joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003e76
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 1
pop ebx
push edi
mov esi, ebx
call fcn.01005aa9
test eax, eax
jne 0x1003e90
mov eax, ebx
jmp 0x1003eef
cmp dword [0x100ae7c], 0
jne 0x1003edd
test byte [0x100aab8], bl
jne 0x1003edd
push 6
push 0
push 0x1002e91
mov dword [0x100b0a4], edi
push dword [0x100aa78]
push 0x7d3
push dword [0x100b6dc]
call fcn.01005920
sub eax, 6
je 0x1003edb
dec eax
je 0x1003ef5
sub eax, 0x832
jne 0x1003edd
mov dword [0x100ae7c], ebx
mov esi, ebx
test esi, esi
je 0x1003eed
push pe_nt_image_headers32
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop edi
pop esi
pop ebx
ret 4
xor esi, esi
jmp 0x1003edd

Function at 0x100401b
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov cl, byte [edi]
test cl, cl
je 0x100407f
mov al, byte [edi + 1]
lea esi, [edi + 1]
xor ebx, ebx
cmp al, 0x3a
jne 0x100403f
cmp byte [edi + 2], 0x5c
jne 0x100403f
lea esi, [edi + 3]
jmp 0x100404e
cmp cl, 0x5c
jne 0x100404e
cmp al, cl
jne 0x100404e
push 2
lea esi, [edi + 2]
pop ebx
mov al, byte [esi]
test al, al
je 0x100407f
cmp al, 0x5c
jne 0x1004074
cmp byte [esi - 1], 0x3a
je 0x1004074
test ebx, ebx
je 0x1004065
dec ebx
jmp 0x1004074
and byte [esi], 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x100404e
pop edi
pop esi
pop ebx
ret 4

Function at 0x10049d0
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [esp + 0x118]
push edi
xor edi, edi
xor ebp, ebp
mov eax, edi
inc edi
push eax
lea eax, [esp + 0x14]
push 0x1001470
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esp + 0x118]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.01005a24
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
je 0x1004a38
cmp edi, 0x190
jl 0x10049e5
jmp 0x1004a4b
xor ebp, ebp
push ebp
push esi
call ebx
test eax, eax
je 0x1004a4b
push 1
pop ebp
mov dword [0x100aaa0], ebp
test ebp, ebp
jne 0x1004a76
push esi
push ebp
push 0x100146c
push dword [esp + 0x124]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1004a76
push 1
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8
Function at 0x1004a85
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
je 0x1004b12
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.010049d0
test eax, eax
je 0x1004b6f
lea eax, [ebp - 0x128]
mov esi, 0x100ae84
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100b6d4], 0x20
je 0x1004b05
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
sub eax, ebx
je 0x1004afa
dec eax
je 0x1004af3
dec eax
je 0x1004aec
dec eax
jne 0x1004b05
push 0x1001494
jmp 0x1004aff
push 0x100148c
jmp 0x1004aff
push 0x1001484
jmp 0x1004aff
push 0x100147c
push esi
call fcn.01005a24
push 0x10012c4
push esi
call fcn.01005a24
jmp 0x1004b21
push dword [ebp + 8]
mov esi, 0x100ae84
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.01004e6a
test eax, eax
jne 0x1004b41
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1004b77
mov dword [0x100aaa0], 1
push ebx
push dword [ebp + 0x10]
push esi
call fcn.01004f50
test eax, eax
je 0x1004b5a
push 1
mov dword [0x100b704], ebx
pop eax
jmp 0x1004b71
cmp dword [0x100aaa0], ebx
je 0x1004b6f
push esi
mov dword [0x100aaa0], ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
call fcn.010056f3
mov dword [0x100b704], eax
jmp 0x1004b6f
Function at 0x1004e6a
Capabilities:
Get file attributes

Disassembly:
push ebx
push ebp
push esi
or ebp, 0xffffffff
push edi
mov edi, dword [esp + 0x14]
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0x13
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jne 0x1004eb4
push eax
push 0x10
push eax
push eax
push 0x4b5
push eax
call fcn.01003c23
call fcn.010056f3
mov dword [0x100b704], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov edi, dword [esp + 0x14]
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x10014ac
mov ecx, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
