joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b663
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d96b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1008dc90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1006af0e
push 4
mov dword [ebp - 4], 0
call fcn.1002cf17
mov edi, eax
add esp, 4
test edi, edi
je 0x1001b690
call fcn.1006b3b5
mov dword [edi], eax
call fcn.1006b174
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1006b0a9
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1001b686
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1006b0d1
jmp 0x1001b692
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001b695
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006d96b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1008dc90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1006af0e
push 4
mov dword [ebp - 4], 0
call fcn.1002cf17
mov edi, eax
add esp, 4
test edi, edi
je 0x1001b690
call fcn.1006b3b5
mov dword [edi], eax
call fcn.1006b174
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1006b0a9
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1001b686
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1006b0d1
jmp 0x1001b692
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, dword [eax + 0x104]
push edi
mov edi, ecx
mov ecx, dword [eax + 0x100]
jbe 0x1001f4c1
sub edx, edi
mov dword [ebp - 4], edx
push ebx
inc ecx
and ecx, 0xff
mov dl, byte [ecx + eax]
movzx ebx, dl
add esi, ebx
and esi, 0xff
mov bl, byte [esi + eax]
mov byte [ecx + eax], bl
mov byte [esi + eax], dl
movzx ebx, byte [ecx + eax]
movzx edx, dl
add ebx, edx
and ebx, 0xff
movzx edx, byte [ebx + eax]
mov ebx, dword [ebp - 4]
xor dl, byte [ebx + edi]
inc edi
dec dword [ebp + 8]
mov byte [edi - 1], dl
jne 0x1001f480
pop ebx
pop edi
mov dword [eax + 0x104], esi
mov dword [eax + 0x100], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001f47a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, dword [eax + 0x104]
push edi
mov edi, ecx
mov ecx, dword [eax + 0x100]
jbe 0x1001f4c1
sub edx, edi
mov dword [ebp - 4], edx
push ebx
inc ecx
and ecx, 0xff
mov dl, byte [ecx + eax]
movzx ebx, dl
add esi, ebx
and esi, 0xff
mov bl, byte [esi + eax]
mov byte [ecx + eax], bl
mov byte [esi + eax], dl
movzx ebx, byte [ecx + eax]
movzx edx, dl
add ebx, edx
and ebx, 0xff
movzx edx, byte [ebx + eax]
mov ebx, dword [ebp - 4]
xor dl, byte [ebx + edi]
inc edi
dec dword [ebp + 8]
mov byte [edi - 1], dl
jne 0x1001f480
pop ebx
pop edi
mov dword [eax + 0x104], esi
mov dword [eax + 0x100], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100277d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
push ebx
lea edx, [eax + eax*2]
sub ecx, edx
push esi
xor esi, esi
mov edx, ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], edx
test eax, eax
jle 0x100278c4
mov edx, dword [ebp + 0x14]
add edx, 0xfffffffc
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
movzx edx, byte [ecx]
mov byte [ebp + 0xf], dl
movzx edx, byte [ecx + 1]
movzx esi, byte [ebp + 0xf]
mov byte [ebp + 0x13], dl
movzx edx, byte [ecx + 2]
movzx edi, byte [ebp + 0x13]
mov byte [ebp + 0xb], dl
mov edx, esi
shr edx, 2
movzx edx, word [edx*2 + 0x1007ccb0]
mov word [eax], dx
shl esi, 4
mov edx, edi
shr edx, 4
or edx, esi
add dword [ebp - 4], 4
and edx, 0x3f
movzx edx, word [edx*2 + 0x1007ccb0]
mov word [eax + 2], dx
movzx edx, byte [ebp + 0xb]
mov esi, edx
shr esi, 6
add edi, edi
add edi, edi
or esi, edi
and esi, 0x3f
mov si, word [esi*2 + 0x1007ccb0]
mov word [eax + 4], si
and edx, 0x3f
movzx edx, word [edx*2 + 0x1007ccb0]
mov word [eax + 6], dx
add ebx, 4
add ecx, 3
add eax, 8
cmp ebx, dword [ebp - 0xc]
jle 0x100278b3
mov edx, 0xd
mov word [eax], dx
mov edx, 0xa
mov word [eax + 2], dx
add eax, 4
xor ebx, ebx
add dword [ebp - 4], 2
dec dword [ebp - 8]
jne 0x10027815
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
jmp 0x100278c7
mov eax, dword [ebp + 0xc]
cmp edx, 1
jne 0x1002790b
movzx ecx, byte [ecx]
mov edx, ecx
shr edx, 2
mov dx, word [edx*2 + 0x1007ccb0]
mov word [eax], dx
and ecx, 3
shl ecx, 5
mov cx, word [ecx + 0x1007ccb0]
mov word [eax + 2], cx
mov dword [eax + 4], 0x3d003d
add eax, 8
add esi, 4
xor ecx, ecx
pop edi
mov word [eax], cx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 2
jne 0x10027962
mov dl, byte [ecx]
mov cl, byte [ecx + 1]
movzx edx, dl
mov edi, edx
shr edi, 2
mov di, word [edi*2 + 0x1007ccb0]
mov word [eax], di
movzx ecx, cl
and edx, 3
mov edi, ecx
shl edx, 4
shr edi, 4
or edi, edx
mov dx, word [edi*2 + 0x1007ccb0]
mov word [eax + 2], dx
and ecx, 0xf
mov cx, word [ecx*8 + 0x1007ccb0]
mov word [eax + 4], cx
mov edx, 0x3d
mov word [eax + 6], dx
add eax, 8
add esi, 4
xor ecx, ecx
pop edi
mov word [eax], cx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10085fc8
push 0x10053c40
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, dword [0x1008dc90]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x2d], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
cmp dword [ecx + 0x1c], 0
je 0x100281c0
mov edx, dword [ebp - 0x40]
cmp dword [edx + 0x20], 0
je 0x100281c0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0xc]
and eax, 0xffff0000
jne 0x1002814e
movzx ecx, word [ebp + 0xc]
mov edx, dword [ebp - 0x3c]
movzx eax, word [edx + 0x10]
sub ecx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], 1
mov dword [ebp - 0x20], 0
jmp 0x10028160
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
movzx edx, byte [ebp - 0x2d]
test edx, edx
jne 0x100281c0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax + 0x18]
jae 0x100281c0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov cx, word [eax + edx*2]
mov word [ebp - 0x48], cx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 0
je 0x100281be
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10067be3
add esp, 8
test eax, eax
jne 0x100281be
movzx ecx, word [ebp - 0x48]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], 1
jmp 0x10028157
mov dword [ebp - 4], 0xfffffffe
jmp 0x100281d9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10102147
Capabilities:
Packed with generic packer

