte [ecx], al
add byte [eax], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dh, bl
ret
add bh, bh
invalid
Function at 0x1002493d
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x48
mov eax, 0x1008570e
call fcn.10063f44
mov esi, ecx
mov ecx, dword [esi + 0x30]
test ecx, ecx
jne 0x1002495c
mov eax, 0x80004005
jmp 0x10024a90
mov ebx, dword [ebp + 0xc]
push ebx
call fcn.1007f185
push ebx
push dword [ebp + 8]
mov ecx, esi
call fcn.10022781
test eax, eax
jne 0x10024a90
push 0xa
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], 0xc8
mov dword [ebp - 0x54], 1
call fcn.1007f185
xor edi, edi
cmp dword [esi + 0x27c4], edi
je 0x100249cc
mov ecx, dword [esi + 0x30]
cmp dword [ecx + 0x5bc], edi
je 0x100249cc
call fcn.1001bd83
mov ecx, dword [esi + 0x27c4]
push eax
call fcn.1007f185
xor eax, eax
mov word [esi + 0x78], ax
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
mov eax, dword [esi + 0x30]
push dword [eax + 0x484]
mov ecx, esi
call fcn.100229fb
mov edi, eax
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x4000
test edi, edi
jne 0x10024a35
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call fcn.10023df6
mov edi, eax
test edi, edi
jne 0x10024a35
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.10024360
mov edi, eax
test edi, edi
jne 0x10024a35
mov ecx, esi
call fcn.10024591
mov edi, eax
mov ecx, esi
call fcn.10024616
test edi, edi
jne 0x10024a70
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x628]
test ecx, ecx
je 0x10024a59
push dword [esi + 0x1018]
push ebx
call fcn.1007f185
push ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10024a70
or eax, 2
push eax
push ebx
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
cmp dword [ebp - 0x2c], 0
je 0x10024a7f
push dword [ebp - 0x2c]
call fcn.1007f185
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x10024a8e
push dword [ebp - 0x1c]
call fcn.1007f185
pop ecx
mov eax, edi
call fcn.1006401c
ret 8
Function at 0x1003121b
Capabilities:
Get graphical window text

Disassembly:
push 0x14
mov eax, 0x10085f3a
call fcn.10063fad
mov edi, ecx
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea eax, [esi*2 + 2]
call fcn.10064635
mov ecx, esp
lea eax, [esi + 1]
push eax
push ecx
push dword [edi + 4]
mov dword [ebp - 0x20], ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x10001964
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x1c], 0
xor esi, esi
test eax, eax
je 0x1003127f
mov eax, dword [eax]
test eax, eax
je 0x1003127f
movzx esi, word [eax]
push esi
push 0x42
call dword [sym.imp.kernel32.dll_GlobalAlloc]
xor ecx, ecx
mov ebx, eax
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], ecx
test ebx, ebx
je 0x100312cb
test esi, esi
je 0x100312cb
push ebx
call dword [sym.imp.kernel32.dll_GlobalLock]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
add ecx, 2
push esi
push ecx
push eax
call fcn.1007f185
add esp, 0xc
push ebx
call dword [sym.imp.kernel32.dll_GlobalUnlock]
lea eax, [ebp - 0x14]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
push ebx
push ebx
push 0x10008de8
push ebx
lea eax, [ebp - 0x18]
push eax
push ecx
push dword [edi + 4]
mov ecx, edi
push dword [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.100314e2
test eax, eax
jns 0x1003131b
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], bl
test eax, eax
je 0x10031302
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x10031313
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
or eax, 0xffffffff
jmp 0x100313c7
mov esi, dword [ebp - 0x18]
mov eax, dword [esi]
lea ecx, [ebp - 0x1c]
push ecx
push 0x10001f44
push esi
call dword [eax]
test eax, eax
jns 0x1003134c
mov eax, dword [esi]
push esi
mov byte [ebp - 4], bl
call dword [eax + 8]
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x10031313
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10031313
push dword [ebp - 0x1c]
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xffffffffffffffeb
push dword [edi + 4]
call ebx
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x10000
push eax
push 0xffffffffffffffec
push dword [edi + 4]
call ebx
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x100313a1
