joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000905b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10009072
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x100090a7
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x100090a3
cmp edi, eax
jae 0x100090a7
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x10009095
cmp edi, eax
jb 0x100090ab
xor eax, eax
jmp 0x100090b4
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x10009c39
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebx + 0x94]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0xc]
shl eax, 4
add eax, 0x94
cmp eax, dword [ebp + 0xc]
jbe 0x10009c5d
xor eax, eax
jmp 0x10009ce5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x40
mov edi, 0x1000
push edi
push dword [ebx + 0x10]
push dword [ebx + 8]
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
test eax, eax
jne 0x10009c8e
push 0x40
push edi
push dword [ebx + 0x10]
push eax
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 8]
test edi, edi
je 0x10009ce9
push 0x25
pop ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
xor edi, edi
cmp dword [ebx + 0xc], edi
jbe 0x10009ce0
mov esi, dword [ebp - 4]
mov eax, dword [esi + 8]
cmp eax, dword [ebp + 0xc]
ja 0x10009ce9
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add edx, ecx
cmp edx, dword [ebx + 0x10]
ja 0x10009ce9
push dword [esi + 0xc]
add eax, ebx
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
add eax, ecx
push eax
call fcn.100361b0
add esi, 0x10
add esp, 0xc
inc edi
mov dword [ebp - 4], esi
cmp edi, dword [ebx + 0xc]
jb 0x10009ca6
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 8
xor eax, eax
jmp 0x10009ce3
Function at 0x10009ced
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 8], 0x94
push ebx
push esi
push edi
mov ebx, eax
mov edi, ecx
jae 0x10009d14
push str.invalid_image_file_
push edi
call fcn.100054df
jmp 0x10009dac
cmp dword [ebx], 0xbcedbedb
jne 0x10009d04
push dword [ebp + 8]
push edi
call fcn.10009c39
test eax, eax
je 0x10009d04
mov eax, dword [edi + 8]
mov ecx, dword [ebx + 8]
cmp eax, ecx
jne 0x10009d38
xor eax, eax
inc eax
jmp 0x10009dae
mov esi, eax
sub esi, ecx
je 0x10009d75
cmp dword [ebx + 0x20], 0
je 0x10009d50
mov ecx, dword [ebx + 0x1c]
push eax
add ecx, eax
push edi
call fcn.1000a1eb
mov ecx, dword [ebx + 0x40]
test ecx, ecx
je 0x10009d66
mov edx, dword [edi + 8]
mov eax, dword [ebx + 0x3c]
push esi
push edx
add eax, edx
call fcn.1000a1ab
cmp dword [ebx + 0x60], 0
je 0x10009d75
mov eax, dword [ebx + 0x5c]
add eax, dword [edi + 8]
mov dword [edi + 0x34], eax
push edi
push dword [0x10060730]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
inc esi
push esi
push edi
call fcn.10009e37
test eax, eax
je 0x10009da7
mov ecx, edi
mov dword [edi + 0xc], esi
call fcn.10009db7
test eax, eax
jne 0x10009da3
call fcn.10009e9a
mov eax, esi
jmp 0x10009dae
call fcn.10009e9a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10009e9a
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [edi + 0x30]
sub esp, 0x10
push ebx
push esi
xor esi, esi
cmp ecx, esi
je 0x10009ec3
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [edi + 0x30]
cmp eax, esi
je 0x10009ec3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi + 0x30], esi
cmp dword [edi + 0xc], esi
je 0x10009ed2
push esi
push edi
call fcn.10009e37
mov dword [edi + 0xc], esi
mov eax, dword [edi + 8]
cmp eax, esi
je 0x10009ee9
push 0x8000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [edi + 8], esi
lea esi, [edi + 0x10]
mov eax, dword [esi + 0x14]
mov ebx, dword [eax]
mov eax, dword [esi]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
mov eax, dword [esi + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
je 0x10009f0d
cmp dword [esp + 8], eax
je 0x10009f12
call fcn.10033399
cmp ebx, dword [esp + 0x14]
je 0x10009f5f
mov eax, dword [esp + 8]
test eax, eax
jne 0x10009f57
call fcn.10033399
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x10009f31
call fcn.10033399
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
jne 0x10009f5b
call fcn.10033399
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x10009f53
call fcn.10033399
mov ebx, dword [ebx]
jmp 0x10009ef7
mov eax, dword [eax]
jmp 0x10009f27
mov eax, dword [eax]
jmp 0x10009f49
call fcn.1000aaa5
lea esi, [edi + 4]
call fcn.10005570
push 0
push dword [0x10060730]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b1d9
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10054814]
push ebx
mov dword [ebp - 0xc], eax
mov eax, dword [0x10054818]
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], eax
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x3c], eax
xor esi, esi
xor eax, eax
inc eax
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0x3c]
test ecx, eax
je 0x1000b282
lea eax, [esi + 0x41]
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1000b282
inc dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x38], ebx
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1000b282
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
adc dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x34]
adc dword [ebp - 0x24], eax
inc esi
cmp esi, 0x1a
jl 0x1000b21c
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
je 0x1000b29f
cmp dword [ebp - 0x14], 0x14
ja 0x1000b29d
jb 0x1000b29f
cmp dword [ebp - 0x18], ebx
jb 0x1000b29f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10032bd7
leave
ret
Function at 0x1000b2ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
push edi
lea eax, [ebp - 0x7c]
push eax
push 0x20019
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerFolders
push 0x80000002
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b38f
push 0x206
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.10035820
add esp, 0xc
xor edi, edi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push edi
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x1000b386
cmp eax, 0xea
je 0x1000b380
cmp eax, esi
jne 0x1000b380
lea eax, [ebp - 0x78]
push eax
call fcn.100344ba
lea eax, [ebp - 0x78]
mov dword [esp], str._virtual
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b3a8
lea eax, [ebp - 0x78]
push str._virtualbox
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b3a8
lea eax, [ebp - 0x78]
push str._vmware
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b3a8
inc edi
cmp edi, 0x64
jl 0x1000b30a
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x190]
pop edi
xor ecx, ebp
pop esi
call fcn.10032bd7
add ebp, 0x194
leave
ret
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000b391

