joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1101c820
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
push ebp
sub esp, 0x15c
lea ebp, [esp - 4]
mov eax, dword [0x111c8010]
xor eax, ebp
mov dword [ebp + 0x15c], eax
push 8
mov eax, 0x1115a8f7
call fcn.1113573b
push 0xfffffffffffffff0
mov esi, ecx
call fcn.110246ed
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
or eax, 0x6000000
push eax
push 0xfffffffffffffff0
mov ecx, esi
call fcn.110246ed
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [esi + 4]
lea edi, [esi + 0x14]
mov ecx, edi
call fcn.11036fbc
xor ebx, ebx
cmp dword [esi + 0x44c], 4
jne 0x1101c94e
mov ecx, dword [0x111cfd20]
cmp ecx, ebx
je 0x1101c8a5
mov eax, dword [0x111cfd24]
cmp eax, ebx
je 0x1101c8a5
push eax
push ecx
jmp 0x1101c947
mov eax, dword [esi]
push 0x11161b28
mov ecx, esi
call dword [eax + 0x14]
push eax
call fcn.11036fe4
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x1101c9c7
push eax
call fcn.11036fe4
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jne 0x1101c8eb
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x1101c9c7
call fcn.11036fe4
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, ebx
mov dword [0x111cfd24], eax
je 0x1101c9c7
push eax
call fcn.11133870
cmp eax, ebx
pop ecx
mov dword [0x111cfd20], eax
je 0x1101c932
push dword [0x111cfd24]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push dword [0x111cfd20]
call fcn.11135a80
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
push dword [0x111cfd24]
push dword [0x111cfd20]
call fcn.1103705b
pop ecx
pop ecx
lea ecx, [ebp]
call fcn.11031d21
push ebx
push edi
push ebx
push ebx
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.1101c6c9
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [ebp]
mov dword [ebp - 0x14], esp
call fcn.11032543
push eax
mov ecx, edi
call fcn.11039cb3
lea eax, [esi + 0x10]
push eax
mov ecx, edi
call fcn.11037593
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.create
call edi
push 0x10
lea eax, [ebp + 0x148]
push eax
push dword [esi + 4]
call fcn.1115a632
add esp, 0xc
lea eax, [ebp + 0x148]
push eax
call edi
push 1
push ebx
mov ecx, esi
call fcn.11024a82
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.1103a101
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x15c]
xor ecx, ebp
call fcn.1113507a
add ebp, 0x160
leave
ret 0x10
Function at 0x1101c9ee
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
xor ebx, ebx
push ebx
push dword [esp + 0x14]
mov edi, ecx
call fcn.1101c6d4
cmp eax, ebx
je 0x1101ca46
push esi
push eax
push ebx
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x1101ca45
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1101ca2e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push dword [esp + 0x18]
mov ecx, edi
call fcn.1101c6d4
cmp eax, ebx
jne 0x1101ca03
pop esi
pop edi
mov dword [0x111c3040], ebx
xor eax, eax
pop ebx
ret 0x10
Function at 0x1101ca53
Capabilities:
Create process on windows

Disassembly:
push pe_nt_image_headers32
mov eax, 0x1115a94b
call fcn.1113573b
mov ebx, ecx
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x84]
mov eax, dword [ecx]
lea edx, [ebp - 0xa0]
push edx
call dword [eax + 4]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x14]
lea edi, [ebx + 0x430]
push eax
mov ecx, edi
call fcn.11019b1d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.11024725
push str.click
mov ecx, esi
call fcn.110246f1
push eax
call fcn.1113521a
test eax, eax
pop ecx
pop ecx
je 0x1101cace
push str.textchanged
mov ecx, esi
call fcn.110246f1
push eax
call fcn.1113521a
test eax, eax
pop ecx
pop ecx
jne 0x1101cb05
mov eax, dword [edi + 4]
push edi
push eax
lea ecx, [ebp - 0x1c]
call fcn.11019715
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.110191e2
test al, al
jne 0x1101cb05
lea ecx, [ebp - 0x14]
call fcn.1101925c
mov eax, dword [eax + 0x84]
dec eax
push 0
push eax
mov eax, dword [0x111ceed8]
call dword [eax + 4]
push str.selectchanged
mov ecx, esi
call fcn.11024dc2
test al, al
je 0x1101cbc4
mov ecx, dword [esi + 0x84]
mov eax, dword [ecx]
lea edx, [ebp - 0xa0]
push edx
call dword [eax + 4]
xor edi, edi
inc edi
push str.Wizard_LicenceOption4Page1
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.11024dc2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
mov byte [ebp + 0xb], al
call fcn.11024725
cmp byte [ebp + 0xb], 0
je 0x1101cc59
mov ecx, dword [esi + 0x84]
call fcn.11027bf5
test al, al
push str.Wizard_NextBtn5Page1
je 0x1101cb91
lea esi, [ebx + 4]
mov ecx, esi
call fcn.11037c8e
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0xd0]