Disassembly:
lcall 0xff65, 0x236be437
xor al, 0x24
push ebx
mov dword [esp + 0xc], 0x3647f688
pushfd
mov dword [esp + 0xc], 0x7c4e4203
pushal
lea esp, [esp + 0x2c]
jmp fcn.1000ece1
push ebx
pushfd
nop
mov byte [esp + 4], ah
lea esp, [esp + 8]
je 0x101a4e2f
pushfd
push 0x8b1a85f
mov dword [esp + 4], ebx
push esi
pushal
not bl
mov ebx, dword [esp + 0x2c]
and al, 0x2c
pushfd
pushfd
call fcn.1021db9a
jg 0x10102122
mov ah, 0x4b
xchg dword [ebp - 0x49aa762], esp
jg 0x10102192
push ecx
jecxz 0x101021ff
and dword [ebx], esp
xchg byte [edx + 0x382b8e94], al
out dx, eax
or dword [ebp - 0x44713739], ebp
sbb byte [esi - 0x26], bh
push 0x13d37abf
adc al, 0x52
fisub dword [edx]
popal
sub ch, dh
jp 0x10102168
ljmp 0xb456:0xe5bd8623
loope 0x10102254
xor eax, dword [edx]
dec ebp
mov eax, dword [0x437ad2fe]
aad 0xad
add ch, byte [edx + edi - 0x3846d220]
leave
wait
mov ebx, 0x100fca9d
wait
jmp [ebp + 0x4835c1d1]
adc al, 0xa4
pop edx
inc byte [eax + 0x4b73da7e]
pushfd
fiadd dword [eax + 0x7d173af4]
shl byte [eax], cl
pop edx
clc
mov al, byte [0xcde33f68]
mov ebp, 0x3be73c1f
inc ebp
cmp byte [edx - 0x4c3ec3da], cl
cli
push cs
pop eax
sub dword [edx + 0x64], 0xffffffaa
aad 0x73
push ebp
sub al, 0x34
xor cl, byte [esi - 0x59a7736]
les eax, [ecx + 0x6f]
retf
pushfd
xchg dword [esp], ebx
bswap ebx
pushal
pushfd
mov ebx, dword [esp + 0x28]
mov byte [esp + 4], bh
lea ebx, [ebx + 1]
push dword [esp + 8]
mov word [esp], 0xad6c
mov dword [esp + 0x2c], ebx
bswap bx
mov ebx, 0x10004cfe
pushfd
jmp 0x10165832