mov ecx, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
push 0x4000080
push 1
push edi
push edi
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebp
je 0x1004ea1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, ebp
je 0x1004ea1
test al, 0x10
je 0x1004ea1
push 1
mov dword [0x100b704], edi
pop eax
jmp 0x1004ead
Function at 0x1005665
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10056a2
push eax
push 0x10
push eax
push eax
push 0x4f0
push eax
call fcn.01003c23
call fcn.010056f3
mov dword [0x100b704], eax
xor eax, eax
leave
ret
push 2
lea eax, [ebp - 0x104]
push 2
push eax
call fcn.01004f50
leave
ret

Function at 0x1005712
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x24]
push edi
push 0x1001370
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], edi
call ebx
add esp, 0xc
lea eax, [ebp - 0x24]
push 0xa
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10057db
jmp 0x1005755
xor edi, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x10057c1
mov eax, dword [esi]
lea edi, [esi + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + edi + 1]
push eax
push edi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [ebp + 8]
test eax, eax
je 0x10057d0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
inc dword [ebp - 4]
lea eax, [ebp - 0x24]
push dword [ebp - 4]
push 0x1001370
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x24]
push 0xa
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x1005753
jmp 0x10057db
mov dword [0x100b704], 0x80070714
mov dword [ebp - 8], edi
jmp 0x10057db
and dword [ebp - 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10058c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push 0x100ae84
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.01005a24
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1005913
test al, 0x10
jne 0x1005913
push 8
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x100591c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4

Function at 0x1005aa9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005abc
xor eax, eax
jmp 0x1005ac4
not eax
shr eax, 4
and eax, 1
ret 4
Function at 0x10073cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x1007413
cmp edx, 0x10
jl 0x10073ff
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x10073ec
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x1007413
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x100740b
and edx, 3
cmp edx, 3
jne 0x1007427
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x100742c
cmp edx, 2
jne 0x1007438
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x100743d
cmp edx, 1
jne 0x1007443
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x417c10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
push edi
push str.Shell32.lib
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.SetCurrentProcessExplicitAppUserModelID
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call sub.MPR.dll_WNetCloseEnum
mov dword [esp + 8], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [esp + 0xc]
mov edi, eax
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetACP]
test edi, edi
mov dword [0x4c6cdc], eax
je 0x417c92
test esi, esi
je 0x417c81
mov edx, dword [0x4c5abc]
push 0x4c57ac
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [0x4c6cdc]
pop edi
pop esi
add esp, 8
ret

Function at 0x4adeb7
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
pop ebp
hlt
mov esp, 0xa070d1d1
cmc
xchg ecx, eax
jo 0x4ade32
nop
lodsb al, byte [esi]
and al, 0
lock or dword [bx + di + 0x4cad], esi
dec esp
cdq
jns 0x4ade38
mov al, 0x70
mov cl, 0xed
sub byte [eax - 0x6f], dh
mov dl, byte [ebx - 0x37ed7350]
mov dword [0x24527cae], eax
movsb byte es:[edi], byte [esi]
pop ebp
invalid
pop edi
loop 0x4addd5
dec esp
add byte [ecx], bh
mov ebp, 0x24735167
mov dh, al
jg 0x4ade23
invalid
mov dword [0x122060], ecx
pushal
