joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102eeef6
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 3]
jmp 0x102eef18
pushfd
mov word [esp], di
lea esp, [esp + 0xc]
popal
sub esp, 0xc
jmp 0x102eef5d
shr edi, 0x18
mov edi, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
and edi, ecx
call fcn.102eef47
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
seto bl
mov ebx, edx
jmp 0x102eef91
xchg bh, bl
movzx ebx, byte [esi + 0xe]
call fcn.102eefce
sahf
adc al, byte [eax + 0x1cd712e7]
xchg edi, eax
pop es
bound edx, qword [ecx + 0x54258a5e]
invalid

Function at 0x103da951
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esi + 0xd4]
xchg word [esp], ax
mov ax, 0x2b34
mov edx, 0xa5cb1256
rdtsc
jmp 0x103da983
mov dword [esp + 1], eax
lea ecx, [eax + edi]
btr dx, sp
jmp 0x103da936
xchg byte [esp + 0x22], ch
pop dword [esp + 2]
bt ecx, edx
not ax
mov dword [esp + 6], edi
xchg byte [esp + 0x20], dl
jmp 0x103da996
lea ecx, [eax + ecx]
not dx
std
push word [esp + 7]
xchg edx, ecx
sub esp, 0x1b
jmp 0x103da95e
mov dx, ax
pushfd
xchg cx, dx
xchg word [esp + 0xa], dx
mov ax, dx
bswap eax
jmp 0x103daa73
mov ax, 0xe964
mov ecx, esi
lea ecx, [edi*4]
mov dl, bl
mov ax, word [esp + 0x27]
clc
jmp 0x103da9bf
xchg dword [esp + 0x23], ecx
shr eax, 0x1f
lea eax, [edi*4]
xchg dword [esp + 0x1e], edx
bswap ecx
push dword [esp + 0x18]
jmp 0x103da9d5
xchg ah, cl
ror al, 4
neg ch
setb dh
or ecx, 0xfa6d5fd2
mov byte [esp + 0x25], bh
jmp 0x103da9fb
pop edx
lea edx, reloc.MSVCRT.dll_strncpy
mov dword [esp + 7], ebp
pop dword [esp + 0x10]
bsr eax, ecx
sub esp, 0xf
jmp 0x103daa39

Function at 0x103dacf5
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dx
mov cx, 0x3f2
dec ecx
add esp, 5
lea esp, [esp]
setb dh
jmp 0x103dacf7
jmp 0x103dacdf
rdtsc
mov ecx, ebx
pop dx
mov al, 0x46
lea eax, [edx + ebx]
bt cx, dx
jmp 0x103dad49
pop eax
setp dh
dec edx
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x103dad5c
mov ax, word [esp + 2]
mov word [esp + 1], bp
neg ah
mov dh, 0x3b
xchg byte [esp + 2], cl
clc
jmp 0x103dad17
lea edx, [ecx - 0xf3]
cld
mov edx, dword [esp]
setp al
pushfd
lea eax, [ecx + esi]
jmp 0x103dad2d
lea edx, [esi*4]
mov ecx, 0xdb633ab7
not edx
neg cx
cmc
rdtsc
jmp 0x103dae11
lea esp, [esp + 0x3e]
mov ecx, dword [esp]
rdtsc
pushal
stc
stc
jmp 0x103dade7
pushal
xchg ecx, eax
mov cl, ah
xchg word [esp + 0x23], ax
mov ax, dx
push word [esp + 0x2a]
jmp 0x103dad95
lea eax, [ecx + esi]
mov dx, word [esp + 0x14]
bts ecx, esp
inc dh
mov eax, dword [esp + 0xc]
sub esp, 2
jmp 0x103dadab
xchg dword [esp + 0xf], ecx
mov dh, dl
rdtsc
std
xchg cl, dl
call 0x103dadf8
loopne 0x103dadae
push esi
jmp 0x103dae25
mov ah, byte [esp]
inc cx
sub esp, 0x1b
bt dx, bp
mov ch, 0xe5
btr dx, dx
jmp 0x103dadd1
lea edx, [eax*4]
push dword [esp + 0x13]
lea edx, [edi + ebp]
lea edx, [edi*4]
jmp 0x103dae6e
lea ecx, [eax*4]
call fcn.103dae97
in eax, dx
adc dword [ebx], 0x76
test dword [esi + eax*8], esp
jno 0x103daedd
jae 0x103dadf2
add esp, 5
bt dx, cx
les eax, [0xcaa30f66]
push eax
pop ecx
mov ax, di
mov ecx, 0x218d797a
jmp 0x103dae58
ret
Function at 0x103ddcc2
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
jmp 0x103ddca1
Function at 0x1008681
Capabilities:
Get token privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push edi
lea eax, [ebp - 4]
push eax
push 0x28
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1008749
push ebx
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
test eax, eax
je 0x10086f5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
push edi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
call ebx
push edi
push edi
push edi