Function at 0x1012ec84
Capabilities:
Encode data using xor

Disassembly:
call fcn.1012f6a4
add al, 0x3f
xor al, 0xd7
push esp
ja 0x1012ec8b
mov cl, 0xb2
imul edi, dword [ebp - 0x787caf35], 0xbd199aa1
sti
mov dword [eax], ebp
inc ebx
insb byte es:[edi], dx
pop edx
invalid

Function at 0x10160d39
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, dword [ebx + 0x158ceb]
mov dword [esp + 4], ebx
lea esp, [esp + 0x2c]
ja 0x101ff234
lea ebx, [ebx - 0x77ec90d9]
push esi
push dword [esp]
call fcn.100e0ddd
fld qword [edx - 0x133b7e5b]
sub byte [esi - 3], bl
sub dh, byte [eax]
insd dword es:[edi], dx
cdq
scasd eax, dword es:[edi]
and eax, dword [ebp - 1]
push ds
inc edx
add al, 0x38
inc esi
invalid
push edi
push 0x7817df9c
push 0x78b45672
lea ebx, [ebx - 0x77ec90d9]
push dword [esp]
pushal
push 0xbeea12b9
xchg dword [esp + 0x34], ebx
push 0x26f780ba
pushfd
push 0xdaefb8a0
push eax
push dword [esp + 0x44]
ret 0x48
Function at 0x101af214
Capabilities:
Encode data using xor

Disassembly:
pop ss
int3
aad 0x59
xchg esi, eax
scasb al, byte es:[edi]
ror dword [ecx - 0x6640a02], 0xaf
std
rcr ah, 0xc3
std
xchg ebx, eax
invalid
pushfd
nop
pushfd
call fcn.102488ed
jle 0x101af1a5
std
and byte [ebx], dl
rol ah, 0x56
les edx, [ebp - 0x21]
bound ebx, qword [esi + 0xc]
sbb byte [esi], ah
in eax, 0x26
or cl, byte [esi + 0x6f]
movsd dword es:[edi], dword [esi]
add byte [edi - 0x66], bl
les eax, [ecx + 0x4e41be8b]
or byte [esi - 0xf], dl
xor al, 0x9d
push ecx
scasb al, byte es:[edi]
nop
salc
jno 0x101af1fd
sti
xchg edi, eax
jne 0x101af284
push ss
sbb byte [eax + 0x5c8edc87], ch
mov ebx, 0x65a7a164
mov esp, 0x140b6523
sub al, byte [edi - 0x3b]
rcl byte [edx + edi*4 - 0x270e94ea], cl
mov al, byte [0xecb04b45]
fisub word [edi + 0x37]
sbb ch, bl
xchg dword [ecx], edi
popfd
and ebx, dword [ecx + 0x7e75b317]
ljmp 0xaf45
adc dword [edi + 0x645a4d1b], edi
add byte [ebp + 0x63], 0xbf
loop 0x101af30e
mov edi, 0x52797ee2
jns 0x101af2e4
mov ah, byte [edx + esi*4 + 0x2d3652c9]
fcom dword [edi + 0x405552b8]
cli
les esp, [eax - 2]
enter 0x7914, 0xffffffffffffffd3
or eax, 0xaf5129a9
sti
cmp ah, byte [ecx]
sti
leave
xor esp, ebp
mov edi, 0xb309456b
out 0x91, eax
test dword [edi - 0x43127cd7], ebp
cli
pop esi
lock and eax, dword [edi + edi + 0x6d5c54e4]
mov cl, 0x1f
push esi
mov byte [esi], dl
inc ecx
jg 0x101af28d
add al, 0xa0
or ebp, ebx
jmp 0x101af310
and al, 0xf0
into
push 0xfffffffffffffff0
pop ss
sub dword [ebx + 0x7f], edx
call 0x6ae8dcc8
fcomi st(3)
push 0x4cce89a2
jecxz 0x101af358
adc dl, bh
mov edi, 0x74d0dea8
repne scasd eax, dword es:[edi]
frstor dword [edi - 0x38a67ac5]
retf 0x4429
pop eax
xor al, 0xd6
salc
xchg edi, eax
cld
sbb ebx, dword [ebx]
wait
in al, 0xfa
mov al, 0xf2
popal
xchg esi, eax
repne movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
pushal
cmp dword [edx], eax
add eax, 0x7fa5393b
loop 0x101af32f
xor eax, 0x23c97a91
inc esi
cmp al, 0xc0
stosb byte es:[edi], al
int3
pushal
cld
enter 0x3c19, 0xffffffffffffffaa
cld
retf 0xab16