Function at 0x1000b3b6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push esi
lea eax, [ebp - 0x80]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlDeviceClasses53f56307_b6bf_11d0_94f2_00a0c91efb8b
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b48c
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10035820
add esp, 0xc
xor esi, esi
push 0x104
lea eax, [ebp - 0x7c]
push eax
push esi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1000b483
cmp eax, 0xea
je 0x1000b47d
test eax, eax
jne 0x1000b47d
lea eax, [ebp - 0x7c]
push eax
call fcn.100344ba
lea eax, [ebp - 0x7c]
mov dword [esp], str.virtual
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b4a4
lea eax, [ebp - 0x7c]
push str.vbox
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b4a4
lea eax, [ebp - 0x7c]
push str.vmware
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b4a4
inc esi
cmp esi, 0x64
jl 0x1000b411
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.10032bd7
add ebp, 0x190
leave
ret
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000b48e
Function at 0x1000b4b2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push esi
lea eax, [ebp - 0x80]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetEnumIDE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b588
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10035820
add esp, 0xc
xor esi, esi
push 0x104
lea eax, [ebp - 0x7c]
push eax
push esi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1000b57f
cmp eax, 0xea
je 0x1000b579
test eax, eax
jne 0x1000b579
lea eax, [ebp - 0x7c]
push eax
call fcn.100344ba
lea eax, [ebp - 0x7c]
mov dword [esp], str.virtual
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b5a0
lea eax, [ebp - 0x7c]
push str.vbox
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b5a0
lea eax, [ebp - 0x7c]
push str.vmware
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b5a0
inc esi
cmp esi, 0x64
jl 0x1000b50d
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.10032bd7
add ebp, 0x190
leave
ret
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000b58a