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp + 8]
push eax
push edi
push edi
push 3
push dword [ebp - 4]
call esi
push 0x101b120
push dword [ebp + 8]
call fcn.0101206b
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x1008724
push 0xe
call ebx
jmp 0x100873e
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 8]
push eax
push 3
push dword [ebp - 4]
call esi
push dword [ebp - 8]
mov edi, eax
call fcn.01011b8f
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, edi
pop edi
leave
ret 4
Function at 0x100fb2f
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x101757b
call fcn.01011f3e
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor esi, esi
push esi
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0xff
push 7
push 0x361
push 0x100544c
push 0x10053c8
push 0x1005360
call fcn.01012994
lea ecx, [ebp - 0x60]
call fcn.01013ba7
mov eax, dword [edi + 4]
mov dword [ebp - 4], esi
cmp eax, 0xffffffff
jne 0x100fb93
mov dword [ebp + 8], 0x8000ffff
push 0x1018610
lea eax, [ebp + 8]
push eax
call sub.msvcrt.dll__CxxThrowException
cmp dword [0x101b064], esi
je 0x100fbcd
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test al, 2
je 0x100fbc1
lea eax, [ebp - 0x20]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov dword [0x101b10c], 1
test eax, eax
jne 0x100fbc7
mov dword [0x101b10c], esi
mov dword [0x101b064], esi
cmp dword [0x101b10c], esi
je 0x100fc1f
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x100fbdb
push esi
sub eax, edx
lea ecx, [ebp - 0x18]
push ecx
sar eax, 1
push eax
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
jne 0x100fca1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x100fc17
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 8], eax
jmp 0x100fb85
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
call ebx
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x100fc03
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, esi
jne 0x100fc5c
mov dword [ebp + 8], 0x8007000e
jmp 0x100fb85
push esi
push esi
push dword [ebp - 0x14]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
call edi
push eax
call ebx
cmp eax, esi
jne 0x100fc7d
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x100fc03
push esi
lea ecx, [ebp - 0x18]
push ecx
dec eax
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10]
test eax, eax
je 0x100fc74
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea ecx, [ebp - 0x60]
call fcn.01013c60
call fcn.0101202a
ret 4
Function at 0x101030f
Capabilities:
Check if file exists
Get disk size

Disassembly:
push 0x58
mov eax, 0x1017da7
call fcn.01011f3e
xor esi, esi
push esi
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 7
push 0x86
push 0x1005810
mov ebx, 0x10053c8
push ebx
mov edi, 0x1005360
push edi
call fcn.01012994
lea ecx, [ebp - 0x64]
call fcn.01013ba7
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x10103de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10103a5
cmp eax, 3
je 0x10103a5
cmp eax, esi
mov ecx, eax
jle 0x10103a0
and ecx, 0xffff
or ecx, 0x80070000
mov dword [ebp - 0x5c], ecx
jmp 0x10103ac
mov dword [ebp - 0x5c], 0x80042308
push eax
push 0x10057c0
push dword [ebp - 0x5c]
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 7
push 0x9e
push 0x1005810
push ebx
push edi
call fcn.01012994
lea eax, [ebp - 0x64]
push eax
call fcn.010143db
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
lea ecx, [ebp - 0x64]
call fcn.01013c60
mov eax, esi
mov edx, edi
call fcn.0101202a
ret 4
Function at 0x1011f03
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1018e18
call fcn.01012464
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x101b48c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1011d18