push 0xffffffffffffffec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, 0x10000
test ecx, eax
jne 0x100313a1
or eax, ecx
push eax
push 0xffffffffffffffec
push dword [edi + 4]
call ebx
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov eax, dword [esi]
push esi
mov byte [ebp - 4], 0
call dword [eax + 8]
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x100313c5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
lea esp, [ebp - 0x30]
call fcn.10064030
ret 0x10
Function at 0x10039725
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 4
mov eax, 0x100864f4
call fcn.10063f44
mov esi, ecx
mov ecx, dword [esi + 0x298]
test ecx, ecx
jne 0x10039744
xor eax, eax
jmp 0x100398e5
lea ebx, [esi + 0x2c4]
xor edi, edi
cmp word [ebx], di
jne 0x1003976d
push 0x10003264
lea eax, [esi + 0x84]
push eax
push 0x10003270
push 0x104
push ebx
call fcn.1007f185
mov ecx, dword [esi + 0x298]
push ebx
call fcn.1007f185
push 0x318
mov dword [esi + 0x2bc], edi
call fcn.1007f185
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1003979d
mov ecx, eax
call fcn.1007b0e6
mov edi, eax
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1003973d
push ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100397bc
and eax, 0xfffffffd
push eax
push ebx
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov ecx, edi
call fcn.1007b15c
mov ecx, edi
test eax, eax
je 0x100397da
call fcn.1007b102
push edi
call fcn.1007f185
pop ecx
jmp 0x1003973d
push 0
push ebx
call fcn.1007f185
test eax, eax
je 0x100397ea
mov ecx, edi
jmp 0x100397c9
push 0xc
call fcn.1007f185
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x10039809
mov ecx, eax
call fcn.10024aee
jmp 0x1003980b
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 4], 0
mov dword [esi + 0x4cc], eax
push edi
mov ecx, esi
je 0x10039825
call fcn.1007f185
jmp 0x1003982a
call fcn.1007f185
test eax, eax
je 0x100397e6
cmp dword [esi + 0x4cc], 0
je 0x1003986d
mov ecx, dword [esi + 0x298]
cmp dword [ecx + 0x5bc], 0
je 0x10039857
call fcn.1001bd83
mov ecx, dword [esi + 0x4cc]
push eax
call fcn.1007f185
mov eax, dword [esi + 0x278]
test eax, eax
je 0x1003986d
mov ecx, dword [esi + 0x4cc]
push eax
call fcn.1007f185
push edi
mov ecx, esi
call fcn.1007f185
mov ecx, edi
call fcn.1007b2ed
mov ecx, edi
call fcn.1007b102
push edi
call fcn.1007f185
pop ecx
push ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100398a1
or eax, 2
push eax
push ebx
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, dword [esi + 0x298]
mov ecx, dword [eax + 0x628]
test ecx, ecx
je 0x100398bd
push dword [esi + 0x2b8]
push ebx
call fcn.1007f185
mov edi, dword [esi + 0x4cc]
test edi, edi
je 0x100398d5
mov ecx, edi
call fcn.10024b14
push edi
call fcn.1007f185
pop ecx
and dword [esi + 0x4cc], 0
xor eax, eax
inc eax
mov dword [esi + 0x294], eax
call fcn.1006401c
ret
Function at 0x1004a40a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100873cd
call fcn.10063fe3
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1004a46b
call fcn.1002c67a
mov esi, eax
jmp 0x1004a543
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1004a489
call fcn.1002c67a
jmp 0x1004a53a
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1004a47f
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x1004a4bc
mov esi, 0x8007000e
jmp 0x1004a53c
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1007f185
mov dword [ebp - 4], 1
jmp 0x1004a4f0
cmp dword [ebp - 0x418], 0
je 0x1004a4b2
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1004a47f
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.1007f185
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1004a55c
lea ecx, [ebp - 0x418]
call fcn.1004a63d
mov eax, esi
call fcn.1006403c
ret 0x10
Function at 0x10063241
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x10093b08
call fcn.10068f85
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x100632cf
call fcn.10068f53
test eax, eax
jne 0x10063265
xor eax, eax
jmp 0x1006339b
call fcn.10068335
test eax, eax
jne 0x10063275
call fcn.10068f71
jmp 0x1006325e
call fcn.10068f07
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x100a2ed4], eax
call fcn.1007f185
mov dword [0x100a0e2c], eax
call fcn.1007f185
test eax, eax
