joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d8de0
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177293
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x101cfdb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0x100d8dc0
push 0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movaps xmm0, xmmword [0x101b7a40]
xor ecx, ecx
mov eax, dword [0x102710b4]
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x30], 0x32352f28
movaps xmm0, xmmword [0x101b7800]
movups xmmword [ebp - 0x50], xmm0
mov byte [eax + 0x154], 0
movaps xmm0, xmmword [0x101b7960]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0x29322734
mov dword [ebp - 0x28], 0x4c6834
nop dword [eax + eax]
mov al, byte [ebp - 0x60]
xor byte [ebp + ecx - 0x5f], al
inc ecx
cmp ecx, 0x3a
jb 0x100d8e70
lea eax, [ebp - 0x5f]
mov byte [ebp - 0x25], 0
push eax
lea ecx, [ebp - 0x98]
call fcn.100461a0
mov byte [ebp - 4], 1
xor ecx, ecx
movaps xmm0, xmmword [0x101b8610]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x2c], 0x246d6f69
movaps xmm0, xmmword [0x101b8600]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x28], 0x28
nop dword [eax]
mov al, byte [ebp - 0x4c]
xor byte [ebp + ecx - 0x4b], al
inc ecx
cmp ecx, 0x24
jb 0x100d8ec0
lea eax, [ebp - 0x4b]
mov byte [ebp - 0x27], 0
push eax
lea ecx, [ebp - 0x7c]
call fcn.100461a0
mov byte [ebp - 4], 2
xor ecx, ecx
movaps xmm0, xmmword [0x101b7f20]
movups xmmword [ebp - 0x48], xmm0
mov byte [ebp - 0x28], 0
movaps xmm0, xmmword [0x101b72a0]
movups xmmword [ebp - 0x38], xmm0
nop dword [eax]
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x1f
jb 0x100d8f00
lea eax, [ebp - 0x47]
mov byte [ebp - 0x28], 0
push eax
lea ecx, [ebp - 0xb4]
call fcn.100461a0
mov edx, 0x101aec64
mov byte [ebp - 4], 3
lea ecx, [ebp + 8]
call fcn.10064400
test al, al
je 0x100d8fbc
lea eax, [ebp - 0x7c]
push eax
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x40]
call fcn.1007bfa0
add esp, 4
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
push ecx
mov edx, eax
lea ecx, [ebp - 0xd0]
call fcn.100d55f0
movaps xmm0, xmmword [0x101b7010]
add esp, 4
mov edx, eax
mov word [ebp - 0x14], 0x1c
movups xmmword [ebp - 0x24], xmm0
xor ecx, ecx
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x100d8f80
push 0x30
lea eax, [ebp - 0x23]
mov byte [ebp - 0x13], 0
push eax
mov ecx, edx
call fcn.10045f60
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0xd0]
call fcn.100460d0
lea ecx, [ebp - 0x40]
call fcn.100460d0
jmp 0x100d8ff8
movaps xmm0, xmmword [0x101b8350]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x77
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x100d8fd0
push 0x30
lea eax, [ebp - 0x23]
mov byte [ebp - 0x13], 0
push eax
lea ecx, [ebp + 8]
call fcn.10045f60
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.10135f80
int3
Function at 0x100dab40
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x100dab77
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call sym.BYRACS.dll_Init
push 0
push 0
push 0
push 0x100daa10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x102710b4]
mov dword [ecx + 0x170], eax
mov eax, 1
ret 0xc
Function at 0x100db060
Capabilities:
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x101cfdb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp 0x100db085
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x102710a8
mov dword [0x1027109c], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100db15c
push 0x10271098
push 0
push 0
push 0x8004
push dword [0x102710a8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100db15c
movaps xmm0, xmmword [0x101b7fa0]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0xc], 0x1d320553
movaps xmm0, xmmword [0x101b7f70]
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 8], 0x17