push str.Wizard_NextBtn4Page1
mov ecx, esi
call fcn.11037c8e
push edi
jmp 0x1101cbb5
add ebx, 4
mov ecx, ebx
call fcn.11037c8e
mov edx, dword [eax]
push 0
mov ecx, eax
call dword [edx + 0xd0]
push str.Wizard_NextBtn4Page1
mov ecx, ebx
call fcn.11037c8e
push 0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xd0]
jmp 0x1101cc59
push str.click
mov ecx, esi
call fcn.11024dc2
test al, al
je 0x1101cc59
mov ecx, dword [esi + 0x84]
mov eax, dword [ecx]
lea edx, [ebp - 0xa0]
push edx
call dword [eax + 4]
push str.Wizard_LicenceButton4Page1
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.11024dc2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
mov bl, al
call fcn.11024725
test bl, bl
je 0x1101cc59
mov esi, dword [esi + 0x84]
mov eax, dword [esi]
lea ecx, [ebp - 0x124]
push ecx
mov ecx, esi
call dword [eax + 0x98]
push 1
xor esi, esi
push esi
push esi
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.110246f1
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.11024725
call fcn.111357da
ret 4
Function at 0x1101cc61
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x2d0
mov eax, 0x1115a98c
call fcn.111357a4
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x2c0], ecx
jb 0x1101cc8c
lea ebx, [esi + 4]
mov eax, dword [ebx]
mov dword [ebp - 0x2b8], ebx
jmp 0x1101cc97
lea eax, [esi + 4]
mov dword [ebp - 0x2b8], eax
mov ebx, eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1101ccac
mov al, 1
call fcn.111357ee
ret 8
push 0x111b6e68
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.110091f0
add esp, 0xc
mov eax, dword [ebp - 0x60]
xor edi, edi
cmp dword [ebp - 0x4c], 8
mov dword [ebp - 4], edi
jae 0x1101cccf
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x2b4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x2bc], eax
je 0x1101ce08
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x48]
call fcn.11005690
push 0x111b6e70
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.110077e0
test eax, eax
je 0x1101cdd2
push 0x111b6e74
lea ecx, [ebp - 0x48]
call fcn.110077e0
test eax, eax
je 0x1101cdd2
test byte [ebp - 0x2b4], 0x10
lea eax, [ebp - 0x288]
push eax
push esi
jne 0x1101cd85
lea eax, [ebp - 0x2c]
push eax
call fcn.110091f0
xor ebx, ebx
add esp, 0xc
inc ebx
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1101cd55
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1101cd72
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x64
cmp ebx, 0x12d
jl 0x1101cd49
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.11005060
mov ebx, dword [ebp - 0x2b8]
jmp 0x1101cdd2
lea eax, [ebp - 0x2dc]
push eax
call fcn.110091f0
push 0x111b6dbc
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 2
call fcn.110091f0
add esp, 0x18
mov ecx, dword [ebp - 0x2c0]
push 1
push eax
mov byte [ebp - 4], 3
call fcn.1101cc61
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.11005060
push edi
push 1
lea ecx, [ebp - 0x2dc]
call fcn.11005060
push edi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.11005060
lea eax, [ebp - 0x2b4]
push eax
push dword [ebp - 0x2bc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1101ccec
push dword [ebp - 0x2bc]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp + 0xc], 0
je 0x1101ce39
cmp dword [esi + 0x18], 8
jb 0x1101ce18
mov eax, dword [ebx]
jmp 0x1101ce1a
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1101ce39
xor bl, bl
push edi
push 1
lea ecx, [ebp - 0x64]
call fcn.11005060
mov al, bl
jmp 0x1101cca4
mov bl, 1
jmp 0x1101ce27
Function at 0x1101ce3d
Capabilities:
Terminate process

Disassembly:
push 0x1c
mov eax, 0x1115a9bc
call fcn.1113573b
mov ebx, ecx
xor edi, edi
jmp 0x1101ce83
push eax
push edi
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x1101ce90
push 0x64
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1101ce7a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
push edi
push dword [ebp + 0xc]
call fcn.1101c6d4
cmp eax, edi
jne 0x1101ce4f
push dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
call fcn.11005690
push 1
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.1101cc61
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.11005060
xor eax, eax
call fcn.111357da
ret 0x10

Function at 0x1101f6b2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x1101f6d7
cmp eax, edi
jge 0x1101f6cf
mov eax, esi
call fcn.1101f0a6
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x1101f6f9
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x1101f6de
cmp ecx, 4
jge 0x1101f718
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x1101f706
xor eax, eax
jmp 0x1101f70e