adc dword [eax + 0x28a7760], ebp
xor byte [edi + 0x11], bh
add byte [eax + 0x11], ah
test al, 0x60
ja 0x4addc9
add dh, byte [eax]
jg 0x4ade54
push edx
add byte [eax - 0x2f], dh
adc esp, edx
mov dh, 0xf0
lodsd eax, dword [esi]
mov ds, word [edi - 0x51]
lodsd eax, dword [esi]
das
push edx
nop
invalid
jge 0x4ade27
pop es
test al, 0x42
loopne 0x4adea3
loopne 0x4adebf
loope 0x4adf08
loope 0x4adef9
push ebp
stc
arpl dx, sp
mov bl, dl
push 0xffffffffffffff87
sub esi, dword [esi - 0x1de6607b]
neg byte [ebx - 0x33]
loop 0x4adf18
neg byte [ebx - 0x33]
push cs
and al, 0x14
adc al, 0xe7
xchg edi, eax
xchg esp, eax
xor eax, dword [ecx]
jb 0x4adeb0
xchg edx, eax
imul bh
xor byte [edx - 0xe66ec00], dl
pushfd
mov esp, 0x9c008c30
xor ah, dl
invalid
arpl word [edi], di
invalid
aas
cmp dh, 0x13
xor byte [eax + 0x3df14d51], dh
in al, dx
invalid
stosb byte es:[edi], al
push edx
adc esp, dword fs:[edx]
sub esp, eax
xchg ecx, eax
jl 0x4adf71
salc
shl byte [eax + 0x7f24c2cd], 0x6f
dec esi
cli
scasd eax, dword es:[edi]
push edi
mov al, byte [0x2422bad0]
mov al, byte [0x23c2cd0c]
mov ch, 0xf8
dec esi
jmp 0x10a1af47
pop ds
das
rol dword [esi + edx - 0x42980c83], cl
mov dh, 0xc
lea esp, [eax - 0x62cf7044]
xor byte [ebp + 0x2280c6d0], bl
jno 0x4adf77
rol dh, 1
and byte [edx], 0x71
cli
jge 0x4adf66
mov eax, 0x64e9e6f9
add al, 0xe1
mov ebx, 0x4d670283
mov bl, 0x4f
stosb byte es:[edi], al
fld dword [ebx]
loope 0x4adf75
into
and ecx, esp
mov dword [0x2f048bad], eax
test byte [edi], ch
or ch, ah
add byte [edi + 0x2304ef04], ch
into
sub al, byte [edi + ebp]
ljmp 0x36cc
Function at 0x10002310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov byte [ebp - 2], 0
jmp 0x10002323
mov al, byte [ebp - 2]
add al, 1
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
cmp ecx, 4
jge 0x10002389
mov byte [ebp - 1], 0
jmp 0x1000233b
mov dl, byte [ebp - 1]
add dl, 1
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
cmp eax, 4
jge 0x10002387
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx*4]
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp + 8]
shl edx, 2
movzx esi, byte [ebp - 2]
shl esi, 2
lea edx, [esi + edx*4]
movzx esi, byte [ebp - 1]
add esi, dword [ebp + 0x10]
movzx edx, byte [esi + edx]
movzx eax, byte [eax + ecx]
xor eax, edx
movzx ecx, byte [ebp - 1]
movzx edx, byte [ebp - 2]
mov esi, dword [ebp + 0xc]
lea edx, [esi + edx*4]
mov byte [edx + ecx], al
jmp 0x10002332
jmp 0x1000231b
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x17f008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0x10
jmp 0x10002992
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp + 0x10]
jae 0x10002a5a
cmp dword [ebp - 0x18], 0x10
jne 0x10002a3a
mov eax, dword [ebp + 8]
add eax, 0xb0
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.100028c0
add esp, 8
mov dword [ebp - 0x18], 0xf
jmp 0x100029e9
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
jl 0x10002a33
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 0xb0]
cmp ecx, 0xff
jne 0x10002a13
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x18]
mov byte [edx + 0xb0], 0
jmp 0x100029e0
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 0xb0]
add ecx, 1
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x18]
mov byte [edx + 0xb0], cl
jmp 0x10002a33
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x1c]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0x18]
movzx eax, byte [ebp + edx - 0x14]
xor ecx, eax
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x1c]
mov byte [edx], cl
jmp 0x10002980
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f989
mov esp, ebp
pop ebp
ret
Function at 0x10005c30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x17f008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x114], 1
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.10012360
add esp, 0xc
push 0x5c
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1000a190