Function at 0x101c6b44
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + 1]
push ebp
mov dword [esp + 0x38], esi
call fcn.10120b5c
xchg edi, eax
xor eax, dword [ecx]
mov al, 0xf4
mov dl, 0xc9
ficomp word [edx]
dec eax
inc esp
out 0x54, al
shl dword [edx + 0x79], 0xed
mov edi, edi
mov ch, 0xf1
lahf
lodsb al, byte [esi]
pop ebx
adc al, 0xd1
lahf
dec ecx
in eax, dx
inc esp
test al, 0x36
xchg edx, eax
fmul qword [edx]
salc
xor byte [ebx + 0x15f751f5], dh
mov cs, word [edi]
mov ch, 0xd0
mov ebp, 0x35d1019e
mov edi, 0x1fc7fa4
xlatb
or ebp, dword [esi - 0x54]
fnsave dword [edx + 0x4c]
mov ebp, 0xc0523fe3
mov bl, byte cs:[ebp - 0x6d4ff605]
outsb dx, byte [esi]
lodsb al, byte [esi]
scasb al, byte es:[edi]
das
mov esp, 0xe19fe7f1
cmp eax, 0x3886225c
outsb dx, byte [esi]
adc byte [edx + ebx*4 + 0x58c34136], dh
insb byte es:[edi], dx
or eax, 0xc1370422
cld
shr byte [esi], 0xf2
and esi, dword [edx + ecx*4 - 0x4a968894]
call 0x2ebeb4ed
invalid
Function at 0x101d4632
Capabilities:
Encode data using xor

Disassembly:
pushal
call fcn.102586c4
stosb byte es:[edi], al
fnstenv [0x7fedbf5b]
mov byte [0x922be998], al
cmpsb byte [esi], byte es:[edi]
fcomp qword [esi + 0xd0967fb]
pop ss
mov bl, 0xcd
pop esi
invalid

Function at 0x101f43a8
Capabilities:
Encode data using xor

Disassembly:
call fcn.100cc0a7
sub byte [eax - 0x425ca836], bh
jecxz 0x101f43fc
sub dword [ebx], esp
dec eax
cli
mov byte [0x3a2c0063], al
scasb al, byte es:[edi]
in al, 0xc0
pop edx
sar byte [esi + eax - 0x30], 0xbb
sub byte es:[esi + esi*4 - 0x4f0995a3], ch
sub byte [esi + esi*4 - 0x4f0995a3], ch
test dl, al
xor al, 0x86
js 0x101f43ca
mov al, byte [0x7ed3a6cf]
pop edx
in eax, 0x3f
pop es
insd dword es:[edi], dx
lodsb al, byte [esi]
bnd jns 0x101f43b3
cmp dword [0x9aade1b6], 0x3806225a
jl 0x101f4423
cmp eax, 0x9aade1b6
pop edx
and al, byte [esi]
cmp byte [edx + esi - 0x4c], bh
push es
mov ah, 6
cmp ah, byte [edx + ebp*2 - 0x4c]
sbb dword [ebp - 0x1e382bad], 0xec19943d
loope 0x101f443b
xchg esp, eax
sbb esp, ebp
inc eax
daa
out 0x97, eax
imul ecx, ebp, 0x2618eff8
jae 0x101f43e6
inc ebx
sahf
pop edx
invalid
pop ebx
pop edi
adc edi, edx
push ebp
inc eax
inc al
xchg dword [ebx], ebx
into
rcl dword [ecx - 0x46685c1b], 0x1f
xchg esp, eax
jnp 0x101f4486
cmpsd dword [esi], dword es:[edi]
dec eax
arpl word [edi - 0x1451f057], dx
daa
xchg edi, eax
stosd dword es:[edi], eax
in eax, 0xda
push 0xffffffffffffffca
ljmp 0x436d
push ebx
mov byte [0x86acee8], al
out dx, al
cmp cl, byte gs:[0x9ec056b0]
fadd dword [edx + 0x733e8860]
daa
adc eax, 0x9fff4ea0
pop edx
hlt

Function at 0x1027067e
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov edi, dword [edi + 0x205981]
jmp 0x1017793f
Function at 0x100131c0
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0xc
mov esi, edx
mov edi, ecx
call fcn.100199b7
add esp, 4
test eax, eax
jne 0x100131d7
pop edi
pop esi
ret
push 0
push 0
push eax
push 0x10014000
push 0
push 0
mov dword [eax], edi
mov dword [eax + 8], 0
mov dword [eax + 4], esi
call fcn.1003c56e
add esp, 0x18
pop edi
pop esi
ret

Function at 0x10046a07
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10046886

Function at 0x1004a054
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10049d14

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x1a1115f4
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x10495d0e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x100051e7
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
and dword [eax], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test ebx, ebx
mov esi, 0x104
jne 0x10005293
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x10005321
lea eax, [ebp - 0x128]
push esi
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x10005321
lea eax, [ebp - 0x228]
push 0
push eax
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.MSVCRT.dll__splitpath]
lea eax, [ebp - 0x228]
push str..INI
push eax
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.MSVCRT.dll__makepath]
add esp, 0x28
lea ebx, [ebp - 0x128]
push 0x20
lea eax, [ebp - 0x24]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x24]
push ebx
push 0x20
push eax
push 0x1000d8e8
push 0x1000d8d8
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.MSVCRT.dll_atol]
test eax, eax
pop ecx
je 0x10005321
lea eax, [ebp - 0x128]
push esi
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x10005321
xor eax, eax
cmp byte [ebp - 0x128], al
je 0x1000530c
cmp eax, esi
jge 0x1000530c
cmp byte [ebp + eax - 0x128], 0x5c
lea ecx, [ebp + eax - 0x128]
jne 0x10005301
mov byte [ecx], 0x7c
inc eax
cmp byte [ebp + eax - 0x128], 0
jne 0x100052e9
push dword [ebp + 0x10]
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.1000532b
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10006048
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x1000f70c]
push esi
test eax, eax
je 0x10006063
push eax
push dword [esp + 0xc]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop eax
jmp 0x10006084
mov esi, dword [esp + 8]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1000607f
push esi
call fcn.10006088
jmp 0x1000605e
and byte [esi], 0
xor eax, eax
pop esi
ret 4
Function at 0x100060d0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebx
push esi
mov esi, 0x104
push edi
push esi
xor ebx, ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [0x1000f70c], eax
je 0x100061d1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x100061ba
push dword [0x1000f70c]
call fcn.10006088
push str.TempFolder
push dword [0x1000f70c]
call sub.MSVCRT.dll_strcat
push str..aaa
push dword [0x1000f70c]
call sub.MSVCRT.dll_strcat
push dword [0x1000f70c]
call sub.MSVCRT.dll_strlen
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x14
mov esi, eax
push ebx
push dword [0x1000f70c]
call edi
test eax, eax
jne 0x1000619f
mov eax, dword [0x1000f70c]
movsx ecx, byte [esi + eax - 1]
lea eax, [esi + eax - 1]
cmp ecx, 0x7a
jl 0x10006175
mov byte [eax], 0x61
mov eax, dword [0x1000f70c]
movsx ecx, byte [eax + esi - 2]
lea eax, [eax + esi - 2]
cmp ecx, 0x7a
jge 0x1000617b
inc cl
mov byte [eax], cl
jmp 0x10006196
mov byte [eax], 0x61
mov edx, dword [0x1000f70c]
movsx eax, byte [edx + esi - 3]
lea ecx, [edx + esi - 3]
cmp eax, 0x7a
jge 0x100061c0
inc al
mov byte [ecx], al
push ebx
push dword [0x1000f70c]
jmp 0x10006146
push dword [0x1000f70c]
call fcn.10006088
push dword [0x1000f70c]
call fcn.100061d7
push 1
pop ebx
jmp 0x100061d1
mov edx, dword [0x1000f70c]
cmp edx, ebx
je 0x100061d1
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [0x1000f70c], ebx
pop edi
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x1000623a
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
pop esi
push ebx
call fcn.10006088
lea eax, [ebp - 0x104]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x104]
push 0x1000d99c
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10006327
lea eax, [ebp - 0x218]
push 0x1000d998
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x10006302
lea eax, [ebp - 0x218]
push 0x1000d994
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x10006302
lea eax, [ebp - 0x104]
push ebx
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x104]
test byte [ebp - 0x244], 0x10
push eax
je 0x100062fa
call fcn.1000623a
jmp 0x10006300
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
test esi, esi
je 0x1000631c
lea eax, [ebp - 0x244]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10006292
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
je 0x10006330
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4