cmp eax, esi
jne 0x1011d0b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1011d1b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1011cf2
xor esi, esi
inc esi
mov eax, dword [0x101b488]
cmp eax, esi
jne 0x1011d2e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1011d69
mov eax, dword [0x101b488]
test eax, eax
jne 0x1011d63
mov dword [0x101b488], esi
push 0x1001274
push 0x1001268
call fcn.01011c6f
pop ecx
pop ecx
test eax, eax
je 0x1011d69
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1011e33
mov dword [0x101b140], esi
mov eax, dword [0x101b488]
cmp eax, esi
jne 0x1011d8d
push 0x1001264
push 0x1001258
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x101b488], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1011d9a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x101b498], ebx
je 0x1011dbb
push 0x101b498
call fcn.010123d9
pop ecx
test eax, eax
je 0x1011dbb
push ebx
push 2
push ebx
call dword [0x101b498]
push dword [0x101b128]
push dword [0x101b12c]
push dword [0x101b124]
call fcn.01009f5f
add esp, 0xc
mov dword [0x101b13c], eax
cmp dword [0x101b130], ebx
jne 0x1011e19
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x101b140], ebx
jne 0x1011e27
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x101b13c]
call fcn.010124a9
ret
call fcn.010125b1
jmp 0x1011cd0
Function at 0x1013438
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x101b078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call sub.VssTrace.DLL_Ordinal_11
cmp eax, dword [esi + 4]
je 0x1013540
and dword [ebp - 0x808], 0
mov dword [esi + 4], eax
lea eax, [ebp - 0x808]
push eax
push dword [esi + 0x1c]
push dword [esi + 0x18]
call sub.VssTrace.DLL_Ordinal_8
test eax, eax
je 0x1013486
mov eax, dword [ebp - 0x808]
jmp 0x1013499
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x1013494
call fcn.0101373e
jmp 0x1013499
call sub.VssTrace.DLL_Ordinal_6
mov dword [esi], eax
mov eax, dword [0x101b090]
cmp eax, dword [esi + 4]
je 0x1013540
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
mov ecx, esi
call fcn.01012ff6
push dword [esi + 4]
lea eax, [ebp - 0x804]
push dword [0x101b090]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1006218
push 0x78
push 0x10061f8
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x80c], esp
push 0xff
push 0xb
push 0x250
push 0x1006190
push 0x100617c
push 0x1006118
call fcn.01012994
push esi
call fcn.01012f36
mov eax, dword [esi + 4]
add esp, 0x7c
mov dword [0x101b090], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01011f29
leave
ret
Function at 0x1015aab
Capabilities:
Get disk information

Disassembly:
push 0x44
mov eax, 0x1018243
call fcn.01011f3e
and dword [ebp - 4], 0
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 0xb
push 0x183
mov ebx, 0x10076e4
push ebx
mov edi, 0x10076d4
push edi
mov esi, 0x1007688
push esi
call fcn.01012994
lea ecx, [ebp - 0x50]
call fcn.01013ba7
push dword [ebp + 0x64]
mov ecx, dword [ebp + 0x68]
push 0x1007618
sub esp, 0x58
mov dword [ebp - 0x10], esp
xor eax, eax
mov word [ecx], ax
mov ecx, esp
push 0xff
push 0xb
push 0x18b
push ebx
push edi
push esi
mov byte [ebp - 4], 1
call fcn.01012994
lea eax, [ebp - 0x50]
push eax
call fcn.010138f0
add esp, 0x64
push dword [ebp + 0x6c]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x1015b6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0x64]
lea eax, [ebp + 8]
push 0x1003f80
push dword [ebp + 0x60]
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0x64], esp
push eax
call fcn.010129e0
lea eax, [ebp - 0x50]
push eax
call fcn.010143db
push dword [ebp + 0x68]
push 0x1007590
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0x64], esp