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x1101f6fc
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x1101f74a
mov eax, str.zlib_corrupt
call fcn.1101d120
jmp 0x1101f785
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x1101f75a
mov eax, str.read_past_buffer
jmp 0x1101f743
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x1101f76f
mov ecx, edi
call fcn.1101f0d1
test eax, eax
je 0x1101f785
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.11135a80
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x1102871f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov edx, dword [esi + 0x3ac]
lea eax, [esi + 0x3a8]
cmp dword [eax], edx
push edi
jg 0x1102873f
lea ecx, [edx + 1]
mov dword [eax], ecx
mov ecx, dword [eax]
cmp dword [esi + 0x3b0], ecx
jle 0x1102874f
mov dword [esi + 0x3b0], ecx
cmp dword [esi + 0x3b0], edx
jge 0x1102875d
mov dword [esi + 0x3b0], edx
and dword [ebp - 0x10], 0
mov ebx, dword [esi + 0xdc]
xor eax, eax
cmp byte [esi + 0x3a4], 0
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
je 0x1102879e
mov eax, dword [esi + 0xd8]
sub eax, dword [esi + 0xd0]
mov edi, dword [esi + 0x3b0]
sub edi, edx
imul eax, edi
sub ecx, edx
cdq
idiv ecx
sub ebx, dword [esi + 0xd4]
mov edi, eax
jmp 0x110287c3
sub ebx, dword [esi + 0xd4]
mov eax, ecx
sub eax, dword [esi + 0x3b0]
sub ecx, edx
imul eax, ebx
cdq
idiv ecx
mov edi, dword [esi + 0xd8]
sub edi, dword [esi + 0xd0]
mov dword [ebp - 0xc], eax
lea ecx, [esi + 0x3b4]
call fcn.11024849
test al, al
jne 0x11028834
lea ecx, [esi + 0x438]
call fcn.11024856
push ebx
push edi
push ebx
push edi
push dword [ebp - 0xc]
lea edi, [esi + 0x438]
push dword [ebp - 0x10]
push str.dest_d__d__d__d_source0_0__d__d
push edi
call fcn.11024e78
add esp, 0x20
mov ecx, edi
call fcn.110246f1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, edi
call fcn.110246f1
lea edi, [esi + 0x3b4]
push eax
mov ecx, edi
call fcn.110246f1
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.1102f93b
test al, al
jne 0x11028834
mov ecx, edi
call fcn.11024856
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x11029175
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x111c8010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x18], bl
push edi
je 0x110291e6
cmp dword [esi + 0x10], ebx
je 0x110291e6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.111382b0
cmp esp, ebx
mov dword [ebp - 8], esp
je 0x110291e6
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push dword [ebp - 8]
add ecx, 0x134
call fcn.1102489c
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.110381a2
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1113507a
leave
ret 0x10
Function at 0x11036f69
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jge 0x11036f7f
push 8
pop edi
push 2
call esi
test ax, ax
jge 0x11036f8b
or edi, 1
push 1
call esi
test ax, ax
jge 0x11036f97
or edi, 2
push 0x10
call esi
test ax, ax
jge 0x11036fa3
or edi, 4
push 0x12
call esi
test ax, ax
jge 0x11036faf
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret

Function at 0x110386a6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
cmp eax, ecx
mov ebx, dword [ebp + 8]
je 0x110386cb
cmp ebx, dword [esi + 0x50]
je 0x110386cb
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x50]
cmp ebx, eax
je 0x1103878d
test eax, eax
push edi
je 0x1103871e
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x50]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor edi, edi
push edi
push edi
push edi
push str.killfocus
push dword [esi + 0x50]
mov ecx, esi
call fcn.110381a2
mov dword [esi + 0x50], edi
test ebx, ebx
je 0x1103878c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x1103878c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc0]
test al, al
je 0x1103878c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xcc]
test al, al
je 0x1103878c
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [esi + 0x50], ebx
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x50]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
xor eax, eax
push eax
push eax
push eax
push str.setfocus
push dword [esi + 0x50]
mov ecx, esi
call fcn.110381a2
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1103ff5d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3b4], ebx
je 0x1103ffc5
cmp dword [ebp + 8], 0x100
jne 0x1103ffb4
cmp word [ebp + 0xc], 0xd
jne 0x1103ffb4
cmp byte [esi + 0x3ba], bl
je 0x1103ff9b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x1103ffb4
cmp byte [esi + 0x3bb], bl
jne 0x1103ffb4
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x1103ffb0