movaps xmm0, xmmword [0x101b74a0]
movups xmmword [ebp - 0x1c], xmm0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x34
jb 0x100db100
push 1
push 0x1d
lea eax, [ebp - 0x3b]
mov byte [ebp - 7], 0
push eax
push dword [0x10271098]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x100db15c
push 0x102710b8
push 0x800000
push dword [0x10271098]
push 0x6801
push dword [0x102710a8]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x100db15c
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x100daf30
push 0x468e60
call fcn.100020f0
push 0x100db040
push 0x468eb6
mov dword [0x102710a0], eax
call fcn.100020f0
jmp 0x100db191
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.101163c0
mov esp, ebp
pop ebp
ret
Function at 0x100e0140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x101cfdb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ecx + 0xe4]
mov eax, edx
sub eax, dword [ecx + 0xe0]
push ebx
push esi
sar eax, 2
mov dword [ebp - 0x40], ecx
push edi
lea edi, [ecx + 0xdc]
cmp eax, 0x64
jb 0x100e022b
movaps xmm0, xmmword [0x101b72e0]
xor ecx, ecx
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0xc], 0x4e130d05
movaps xmm0, xmmword [0x101b7450]
movups xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 8], 0
nop dword [eax]
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0x23
jb 0x100e01a0
lea ebx, [ebp - 0x2b]
mov byte [ebp - 8], 0
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x100e01b7
sub ebx, ecx
lea esi, [ebx + 0x21]
push esi
call fcn.10117010
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x30], edi
call fcn.101193b0
push ebx
lea eax, [ebp - 0x2b]
push eax
lea esi, [edi + 0x20]
push esi
call fcn.10118c50
add esp, 0x1c
mov dword [edi + 0x14], ebx
mov dword [edi + 4], esi
mov dword [edi + 0x18], 0x1f
mov ecx, dword ds:[0xf3690c]
push 0
push 0xffff6f00
push dword [ebp - 0x30]
mov eax, dword [0x101b06ec]
call eax
push edi
call fcn.101163d0
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101163c0
mov esp, ebp
pop ebp
ret 4
push edi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], edx
call fcn.10049150
mov eax, dword [edi + 8]
lea esi, [ebp + 8]
sub esp, 0xc
mov ecx, esp
push edi
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], eax
call fcn.10049150
mov eax, dword [edi + 4]
sub esp, 0xc
mov ecx, esp
push edi
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], eax
call fcn.10049150
mov edx, esi
lea ecx, [ebp - 0x4c]
call fcn.100d5b90
add esp, 0x18
mov ebx, eax
mov ecx, eax
call fcn.100491b0
lea ecx, [ebp - 0x3c]
mov esi, eax
call fcn.100491b0
cmp esi, eax
je 0x100e02ec
push str.vector_iterators_incompatible
push 0x101aeae8
push 0
push 0xba
push 0x101af550
push 2
call fcn.1011d740
add esp, 0x18
cmp eax, 1
jne 0x100e02ce
int3
push 0
push 0xba
push str.C:Program_Files__x86_Microsoft_Visual_Studio2019CommunityVCToolsMSVC14.29.30133include_vector
push 0x101aec28
push str._vector_iterators_incompatible_
call fcn.1012c080
add esp, 0x14
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
push 3
sete bl
call fcn.10112de0
lea ecx, [ebp - 0x4c]
call fcn.100491c0
lea ecx, [ebp - 0x30]
call fcn.10112e90
push 3
lea ecx, [ebp - 0x30]
call fcn.10112de0
lea ecx, [ebp - 0x3c]
call fcn.100491c0
lea ecx, [ebp - 0x30]
call fcn.10112e90
test bl, bl
je 0x100e0216
mov eax, dword [ebp - 0x40]
mov byte [eax + 0x9c], 1
mov ecx, dword [edi + 8]
cmp ecx, dword [edi + 0xc]
je 0x100e035a
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, edi
mov eax, dword [edi + 8]
push eax
push eax
call fcn.10046c50
add dword [edi + 8], 4
jmp 0x100e0366
lea eax, [ebp + 8]
push eax
push ecx
mov ecx, edi
call fcn.1004e050
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101163c0
mov esp, ebp
pop ebp
ret 4
Function at 0x100e6b80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177cd0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101cfdb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x14]
mov dword [ebp - 4], 0
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.10047940
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
mov dword [ebp - 4], 1
mov ecx, esi
push 0
push 0x101aec64
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
call fcn.10046d30
mov dword [edi + 0x30], 0
mov eax, edi
mov dword [edi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ed1d0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100ed090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x100f0340
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov dword [0x10271318], eax
mov eax, dword [esp + 8]
test eax, eax
je 0x100f057b
cmp dword [esp + 0xc], 1
jne 0x100f057b
cmp eax, dword [esi + 0x6c]
jne 0x100f0421
mov eax, dword [0x102710b4]
mov esi, dword [eax + 0x478]
test esi, esi
jne 0x100f0385
call fcn.100fd950
mov al, 1
pop esi
ret 8
mov ecx, dword [esi + 0xf8]
test ecx, ecx
je 0x100f03bc
cmp byte [ecx + 0x10d], 0
je 0x100f03bc
push 0
call dword [0x101b07e0]
mov ecx, dword [esi + 0x1bc]
test ecx, ecx
je 0x100f0575
push 0
call dword [0x101b07e0]
mov al, 1
pop esi
ret 8
mov ecx, dword [esi + 0x104]
test ecx, ecx
je 0x100f03db
cmp byte [ecx + 0x10d], 0
je 0x100f03db
mov ecx, esi
call fcn.10061e60
mov eax, dword [0x102710b4]
mov esi, dword [eax + 0x478]
mov ecx, dword [esi + 0x104]
test ecx, ecx
je 0x100f03f3
push 0
call dword [0x101b07e0]
mov ecx, dword [esi + 0xf8]
test ecx, ecx
je 0x100f0405
push 1
call dword [0x101b07e0]
mov ecx, dword [esi + 0x1bc]
test ecx, ecx
je 0x100f0575
push 1
call dword [0x101b07e0]
mov al, 1
pop esi
ret 8
cmp eax, dword [esi + 0x74]
jne 0x100f044b
cmp dword [esi + 0x54], 0x10
lea eax, [esi + 0x40]
jb 0x100f0431
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov al, 1
pop esi
ret 8
push edi
mov edi, dword [esi + 0x60]
cmp eax, edi
jne 0x100f04a2
test edi, edi
je 0x100f048a
push 0
mov ecx, edi
call dword [0x101b07e0]
mov edi, dword [esi + 0x60]
test edi, edi
je 0x100f048a
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100f048a
mov dword [0x10271054], edi
mov dword [0x10270fec], 7
call fcn.100ce410
mov eax, dword [0x102710b4]
mov eax, dword [eax + 0x514]
test eax, eax
je 0x100f0574
mov ecx, dword [eax + 4]
jmp 0x100f04f9
mov edi, dword [esi + 0x64]
cmp eax, edi
jne 0x100f050c
test edi, edi
je 0x100f04e0
push 0
mov ecx, edi
call dword [0x101b07e0]
mov edi, dword [esi + 0x64]
test edi, edi
je 0x100f04e0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100f04e0
mov dword [0x10271054], edi
mov dword [0x10270fec], 7
call fcn.100ce410
mov eax, dword [0x102710b4]
mov eax, dword [eax + 0x510]
test eax, eax
je 0x100f0574
mov ecx, dword [eax + 0x168]
test ecx, ecx
je 0x100f0574
push 1
call dword [0x101b07e0]
pop edi
mov al, 1
pop esi
ret 8
mov edi, dword [esi + 0x68]
cmp eax, edi
jne 0x100f0574
test edi, edi
je 0x100f054a
push 0
mov ecx, edi
call dword [0x101b07e0]
mov edi, dword [esi + 0x68]
test edi, edi
je 0x100f054a
push 4
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100f054a
mov dword [0x10271054], edi
mov dword [0x10270fec], 7
call fcn.100ce410
mov eax, dword [0x102710b4]
mov esi, dword [eax + 0x518]
test esi, esi
je 0x100f0574
push dword [esi + 4]
call fcn.100ca490
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x100f0570
push 1
call dword [0x101b07e0]
mov byte [esi + 0x20], 0
pop edi
mov al, 1
pop esi
ret 8
xor al, al
pop esi
ret 8
Function at 0x100f81d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017058d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push edi
mov eax, dword [0x101cfdb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push 8
movups xmmword [ebp - 0x20], xmm0
call fcn.10047940
lea ecx, [ebp - 0x20]
add esp, 4
mov dword [eax + 4], 0
mov dword [ebp - 0x20], eax
mov dword [eax], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], 0x214
cmp eax, dword [ebp - 0x14]
je 0x100f8250
mov dword [eax], 0x214
mov eax, dword [ebp - 0x18]
push eax
push eax
call fcn.10046c50
mov eax, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 0x18], eax
jmp 0x100f8260
lea ecx, [ebp - 0x10]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.1004e050
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], 0
cmp eax, dword [ebp - 0x14]
je 0x100f8285
mov dword [eax], 0
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
push eax
push eax
call fcn.10046c50
add dword [ebp - 0x18], 4
jmp 0x100f8292
lea ecx, [ebp - 0x10]
push ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.1004e050
sub esp, 0x10
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.1004dbb0
push 0xf3690c
call fcn.100ca330
mov dword [edi], eax
test eax, eax
je 0x100f82ff
mov ecx, edi
mov word [edi + 0xc], 0
call fcn.100f8360
mov ecx, dword [edi]
test ecx, ecx
je 0x100f82c8
mov ecx, dword [ecx]
add ecx, 0x70
mov eax, dword [ecx]
push 0
push 0
push 0
push 0x100f8140
push 0
mov dword [0x1027135c], eax
push 0
mov dword [ecx], 0x100f85a0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x100f80b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0x20]
call fcn.100432e0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100f8335
mov eax, dword [ebp - 0x14]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
call fcn.100479d0
add esp, 8
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x20]
push 8
push eax
mov dword [ebp - 0x20], 0
call fcn.100479d0
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1010f4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017a0dd
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x101cfdb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, dword [0x102710b4]
call fcn.1004dd60
mov ecx, edi
mov word [esi + 0x36], ax
call fcn.1010f670
movaps xmm0, xmmword [0x101b7080]
xor eax, eax
movups xmmword [ebp - 0x70], xmm0
mov byte [ebp - 0x30], 0
movaps xmm0, xmmword [0x101b7410]
movups xmmword [ebp - 0x60], xmm0
movaps xmm0, xmmword [0x101b8020]
movups xmmword [ebp - 0x50], xmm0
movaps xmm0, xmmword [0x101b8070]
movups xmmword [ebp - 0x40], xmm0
mov cl, byte [ebp - 0x70]
xor byte [ebp + eax - 0x6f], cl
inc eax
cmp eax, 0x3f
jb 0x1010f568
sub esp, 0x1c
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x6f]
mov ecx, esp
push eax
call fcn.100461a0
lea eax, [ebp - 0x2c]
push eax
call fcn.100492e0
add esp, 0x20
mov dword [ebp - 4], 0
lea ecx, [eax + 4]
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 0x74], ecx
jb 0x1010f5ab
mov ecx, dword [ecx]
mov dword [ebp - 0x74], ecx
mov ebx, ecx
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x1010f5b0
sub ebx, ecx
lea esi, [ebx + 0x21]
push esi
call fcn.10117010
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x78], edi
call fcn.101193b0
push ebx
push dword [ebp - 0x74]
lea esi, [edi + 0x20]
push esi
call fcn.10118c50
add esp, 0x1c
mov dword [edi + 0x14], ebx
mov dword [edi + 4], esi
mov dword [edi + 0x18], 0x1f
mov ecx, dword ds:[0xf3690c]
push 0
push 0x42d1eb
push dword [ebp - 0x78]
mov eax, dword [0x101b06ec]
call eax
push edi
call fcn.101163d0
add esp, 4
lea ecx, [ebp - 0x2c]
call fcn.100432e0
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x1010f62b
inc eax
push eax
push dword [ebp - 0x28]
call fcn.100479d0
add esp, 8
mov eax, dword [ebp - 0x2c]
push 8
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
call fcn.100479d0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101163c0
mov esp, ebp
pop ebp
ret 4