push 0xff
push 0xb
push 0x193
push ebx
push edi
push esi
call fcn.01012994
lea eax, [ebp - 0x50]
push eax
call fcn.010138f0
add esp, 0x64
lea ecx, [ebp - 0x50]
call fcn.01013c60
lea ecx, [ebp + 8]
call fcn.01012a44
call fcn.0101202a
ret 0x68
Function at 0x10037be
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1005274]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x1003853
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10037dc
sub eax, edx
sar eax, 1
mov ecx, 0x104
cmp eax, ecx
ja 0x1003853
push esi
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcscpy_s
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100380d
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x20c]
dec eax
dec eax
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x1003833
cmp cx, 0x2f
jne 0x100383a
xor ecx, ecx
mov word [eax], cx
jmp 0x1003822
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x1003855
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100421d
leave
ret
Function at 0x1003866
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x1005274]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push dword [edi + 4]
mov dword [ebp - 0x768], eax
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
mov ecx, dword [edi + 4]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10038a6
sub eax, edx
sar eax, 1
sub ebx, eax
mov eax, ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10038bb
sub eax, ecx
sar eax, 1
push 0x1001ca0
lea eax, [ebp + eax*2 - 0x20c]
push ebx
push eax
mov dword [ebp - 0x764], eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
jne 0x1003916
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1003aa1
mov ecx, 0x1001c9c
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003947
test dx, dx
je 0x1003943
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003947
add eax, 4
add ecx, 4
test dx, dx
jne 0x1003921
xor eax, eax
jmp 0x100394c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1003a67
mov ecx, 0x1001c94
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003985
test dx, dx
je 0x1003981
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003985
add eax, 4
add ecx, 4
test dx, dx
jne 0x100395f
xor eax, eax
jmp 0x100398a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1003a67
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push ebx
push dword [ebp - 0x764]
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [edi + 0xc]
add esp, 0x10
test eax, eax
je 0x10039cb
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push 0x104
lea eax, [ebp - 0x730]
push eax
push dword [edi + 8]
call fcn.01003d25
test eax, eax
je 0x1003a67
cmp dword [edi + 0xc], 0
je 0x1003a44
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea edx, [ebp - 0x20c]
call fcn.010036eb
test eax, eax
je 0x1003a44
test byte [ebp - 0x75c], 0x10
je 0x1003a67
lea esi, [ebp - 0x30c]
call fcn.010037be
test eax, eax
je 0x1003a67
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.01003530
jmp 0x1003a67
lea esi, [ebp - 0x20c]
call fcn.010037be
test eax, eax
je 0x1003a67
mov eax, esi
push eax
mov eax, dword [ebp - 0x768]
call fcn.01003609
mov esi, eax
test esi, esi
jne 0x1003a84
lea eax, [ebp - 0x75c]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test esi, esi
jne 0x1003916
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x1003a9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1003a9f
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100421d
leave
ret 8
Function at 0x1004203
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10046c8
call fcn.010043f4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1006d0c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1004018