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.110381a2
xor eax, eax
jmp 0x1103ffc8
mov eax, dword [esi + 0x3b4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x11041e59
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
and byte [esi + 0xc], 9
mov al, byte [esi + 0xc]
test al, 1
je 0x11041e92
test al, 8
jne 0x11041e92
push 0xfffffffffffffff0
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x11041e92
or byte [esi + 0xc], 4
test eax, 0x21000000
mov cl, byte [esi + 0xc]
jne 0x11041e92
or cl, 2
mov byte [esi + 0xc], cl
test byte [esi + 0xc], 2
je 0x11041eb0
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 8]
mov ecx, esi
call fcn.11041d19
jmp 0x11041ebb
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4

Function at 0x110435e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x110435f3
xor eax, eax
ret
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x110436ae
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x11167a90]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x11167a90]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x11167a90]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x11167a90]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x11167a90]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x11167a90]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x11167a90]
inc edx
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x11167a90]
inc edx
sub eax, 8
dec edi
jne 0x11043613
pop edi
test eax, eax
je 0x110436c7
movzx ebx, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x11167a90]
inc edx
dec eax
jne 0x110436b2
mov eax, esi
pop esi
not eax
pop ebx
ret
Function at 0x11043b60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x11043b94
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x11043b8f
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x11043bbc
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x11043ba5
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.11135a80
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x11044933
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x111c8010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x110449dc
movzx ecx, word [esi]
test cx, cx
je 0x110449dc
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x11044971
cmp cx, 0x5c
jne 0x11044973
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x11044965
cmp eax, esi
je 0x110449b0
push edi
sub eax, esi
mov edi, eax
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.111378ea
and word [ebp + edi*2 - 0x20c], 0
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.11044933
add esp, 0x14
pop edi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.111352d5
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.111352ab
add esp, 0x10
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1113507a
leave
ret

Function at 0x11045f0d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x11045f88
cmp dword [esi + 4], 0xffffffff
jne 0x11045f88
push edi
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x111b6dbc
push edi
call fcn.111352ab
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop edi
jne 0x11045f5a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x11045f5a
mov eax, 0x2000000
jmp 0x11045f8d
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.11043976
add esp, 0x10
test eax, eax
jne 0x11045f78
mov eax, dword [ebp + 0x10]
jmp 0x11045f8d
push eax
call fcn.11045b09
mov dword [esi], eax
mov eax, dword [0x111d0328]
pop ecx
jmp 0x11045f8d
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x1104d430
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x1104d452
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x1104d446
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x1104d482
cmp dword [esi + 8], 0
jne 0x1104d475
mov ecx, dword [eax + 8]
push 0x11168460
push ecx
call fcn.1113c651
add esp, 8
test eax, eax
mov dword [esi + 8], eax
jne 0x1104d475
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.1113b6a4
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1104d4a4
mov eax, dword [esi + 8]
test eax, eax
je 0x1104d49e
push eax
call fcn.11139ba5
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x1104db50
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x111c8010]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1104dba0
mov ax, word [esp]
cmp al, 2
jne 0x1104db9a
cmp ah, al
jne 0x1104db9a
xor eax, eax
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.1113507a
add esp, 0x194
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 2
call fcn.1113507a
add esp, 0x194
ret