add esp, 8
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x10005ca2
xor eax, eax
jmp 0x10005e85
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x110], edx
push 0x17b050
mov eax, dword [ebp + 0xc]
push eax
call fcn.1001644f
add esp, 8
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x10005cd8
xor eax, eax
jmp 0x10005e85
push 0xfa001
call fcn.1001733e
add esp, 4
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x118], 0
mov ecx, dword [ebp - 0x11c]
push ecx
call fcn.100165a3
add esp, 4
test eax, eax
jne 0x10005e28
push 0x104
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.10012360
add esp, 0xc
mov eax, dword [ebp - 0x11c]
push eax
push 0xfa000
push 1
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.1001679a
add esp, 0x10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x118], 0
jne 0x10005d72
cmp dword [ebp - 0x114], 0xfa000
jae 0x10005d72
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.100095e0
add esp, 8
jmp 0x10005d9d
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x110]
push edx
push 0x17b054
call fcn.1000f0c0
add esp, 4
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.1000a150
add esp, 0x10
cmp dword [ebp - 0x114], 0
jbe 0x10005dfe
push 0x17b060
call dword [0x175034]
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x114]
push edx
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10005ea0
add esp, 0x10
mov dword [ebp - 0x124], eax
mov edx, dword [ebp - 0x120]
add edx, dword [ebp - 0x114]
mov dword [ebp - 0x120], edx
cmp dword [ebp - 0x124], 0
jne 0x10005dfe
mov eax, dword [ebp - 0x120]
jmp 0x10005e85
push 0xfa001
push 0
mov eax, dword [ebp - 0x10c]
push eax
call fcn.10012360
add esp, 0xc
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x118], ecx
jmp 0x10005cf5
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x128], edx
push 1
mov eax, dword [ebp - 0x128]
push eax
call fcn.1000ff31
add esp, 8
cmp dword [ebp - 0x128], 0
jne 0x10005e5a
mov dword [ebp - 0x12c], 0
jmp 0x10005e70
mov dword [ebp - 0x10c], 0x8123
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x12c], ecx
mov edx, dword [ebp - 0x11c]
push edx
call fcn.10016523
add esp, 4
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f989
mov esp, ebp
pop ebp
ret
Function at 0x1000bd70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x17f008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push eax
call dword [0x175024]
mov byte [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x17], ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov byte [ebp - 7], cl
mov edx, dword [ebp + 8]
sub edx, 0x12
mov dword [ebp - 0x28], edx
mov eax, dword [0x1803ac]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x14], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0xc], edx
mov ax, word [eax + 0x10]
mov word [ebp - 8], ax
mov ecx, 1
imul edx, ecx, 0
mov al, byte [ebp + edx - 0x18]
mov byte [0x1802d4], al
mov ecx, 1
shl ecx, 0
mov dl, byte [ebp + ecx - 0x18]
mov byte [0x1802d5], dl
lea eax, [ebp - 0x16]
mov ecx, dword [eax]
mov dword [0x1802d6], ecx
mov edx, dword [eax + 4]
mov dword [0x1802da], edx
mov ecx, dword [eax + 8]
mov dword [0x1802de], ecx
mov edx, dword [eax + 0xc]
mov dword [0x1802e2], edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [0x1803ac]
add ecx, 0x12
push ecx
mov edx, dword [0x1803ac]
push edx
call fcn.100236d0
add esp, 0xc
mov dword [ebp - 0x24], 0
jmp 0x1000be44
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x28]
jge 0x1000be84
mov edx, dword [0x1803ac]
add edx, dword [ebp - 0x24]
mov al, byte [edx]
mov byte [ebp - 0x1d], al
movzx ecx, byte [ebp - 0x1d]
mov edx, dword [ebp - 0x24]
and edx, 0x8000000f
jns 0x1000be6e
dec edx
or edx, 0xfffffff0
inc edx
movzx eax, byte [edx + 0x1802d6]
xor ecx, eax
mov edx, dword [0x1803ac]
add edx, dword [ebp - 0x24]
mov byte [edx], cl
jmp 0x1000be3b