cmp eax, esi
jne 0x100400b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100401b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003ff2
xor esi, esi
inc esi
mov eax, dword [0x1006d08]
cmp eax, esi
jne 0x100402e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1004069
mov eax, dword [0x1006d08]
test eax, eax
jne 0x1004063
mov dword [0x1006d08], esi
push 0x1001164
push 0x1001158
call fcn.01003f6f
pop ecx
pop ecx
test eax, eax
je 0x1004069
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1004133
mov dword [0x100533c], esi
mov eax, dword [0x1006d08]
cmp eax, esi
jne 0x100408d
push 0x1001154
push 0x100114c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1006d08], 2
cmp dword [ebp - 0x1c], ebx
jne 0x100409a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1006d10], ebx
je 0x10040bb
push 0x1006d10
call fcn.01004369
pop ecx
test eax, eax
je 0x10040bb
push ebx
push 2
push ebx
call dword [0x1006d10]
push dword [0x1005324]
push dword [0x1005328]
push dword [0x1005320]
call fcn.010022a1
add esp, 0xc
mov dword [0x1005338], eax
cmp dword [0x100532c], ebx
jne 0x1004119
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100533c], ebx
jne 0x1004127
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1005338]
call fcn.01004439
ret
call fcn.01004541
jmp 0x1003fd0
Function at 0x10007e80
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
sal dword [ecx - 0x42], 1
fsubr st(1), st(0)
aaa
scasd eax, dword es:[edi]
xchg esp, eax
sub eax, 0x2f2664ab
mov ch, 0xb2
cmp bh, byte [edx - 0x53c5460d]
mov dl, 0x3a
mov edx, 0xac3ab9f3
dec edi
dec ebp
jnp 0x10007e5b
fptan
cmpsb byte [esi], byte es:[edi]
das
cmp dh, bh
fdiv st(7)
xchg bl, bl
push 0x2c7f35d9
and byte [eax], dh
xor dword [esi], 5
pop esi
arpl bp, dx
lcall 0x90c2, 0x1d9ddca0
fcomp qword [ebp + 0x1d90c21d]
cld
lea edi, [ebx - 0x78]
fcomp qword [ebp + 0x1d90c21d]
cld
lea edi, [ebx - 0x78]
ret 0x1d90
adc al, byte [ebx - 0x111acef1]
mov dh, 0xb8
xor dl, byte [0xd0f19d4a]
jp 0x10007e83
push es
or dword [edi - 0x1d], esp
xchg esp, eax
popfd
jb 0x10007e4c
jp 0x10007edb
aas
invalid
xor al, 0x51
xchg esp, eax
inc eax
popal
xor byte [ebx + 0x7c], 0x6a
add al, 0xdc
out dx, eax
ficomp dword [ecx]
fimul dword [eax - reloc.KERNEL32.dll_GetFileSizeEx]
cdq
push ds
pop ds
or ebx, dword [ebx + reloc.KERNEL32.dll_GetFileSizeEx]
mov ecx, 0x5108aab2
inc ebx
or byte [ecx + 0x43], dl
push esp
stosb byte es:[edi], al
mov edi, 0x4e499355
aad 0x76
sub ecx, dword fs:[eax - reloc.KERNEL32.dll_GetFileSizeEx]
inc edi
inc byte [ebx]
je 0x10007efa
outsd dx, dword [esi]
clc
sbb dl, byte [edx + 0x5c0449ba]
mov ch, 0x89
cmp edx, dword [edi]
pop edx
cmpsb byte [esi], byte es:[edi]
stosb byte es:[edi], al
sub byte [ecx - 0x15b85030], dh
inc ecx
push edx
sbb ebx, ebx
adc dword [esi - 0x7e], eax
pop eax
call 0x6b415df0
push esp
sbb ebx, dword [ebx + 0x54]
test dword [ebp + ecx - 0x39], edx
leave
cmpsd dword [esi], dword es:[edi]
or al, bh
pop esi
push ds
out 0x59, al
std
ficomp dword [ebp - 0x49]
xchg esi, eax
jno 0x10007eee
pop ecx
stc
je 0x10007f98
add edx, edi
jge 0x10007fcd
int3
lds edx, [edi - 0x26]
xbegin 0x11b217e8
mov al, 0xdd
jle 0x10007fa8
invalid
test al, 0x84
stc
wait
stosb byte es:[edi], al
arpl word [esi - 0x7a], bp
les edx, [esi - 0x77]
sub al, 0x2c
aam 0
push eax
stc
push eax
xor edx, dword [edx]
cmpsd dword [esi], dword es:[edi]
ficomp word [edx + 0x26]
test eax, 0x77cc1462
jecxz 0x10007fdb
int3
and al, cl
mov ebx, 0x30c696f3
push ebp
sub al, 0x57
sbb esi, dword [ebp + 0x56]
xor dword [edi - reloc.KERNEL32.dll_GetFileSizeEx], 0xffffffeb
sub ch, byte [edi + 0x13f3a6ad]
sub al, ah
inc esi
ret 0x5e47