jns 0x1006329f
call fcn.1006800e
jmp 0x1006326e
call fcn.1007f185
test eax, eax
js 0x100632c8
call fcn.10068b3f
test eax, eax
js 0x100632c8
push 0
call fcn.1007f185
pop ecx
test eax, eax
jne 0x100632c8
inc dword [0x100a0e28]
jmp 0x10063398
call fcn.10068aec
jmp 0x10063298
xor edi, edi
cmp eax, edi
jne 0x1006332e
cmp dword [0x100a0e28], edi
jle 0x1006325e
dec dword [0x100a0e28]
mov dword [ebp - 4], edi
cmp dword [0x100a119c], edi
jne 0x100632f3
call fcn.1006887a
cmp dword [ebp + 0x10], edi
jne 0x10063307
call fcn.10068aec
call fcn.1006800e
call fcn.10068f71
mov dword [ebp - 4], 0xfffffffe
call fcn.1006331a
jmp 0x10063398
cmp eax, 2
jne 0x1006338c
call fcn.10067fda
push 0x214
push 1
call fcn.1007f185
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x1006325e
push esi
push dword [0x1009e504]
push dword [0x100a1178]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x10063380
push edi
push esi
call fcn.1006804f
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x10063398
push esi
call fcn.1007f185
pop ecx
jmp 0x1006325e
cmp eax, 3
jne 0x10063398
push edi
call fcn.1007f185
pop ecx
xor eax, eax
inc eax
call fcn.10068fca
ret 0xc

Function at 0x10063f36
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x100a0f50], eax
mov dword [0x100a0f4c], ecx
mov dword [0x100a0f48], edx
mov dword [0x100a0f44], ebx
mov dword [0x100a0f40], esi
mov dword [0x100a0f3c], edi
mov word [0x100a0f68], ss
mov word [0x100a0f5c], cs
mov word [0x100a0f38], ds
mov word [0x100a0f34], es
mov word [0x100a0f30], fs
mov word [0x100a0f2c], gs
pushfd
pop dword [0x100a0f60]
mov eax, dword [ebp]
mov dword [0x100a0f54], eax
mov eax, dword [ebp + 4]
mov dword [0x100a0f58], eax
lea eax, [ebp + 8]
mov dword [0x100a0f64], eax
mov eax, dword [ebp - 0x320]
mov dword [0x100a0ea0], 0x10001
mov eax, dword [0x100a0f58]
mov dword [0x100a0e54], eax
mov dword [0x100a0e48], 0xc0000409
mov dword [0x100a0e4c], 1
mov eax, dword [0x1009e4f8]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1009e4fc]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x100a0e98], eax
push 1
call fcn.100693d8
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10006b5c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x100a0e98], 0
jne 0x100638a0
push 1
call fcn.100693d8
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
cmp ecx, dword [0x1009e4f8]
jne 0x100637b4
repz ret
Function at 0x1007a142
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x1007a17f
cmp byte [edx], 0
je 0x1007a17f
mov ecx, edx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1007a157
sub ecx, esi
pop esi
cmp ecx, 0x104
jae 0x1007a17f
push edx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1007a17f
test al, 0x10
jne 0x1007a17f
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x1007b102
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
xor ebx, ebx
test ecx, ecx
je 0x1007b118
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 4], ebx
mov ecx, dword [esi]
test ecx, ecx
je 0x1007b126
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi], ebx
push edi
mov edi, dword [esi + 0x210]
test edi, edi
je 0x1007b145
mov ecx, edi
call fcn.1007b102
push edi
call fcn.1007f185
pop ecx
mov dword [esi + 0x210], ebx
add esi, 0x214
pop edi
cmp byte [esi], bl
je 0x1007b159
push esi
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov byte [esi], bl
pop esi
pop ebx
ret

Function at 0x1007f185
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1007f194
pop dword [ebp - 0x28]
mov eax, 0x1b9586ea
sub eax, 0xb8d9556
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x56b81
push 0
mov eax, 0x86fbeeb9
add eax, 0x8904221b
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4575
xor edx, edx
add edx, eax
mov ebx, 0xbaa9aaf1
add ebx, 0x5565130f
add ebx, dword [ebp - 0x28]
mov esi, 0xf0c3fa2b
sub esi, 0x5ff4024f
sub dword [ebp - 8], ebx
mov edi, dword [ebx]
add dword [ebp - 0x18], 0x7b90db95
add edi, esi
xor dword [ebp - 0x1c], 0x204c70a0
mov dword [edx], edi
add dword [ebp - 0x20], edx
add edx, 4
add ebx, 4
loop 0x1007f1ef
add eax, 0x108a7
xor ebx, ebx
add ebx, eax
add eax, 0x5e57927b
sub eax, 0x5e579276
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret