joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100329e0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x18]
and esi, 0x3f
mov eax, esi
mov ebx, edx
and eax, 3
shr esi, 2
xor edx, edx
test eax, eax
je 0x100329ff
mov edx, dword [edi + esi*4 + 0x20]
lea ecx, [eax*8]
mov eax, SysReAllocString
shr eax, cl
inc esi
or eax, edx
mov dword [edi + esi*4 + 0x1c], eax
cmp esi, 0xe
je 0x10032a3e
lea esp, [esp]
and esi, 0xf
jne 0x10032a30
push edi
lea edx, [edi + 0x20]
mov ecx, edi
call fcn.10031a60
mov dword [edi + esi*4 + 0x20], 0
inc esi
cmp esi, 0xe
jne 0x10032a20
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
mov dword [edi + 0x58], ecx
push edi
lea edx, [edi + 0x20]
mov ecx, edi
mov dword [edi + 0x5c], eax
call fcn.10031a60
xor eax, eax
mov ecx, dword [edi + eax*4]
bswap ecx
mov dword [ebx], ecx
inc eax
add ebx, 4
cmp eax, 5
jb 0x10032a61
mov ecx, edi
pop edi
pop esi
pop ebx
jmp fcn.10031a30

Function at 0x10032b20
Capabilities:
Hash data using sha1

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x18]
and esi, 0xf
mov dword [edi + esi*4 + 0x20], SysReAllocString
inc esi
mov ebp, edx
cmp esi, 0xe
je 0x10032b5e
jmp 0x10032b40
and esi, 0xf
jne 0x10032b50
push edi
lea edx, [edi + 0x20]
mov ecx, edi
call fcn.10031a60
mov dword [edi + esi*4 + 0x20], 0
inc esi
cmp esi, 0xe
jne 0x10032b40
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
shld ecx, eax, 5
shl eax, 5
mov dword [edi + 0x58], ecx
push ebp
lea edx, [edi + 0x20]
mov ecx, edi
mov dword [edi + 0x5c], eax
call fcn.10031a60
mov ecx, edi
pop edi
pop esi
pop ebp
jmp fcn.10031a30

Function at 0x10032b90
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret

Function at 0x10033770
Capabilities:
Hash data using sha256

Disassembly:
push ebp
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 0x20]
and edi, 0x3f
mov byte [edi + esi + 0x28], 0x80
inc edi
mov ebp, edx
cmp edi, 0x38
je 0x1003379e
and edi, 0x3f
jne 0x10033793
push esi
call fcn.10032bd0
mov byte [esi + edi + 0x28], 0
inc edi
cmp edi, 0x38
jne 0x10033788
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
push esi
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
call fcn.10032bd0
xor eax, eax
mov ecx, dword [esi + eax*4 + 4]
mov edx, dword [esi + eax*4]
bswap edx
bswap ecx
mov dword [ebp], edx
mov dword [ebp + 4], ecx
add eax, 2
add ebp, 8
cmp eax, 8
jb 0x100337c0
pop edi
mov ecx, esi
pop esi
pop ebp
jmp fcn.10032b90
Function at 0x100338f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push dword [ebp + 8]
mov esi, ecx
push edx
push eax
push eax
call fcn.100b1e79
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.100338b9
pop esi
pop ebp
ret 4

Function at 0x10033a78
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], edx
dec edx
je 0x10033a98
sub edx, 3
je 0x10033a8f
sub edx, 6
jne 0x10033a9c
add ecx, 0x10
jmp fcn.10032b90
or dword [ecx + 8], 0xffffffff
or dword [ecx + 0xc], 0xffffffff
ret
or dword [ecx + 4], 0xffffffff
ret

Function at 0x100350a7
Capabilities:
Hash data using sha256

Disassembly:
and dword [eax + 8], 0
and dword [eax + 0xc], 0
lea ecx, [eax + 0x10]
jmp fcn.10033a78
Function at 0x100420e2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xffff
jmp fcn.100420b3
Function at 0x100479ad
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [eax]
xor eax, eax
xor ecx, ecx
cmp dword [ecx + str.Hah_], edx
je 0x100479ca
add ecx, 0xc
inc eax
cmp ecx, 0xcc
jb 0x100479b3
or eax, 0xffffffff
ret
Function at 0x1004daa5
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
movzx eax, word [ecx]
mov edx, dword [esp + 4]
jbe 0x1004dada
push esi
push edi
movzx esi, byte [edx]
movzx edi, al
shr ax, 8
xor esi, edi
xor ax, word [esi*2 + 0x100eba68]
dec dword [esp + 0x10]
inc edx
cmp dword [esp + 0x10], 0
movzx eax, ax
ja 0x1004dab5
pop edi
pop esi
mov word [ecx], ax
ret 8
Function at 0x1005e589
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push 0x14
pop eax
cmp edx, eax
jae 0x1005e59d
xor eax, eax
jmp 0x1005e765
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov di, word [esi]
mov word [ecx], di
mov di, word [esi + 2]
movzx ebx, word [ecx]
mov word [ecx + 2], di
mov di, word [esi + 4]
mov word [ecx + 4], di
mov di, word [esi + 6]
mov word [ecx + 6], di
xor edi, edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x1c], edi
cmp bx, 2
je 0x1005e6ea
cmp bx, 9
je 0x1005e711
cmp bx, 1
jne 0x1005e618
cmp edx, 0x20
jb case.0x1005e697.8
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edi
movzx eax, word [esi + 0x18]
cdq
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
movzx eax, word [esi + 0x1a]
push 0x20
mov dword [ecx + 0xc], eax
pop eax
jmp 0x1005e762
cmp bx, 8
jne 0x1005e681
push 0x28
pop eax
cmp edx, eax
jb case.0x1005e697.8
mov edx, dword [esi + 0x14]
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edi
mov edx, dword [esi + 0x18]
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x1c], edi
movzx edx, word [esi + 0x20]
movzx ebx, word [esi + 0x22]
mov dword [ecx + 0xc], ebx
cmp edx, edi
jbe 0x1005e762
lea ecx, [eax + 0xc]
cmp ecx, dword [ebp + 0xc]
ja case.0x1005e697.8
mov ecx, dword [eax + esi + 8]
lea eax, [eax + ecx + 0xd]
cmp eax, dword [ebp + 0xc]
ja case.0x1005e697.8
cmp ecx, 0x400
ja case.0x1005e697.8
inc edi
cmp edi, edx
jb 0x1005e64e
jmp 0x1005e762
movzx edx, bx
add edx, 0xfffffffd
cmp edx, 0xb
ja case.0x1005e697.8
movzx edx, byte [edx + 0x1005e779]
jmp dword [edx*4 + 0x1005e769]
cmp dword [ebp + 0xc], 0x18
jb case.0x1005e697.8
mov esi, dword [esi + 0x14]
lea eax, [esi + 0x18]
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], edi
cmp dword [ebp + 0xc], eax
jb case.0x1005e697.8
cmp esi, 0x40000000
jbe case.0x1005e697.6
jmp case.0x1005e697.8
push 0x18
pop eax
cmp dword [ebp + 0xc], eax
jb case.0x1005e697.8
cmp bx, 8
jb 0x1005e762
add eax, 4
cmp dword [ebp + 0xc], eax
jb case.0x1005e697.8
jmp 0x1005e762
cmp edx, 0x20
jb case.0x1005e697.8
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edi
mov eax, dword [esi + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edi
push 0x20
jmp 0x1005e73c
cmp edx, 0x38
jb case.0x1005e697.8
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x30]
mov dword [ecx + 0xc], eax
push 0x38
pop esi
push dword [ebp + 0x10]
call fcn.1005de92
push edi
push 4
push edx
push eax
call fcn.100b1880
xor ecx, ecx
add eax, esi
adc edx, ecx
cmp edx, ecx
ja case.0x1005e697.8
jb 0x1005e762
cmp eax, dword [ebp + 0xc]
jbe 0x1005e762
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10076769
Capabilities:
Parse pe header

Disassembly:
cmp dword [esp + 4], 0x200
jb 0x100767c9
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x100767c9
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x100767c9
lea edx, [eax + 0x200]
cmp edx, dword [esp + 4]
ja 0x100767c9
test al, 7
jne 0x100767c9
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100767c9
add eax, 4
movzx ecx, word [eax]
sub ecx, 0x14c
je 0x100767e3
sub ecx, 0x74
je 0x100767dc
dec ecx
dec ecx
je 0x100767dc
dec ecx
dec ecx
je 0x100767d5
sub ecx, 0x3c
je 0x100767ce
sub ecx, 0x8464
je 0x100767e3
xor eax, eax
ret 8
mov ecx, 0x3030401
jmp 0x100767e8
mov ecx, 0x3030701
jmp 0x100767e8
mov ecx, 0x3030501
jmp 0x100767e8
mov ecx, 0x3030103
mov edx, 0x400
cmp word [eax + 0x10], dx
ja 0x100767c9
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x10076805
cmp eax, 0x20b
jne 0x100767c9
mov eax, dword [esp + 8]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x100767cb

Function at 0x10081d4b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
xor eax, eax
cmp esi, 8
jb 0x10081d6c
mov edx, esi
shr edx, 3
push edi
mov edi, dword [ecx + 4]
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
sub esi, 8
dec edx
jne 0x10081d5b
pop edi
cmp esi, 4
jb 0x10081d76
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x10081d87
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x10081d95
movzx edx, byte [ecx]
shl edx, 8
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x10081d9f
movzx ecx, byte [ecx]
xor eax, ecx
ret
Function at 0x1008f734
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [ecx + 0x3c]
cmp edx, 2
mov eax, dword [esp + 4]
jge 0x1008f754
cmp byte [ecx + 0x42], 0
je 0x1008f7ae
cmp eax, 0x3f
jb 0x1008f7ae
jne 0x1008f751
push 0x46
jmp 0x1008f7ad
dec eax
jmp 0x1008f7ae
cmp eax, 0x2c
jb 0x1008f7ae
cmp edx, 3
jl 0x1008f768
cmp eax, 0x2c
jne 0x1008f767
push 0x48
jmp 0x1008f7ad
dec eax
cmp edx, 4
jl 0x1008f777
cmp eax, 0x2c
jne 0x1008f776
push 0x49
jmp 0x1008f7ad
dec eax
cmp eax, 0x3a
jb 0x1008f7ae
cmp byte [ecx + 0x14], 0
je 0x1008f796
cmp eax, 0x3a
jne 0x1008f78b
push 0x44
jmp 0x1008f7ad
cmp eax, 0x3b
jne 0x1008f794
push 0x45
jmp 0x1008f7ad
dec eax
dec eax
cmp eax, 0x3f
jb 0x1008f7a6
cmp byte [ecx + 0x42], 0
je 0x1008f7a6
cmp eax, 0x3f
jmp 0x1008f74b
cmp eax, 0x44
jne 0x1008f7ae
push 0x47
pop eax
ret 4

Function at 0x1008f910
Capabilities:
Parse pe header

Disassembly:
cmp dword [esp + 4], 2
jb 0x1008f958
cmp byte [ecx], 0x4d
jne 0x1008f958
cmp byte [ecx + 1], 0x5a
jne 0x1008f958
cmp dword [esp + 4], 0x40
jb 0x1008f958
mov eax, dword [ecx + 0x3c]
lea edx, [eax - 0x40]
cmp edx, 0xfc0
ja 0x1008f958
test al, 7
jne 0x1008f958
lea edx, [eax + 0x18]
cmp edx, dword [esp + 4]
ja 0x1008f958
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1008f958
cmp word [ecx + 0x14], 0x60
sbb eax, eax
inc eax
jmp 0x1008f95a
xor al, al
ret 4
Function at 0x10092582
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xc
mov eax, 0x100bf576
call fcn.100b0a88
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, dword [eax + ecx*4]
xor edi, edi
cmp byte [esi + 0x68], 0x53
mov dword [ebp - 4], edi
jne 0x10092659
push 0x38
call fcn.10003dc0
pop ecx
cmp eax, edi
je 0x100925cc
mov dword [eax + 4], edi
mov dword [eax], vtable.NArchive::NTar::CSparseStream.0
mov dword [eax + 0x20], edi
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], edi
mov dword [eax + 0x30], edi
mov edi, eax
push edi
lea ecx, [ebp + 8]
call fcn.1003688f
xor eax, eax
add ebx, 0xfffffff8
push ebx
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 1
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov byte [edi + 0x18], 1
mov dword [edi + 0x1c], ebx
call fcn.10020ed7
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x70]
add edi, 0x28
push eax
mov ecx, edi
call fcn.100762c9
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 0x70]
jae 0x1009264d
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov ebx, dword [ebp - 0x18]
shl eax, 4
add eax, dword [esi + 0x6c]
mov dword [ecx + edx*8], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ecx + edx*8 + 4], ebx
inc dword [edi + 4]
mov ecx, dword [eax + 8]
add dword [ebp - 0x18], ecx
mov eax, dword [eax + 0xc]
adc dword [ebp - 0x14], eax
inc dword [ebp + 0xc]
jmp 0x10092619
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
xor eax, eax
jmp 0x100926a6
mov ecx, esi
call fcn.10091482
test al, al
je 0x10092678
push dword [ebp + 0x10]
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
add ebx, 0xfffffff8
push ebx
call fcn.10021902
jmp 0x10092655
mov eax, dword [esi + 0x80]
push dword [esi + 0x14]
mov ecx, dword [ebx + 0x1c]
push dword [esi + 0x10]
xor edx, edx
add eax, dword [esi + 0x78]
adc edx, dword [esi + 0x7c]
push edx
mov edx, dword [ebp + 0x10]
push eax
call fcn.1001f9ec
jmp 0x100926a6
call fcn.100b0b2d
ret 0xc
Function at 0x1009ce6a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi], ax
cmp byte [edi + 1], al
je 0x1009cee2
mov al, byte [edi + 2]
mov byte [ebp - 1], al
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.10002918
movzx eax, byte [edi + 4]
push eax
push 0x800
mov ecx, esi
call fcn.1009ce13
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x1009ceec
mov ecx, esi
call fcn.1009c0aa
mov byte [ebp - 1], al
mov eax, dword [ebx + 0x38]
mov dword [esi + 0x48], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x4c], eax
xor eax, eax
mov byte [esi + 0x41], 0
mov byte [esi + 0x40], 0x3f
mov byte [esi + 5], 0
mov word [esi + 0x42], ax
cmp byte [ebp - 1], al
jne 0x1009cf1c
mov eax, dword [ebp + 8]
cmp byte [eax + 0x24], 0
mov byte [ebp + 8], 1
jne 0x1009cf20
mov byte [ebp + 8], 0
push dword [ebp + 8]
mov ecx, esi
push 1
call fcn.1009ce13
cmp byte [ebp - 1], 0
je 0x1009cf4b
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
leave
ret 4

Function at 0x100a2b6c
Capabilities:
Hash data using sha1

Disassembly:
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
add ecx, 0x18
jmp fcn.10031a30
Function at 0x100a9ab4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x74
mov eax, 0x100c0973
call fcn.100b0abe
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov al, byte [edi + 0x2c]
mov byte [esi + 0x69], al
cmp dword [edi], 0x10900
mov edx, esi
sete al
mov ebx, edi
mov dword [ebp - 0x40], ecx
mov byte [esi + 0x68], al
call fcn.100a93b0
xor ebx, ebx
cmp eax, ebx
jne 0x100a9c58
mov eax, dword [edi + 0x80]
or eax, dword [edi + 0x84]
jne 0x100a9b07
inc eax
jmp 0x100a9b09
xor eax, eax
test al, al
lea ecx, [ebp - 0x80]
sete byte [ebp - 0x25]
mov dword [ebp - 0x34], ebx
call fcn.100a043b
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], ebx
cmp eax, ebx
jbe 0x100a9c3a
mov dword [ebp - 0x38], ebx
mov ebx, dword [esi + 0x20]
add ebx, dword [ebp - 0x38]
cmp word [edi + 0x20], 1
jne 0x100a9c27
cmp word [ebx + 0x20], 1
jne 0x100a9c27
mov eax, dword [esi + 0x60]
xor ecx, ecx
cmp byte [esi + 0x68], cl
sete cl
add ecx, eax
mov dword [ebp - 0x3c], ecx
lea ecx, [esi + 0x5c]
call fcn.100a9a75
mov ecx, dword [ebp - 0x3c]
mov edx, eax
mov dword [ebp - 0x30], edx
call fcn.100a9583
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x80]
push esi
push edi
push ebx
push dword [ebp - 0x40]
call fcn.100a89ec
test eax, eax
jne 0x100a9c48
lea eax, [ebx + 0x2c]
push 0x14
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.100aefe0
add esp, 0xc
test eax, eax
je 0x100a9bbc
cmp byte [edi + 0x2c], 0
je 0x100a9c60
lea ecx, [ebx + 0x2c]
call fcn.1009ffa1
test al, al
je 0x100a9c60
mov eax, dword [ebp - 0x30]
and dword [eax + 0x1c], 0
cmp dword [esi + 0x3c], 0
jne 0x100a9bd4
push dword [ebp + 0x10]
lea ecx, [esi + 0x38]
call fcn.100a82b5
push 0xffffffffffffffff
push dword [ebp - 0x30]
mov ecx, esi
call fcn.100a91c3
test eax, eax
jne 0x100a9c48
cmp byte [ebp - 0x25], al
je 0x100a9c27
mov eax, dword [edi + 0x78]
cmp eax, dword [ebx + 8]
jne 0x100a9c44
mov eax, dword [edi + 0x7c]
cmp eax, dword [ebx + 0xc]
jne 0x100a9c44
mov cl, 1
mov byte [ebp - 0x25], 0
cmp byte [edi + 0x2d], 0
je 0x100a9c27
cmp dword [ebx + 0x24], 1
jne 0x100a9c27
inc dword [ebp - 0x34]
mov eax, dword [edi + 0x28]
cmp eax, dword [ebp - 0x34]
sete al
test cl, cl
je 0x100a9c1f
test al, al
je 0x100a9c60
test al, al
je 0x100a9c27
test cl, cl
je 0x100a9c60
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x38], 0x40
cmp eax, dword [esi + 0x24]
jb 0x100a9b2e
cmp byte [ebp - 0x25], 0
jne 0x100a9c60
xor esi, esi
jmp 0x100a9c4a
xor cl, cl
jmp 0x100a9bff
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.100a7b4c
mov eax, esi
call fcn.100b0b41
ret 0x10
xor esi, esi
inc esi
jmp 0x100a9c4a

Function at 0x100ab821
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov ecx, edx
mov edx, dword [esp + 4]
test edx, edx
jbe 0x100ab855
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
shr esi, 8
xor esi, edi
shl eax, 8
and esi, 0xff
xor ax, word [esi*2 + 0x100ebc90]
dec edx
inc ecx
movzx eax, ax
test edx, edx
ja 0x100ab82f
pop edi
pop esi
ret 4
Function at 0x100ad58b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x100e7b8c], 0
push esi
mov esi, edx
jne 0x100ad5c4
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.10003427
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.10003deb
pop ecx
test esi, esi
je 0x100ad5d0
mov al, 1
jmp 0x100ad5d2
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x100ad5be
xor al, al
pop esi
leave
ret