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2c], 0
push 0x17bdc4
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.10016466
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x1000bed5
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x28]
push eax
push 1
mov ecx, dword [0x1803ac]
push ecx
call fcn.10017732
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x1c]
push edx
call fcn.10016523
add esp, 4
mov eax, dword [0x1803ac]
push eax
push 0
call dword [0x175068]
push eax
call dword [0x175064]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f989
mov esp, ebp
pop ebp
ret
Function at 0x1000e260
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [0x17f008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x540], 0
mov byte [ebp - 0x84], 0
push 0x7f
push 0
lea eax, [ebp - 0x83]
push eax
call fcn.10012360
add esp, 0xc
push 0x17ab4b
lea ecx, [ebp - 0x84]
push ecx
call fcn.1000de20
add esp, 8
mov byte [ebp - 0x534], 0
push 0x4af
push 0
lea edx, [ebp - 0x533]
push edx
call fcn.10012360
add esp, 0xc
push 1
lea eax, [ebp - 0x534]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000c220
add esp, 0xc
lea edx, [ebp - 0x84]
push edx
lea eax, [ebp - 0x534]
push eax
call fcn.10005230
add esp, 8
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 1
jne 0x1000e3d0
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x53c], 0
mov ecx, dword [0x1803a8]
push ecx
push 0
call dword [0x175068]
push eax
call dword [0x17506c]
mov dword [0x1803ac], eax
push 0x17c590
lea edx, [ebp - 0x84]
push edx
lea eax, [ebp - 0x538]
push eax
call fcn.10016466
add esp, 0xc
cmp dword [ebp - 0x538], 0
je 0x1000e3d0
mov ecx, dword [ebp - 0x538]
push ecx
mov edx, dword [0x1803a8]
push edx
push 1
mov eax, dword [0x1803ac]
push eax
call fcn.1001679a
add esp, 0x10
mov dword [ebp - 0x53c], eax
mov ecx, dword [ebp - 0x53c]
cmp ecx, dword [0x1803a8]
jne 0x1000e3d0
mov edx, dword [ebp - 0x538]
push edx
call fcn.10016523
add esp, 4
lea eax, [ebp - 0x84]
push eax
call dword [0x175024]
push 0x80
push 0
lea ecx, [ebp - 0x84]
push ecx
call fcn.10012360
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x53c]
push eax
call fcn.1000bd70
add esp, 8
mov eax, dword [ebp - 0x540]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f989
mov esp, ebp
pop ebp
ret

Function at 0x1001b63d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001b4bc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401760
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
fldz
xor eax, eax
mov word [esp], ax
fstp qword [esp + 4]
xor ecx, ecx
xor edx, edx
mov word [esp], cx
mov word [esp + 0x4e], dx
mov ecx, 1
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x6c]
mov word [esp + 0x50], cx
lea ecx, [esp + 0x20]
push ecx
push eax
push eax
push 8
push eax
push eax
push eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x84]
push edx
push eax
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x70], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x60
ret
Function at 0x401ea0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
fldz
push ebx
mov ebx, dword [esp + 0x18]
fstp dword [esp + 0xc]
push ebp
push esi
xor eax, eax
push edi
mov word [esp + 0x10], ax
mov dword [esp + 0x14], eax
push ebx
call fcn.0040b559
mov edi, dword [esp + 0x24]
push ebx
mov esi, eax
push edi
push esi
call fcn.0040b640
fld qword [0x41f440]
mov ecx, dword [0x4276a4]
fstp qword [0x4241d8]
sub edi, 0x42303c
lea ebp, [esi + ebx]
add esp, 0x10
add ecx, edi
mov eax, esi
cmp esi, ebp
je 0x401f10
mov dl, byte [ecx]
xor byte [eax], dl
mov edx, dword [esp + 0x14]
add edx, 0x51439c4e
inc eax
inc ecx
mov dword [0x425474], edx
cmp eax, ebp
jne 0x401ef6
mov ax, word [esp + 0x10]
mov edx, dword [esp + 0x14]
movsx ecx, ax
sub edx, ecx
mov dword [esp + 0x24], edx
pop edi
mov eax, esi
fild dword [esp + 0x20]
pop esi
pop ebp
pop ebx
fadd dword [esp + 8]
fstp dword [0x42476c]
add esp, 0xc
ret