Function at 0x10111c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017a32d
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x101cfdb0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [0x102713c8], eax
test edi, edi
je 0x10111dc9
cmp edi, dword [esi + 0x1c]
jne 0x10111c5c
mov ecx, dword [0x102710b4]
mov eax, dword [ecx + 0x520]
test eax, eax
je 0x10111cbb
mov ecx, eax
call fcn.100e17d0
jmp 0x10111cb5
cmp edi, dword [esi + 0x24]
jne 0x10111cb5
mov ecx, dword [0x102710b4]
mov edx, dword [ecx + 0x4fc]
test edx, edx
je 0x10111cbb
movzx eax, byte [edx + 0x8e]
mov ecx, edx
push eax
call fcn.100f3450
mov edx, dword [0x102710b4]
mov eax, dword [edx + 0x4fc]
mov ecx, dword [eax + 0x94]
test ecx, ecx
je 0x10111ca4
push 1
call dword [0x101b07e0]
mov edx, dword [0x102710b4]
mov eax, dword [edx + 0x4fc]
push dword [eax + 0x94]
call fcn.100ca490
mov ecx, dword [0x102710b4]
cmp edi, dword [esi + 0x28]
jne 0x10111db5
cmp dword [ecx + 0x47c], 0
jne 0x10111d8d
movaps xmm0, xmmword [0x101b70b0]
xor ecx, ecx
movups xmmword [ebp - 0x50], xmm0
push 0
movaps xmm0, xmmword [0x101b7680]
movups xmmword [ebp - 0x40], xmm0
push 1
movaps xmm0, xmmword [0x101b7580]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x9181e0d
mov word [ebp - 0x1c], 0x4208
mov byte [ebp - 0x1a], 0
nop dword [eax]
mov al, byte [ebp - 0x50]
xor byte [ebp + ecx - 0x4f], al
inc ecx
cmp ecx, 0x35
jb 0x10111d10
sub esp, 0x1c
mov byte [ebp - 0x1a], 0
lea eax, [ebp - 0x4f]
mov dword [ebp - 0x54], esp
mov ecx, esp
push eax
call fcn.100461a0
mov dword [ebp - 4], 0
mov cl, 0x38
mov dword [ebp - 0x18], 0x4a4a7d38
xor eax, eax
mov word [ebp - 0x14], 0x4a57
mov byte [ebp - 0x12], 0
nop
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 5
jae 0x10111d5f
mov cl, byte [ebp - 0x18]
jmp 0x10111d50
sub esp, 0x1c
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x17]
mov ecx, esp
push eax
call fcn.100461a0
mov ecx, dword [0x102710b4]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ecx + 0x474]
call fcn.100fc8c0
mov al, 1
jmp 0x10111dcb
mov esi, dword [ecx + 0x50c]
test esi, esi
je 0x10111dc5
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x10111dab
push 1
mov ecx, eax
call dword [0x101b07e0]
mov eax, dword [esi + 0x1c]
push eax
call fcn.100ca490
mov al, 1
jmp 0x10111dcb
cmp edi, dword [esi + 0x20]
jne 0x10111dc5
mov ecx, dword [ecx + 0x51c]
call fcn.10079e00
mov al, 1
jmp 0x10111dcb
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101163c0
mov esp, ebp
pop ebp
ret 8
Function at 0x1011c9f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1011c610
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1011ca22
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1017c3ec]
call dword [ebp - 8]
jmp 0x1011ca2c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x10154e00
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10154e27
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.101340f0
add esp, 4
or eax, 0xffffffff
jmp 0x10154e29
xor eax, eax
pop ebp
ret

Function at 0x10155a4e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1016b740

Function at 0x10160698
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1016008e
Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x4baab0]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4ba070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x4baab0], eax
test eax, eax
pop ebx
je 0x417ad1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ba05c
push eax
call esi
mov ecx, dword [0x4baab0]
push 0x4ba044
push ecx
mov dword [0x4baaac], eax
call esi
mov ecx, dword [0x4baaac]
mov dword [0x4baab4], eax
test ecx, ecx
je 0x417ac7
test eax, eax
je 0x417ac7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x4baab0], 0
xor eax, eax
pop esi
add esp, 0x50
ret