Function at 0x100ad5d5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x100e7b8c], 0
jne 0x100ad60e
mov edx, ecx
push esi
lea ecx, [ebp - 0xc]
call fcn.10003427
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.10003deb
pop ecx
test esi, esi
pop esi
je 0x100ad61b
mov al, 1
leave
ret
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x100ad608
xor al, al
leave
ret

Function at 0x100ad61f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.100adca9
cmp eax, 0xffffffff
je 0x100ad64a
test al, 0x10
jne 0x100ad64a
test al, 1
je 0x100ad64a
mov edx, eax
and edx, 0xfffffffe
mov ecx, esi
call fcn.100ad58b
test al, al
je 0x100ad683
cmp byte [0x100e7b8c], 0
jne 0x100ad678
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.10003427
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.10003deb
pop ecx
test esi, esi
je 0x100ad683
mov al, 1
jmp 0x100ad685
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jmp 0x100ad672
xor al, al
pop esi
leave
ret

Function at 0x100ad688
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x314
lea ebp, [esp - 4]
mov eax, dword [0x100e6dd4]
xor eax, ebp
mov dword [ebp + 0x314], eax
push 0x18
mov eax, 0x100c0cc2
call fcn.100b0a55
mov esi, ecx
and dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
cmp byte [0x100e7b8c], cl
jne 0x100ad719
lea eax, [ebp + 0x20c]
push eax
push 0x105
mov byte [ebp + 0x20c], cl
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, eax
lea eax, [ebp + 0x20c]
push eax
lea ecx, [ebp - 0x18]
call fcn.10002833
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.1000346d
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.10002edf
push dword [ebp - 0x24]
call fcn.10003deb
push dword [ebp - 0x18]
call fcn.10003deb
pop ecx
pop ecx
jmp 0x100ad73b
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.10002e7f
dec edi
mov eax, 0x103
cmp eax, edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x314]
xor ecx, ebp
call fcn.100b0660
add ebp, 0x318
leave
ret
Function at 0x100adca9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x100e7b8c], 0
jne 0x100adcdb
mov edx, ecx
push esi
lea ecx, [ebp - 0xc]
call fcn.10003427
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.10003deb
pop ecx
mov eax, esi
pop esi
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100adce9
or eax, eax
leave
ret
Function at 0x100b0660
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100e6dd4]
jne 0x100b066a
repz ret
jmp fcn.100b25df

Function at 0x100b70ad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100b3410
and dword [ebp - 4], 0
cmp dword [0x100ec854], 0
mov ebx, eax
jne 0x100b715e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100b720f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100b720f
push eax
call fcn.100b339e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100ec854], eax
call esi
push eax
call fcn.100b339e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100ec858], eax
call esi
push eax
call fcn.100b339e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100ec85c], eax
call esi
push eax
call fcn.100b339e
pop ecx
mov dword [0x100ec864], eax
test eax, eax
je 0x100b715e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100b339e
pop ecx
mov dword [0x100ec860], eax
mov eax, dword [0x100ec860]
cmp eax, ebx
je 0x100b71b6
cmp dword [0x100ec864], ebx
je 0x100b71b6
push eax
call fcn.100b3419
push dword [0x100ec864]
mov esi, eax
call fcn.100b3419
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100b71b6
test edi, edi
je 0x100b71b6
call esi
test eax, eax
je 0x100b71ad
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100b71ad
test byte [ebp - 0xc], 1
jne 0x100b71b6
or dword [ebp + 0x10], 0x200000
jmp 0x100b71ef
mov eax, dword [0x100ec858]
cmp eax, ebx
je 0x100b71ef
push eax
call fcn.100b3419
pop ecx
test eax, eax
je 0x100b71ef
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100b71ef
mov eax, dword [0x100ec85c]
cmp eax, ebx
je 0x100b71ef
push eax
call fcn.100b3419
pop ecx
test eax, eax
je 0x100b71ef
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100ec854]
call fcn.100b3419
pop ecx
test eax, eax
je 0x100b720f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100b7211
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x2aa398c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x1dda6fdb
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
jmp 0x431219