Function at 0x1000b5ae
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push esi
lea eax, [ebp - 0x80]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetEnumSCSI
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b684
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10035820
add esp, 0xc
xor esi, esi
push 0x104
lea eax, [ebp - 0x7c]
push eax
push esi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1000b67b
cmp eax, 0xea
je 0x1000b675
test eax, eax
jne 0x1000b675
lea eax, [ebp - 0x7c]
push eax
call fcn.100344ba
lea eax, [ebp - 0x7c]
mov dword [esp], str.virtual
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b69c
lea eax, [ebp - 0x7c]
push str.vbox
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b69c
lea eax, [ebp - 0x7c]
push str.vmware
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b69c
inc esi
cmp esi, 0x64
jl 0x1000b609
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.10032bd7
add ebp, 0x190
leave
ret
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000b686
Function at 0x1000b6aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
lea eax, [ebp - 0x7c]
push eax
push 0x20019
xor esi, esi
push esi
push str.SYSTEMCurrentControlSet_servicesDiskEnum
push 0x80000002
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000b784
push 0x206
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.10035820
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push esi
push 0x100533bc
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000b77b
lea eax, [ebp - 0x78]
push eax
call fcn.100344ba
lea eax, [ebp - 0x78]
mov dword [esp], str.virtual
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
je 0x1000b753
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000b786
lea eax, [ebp - 0x78]
push str.vbox
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b745
lea eax, [ebp - 0x78]
push str.vmware
push eax
call fcn.100339fa
pop ecx
pop ecx
test eax, eax
jne 0x1000b745
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x190]
xor ecx, ebp
pop esi
call fcn.10032bd7
add ebp, 0x194
leave
ret

Function at 0x1000ba0c
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
push edi
mov word [ebp - 0x50], ax
lea edi, [ebp - 0x4e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
push 0x3a
push eax
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push eax
call fcn.10035820
add esp, 0xc
push 0x1000bad1
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov edi, 0x104
push edi
mov esi, 0x10060270
push esi
mov dword [0x1006026c], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Minidump
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x44]
push eax
movzx eax, word [ebp - 0x46]
push eax
movzx eax, word [ebp - 0x48]
push eax
movzx eax, word [ebp - 0x4a]
push eax
movzx eax, word [ebp - 0x4e]
push eax
movzx eax, word [ebp - 0x50]
push eax
push str.MINI__04d__02d__02d__02d__02d__02d.dmp
lea eax, [ebp - 0x40]
push 0x1e
push eax
call fcn.1000bb4e
add esp, 0x24
lea eax, [ebp - 0x40]
push eax
push edi
push esi
call fcn.1000311f
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x10060734
pop esi
call fcn.10032bd7
leave
ret
Function at 0x1000c2fb
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, str.www.wxrobot.cc
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x1000c324
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1000c31d
or eax, 0xffffffff
jmp 0x1000c324
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [esp + 8]
cmp eax, 0xffffffff
mov dword [ecx + 0xa0], eax
setne al
pop esi
ret 4
Function at 0x1000f913
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
and ecx, 0xfffffff0
push esi
push 0
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0x13], 0x5a
mov byte [ebp - 0x12], 0x8f
mov byte [ebp - 0x11], 0x1a
mov byte [ebp - 0x10], 0x2a
mov byte [ebp - 0xf], 0x3c
mov byte [ebp - 0xe], 0x4e
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0xa8
mov byte [ebp - 0xb], 0x1b
mov byte [ebp - 0xa], 0xa
mov byte [ebp - 9], 0xbd
mov byte [ebp - 8], 0x2a
mov byte [ebp - 7], 0x4c
mov byte [ebp - 6], 0x56
mov byte [ebp - 5], 0x15
pop eax
jbe 0x1000f993
push edi
mov edx, dword [ebp - 0x18]
xor esi, esi
lea edi, [edx + eax]
mov dl, byte [ebp + esi - 0x14]
xor byte [edi + esi], dl
inc esi
cmp esi, 0x10
jb 0x1000f97e
add eax, 0x10
cmp eax, ecx
jb 0x1000f976
pop edi
cmp eax, dword [ebp + 0xc]
jae 0x1000f9ac
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
lea esi, [edx + eax]
mov dl, byte [ecx]
xor byte [esi], dl
inc ecx
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x1000f99b
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10032bd7
leave
ret

Function at 0x10012a1d
Capabilities:
Hash data with md5

Disassembly:
push 0x40
lea eax, [esi + 0x14]
push 0
push eax
call fcn.10035820
and dword [esi + 0x58], 0
and dword [esi + 0x54], 0
add esp, 0xc
mov dword [esi + 0x5c], 0x67452301
mov dword [esi + 0x60], 0xefcdab89
mov dword [esi + 0x64], 0x98badcfe
mov dword [esi + 0x68], 0x10325476
ret
Function at 0x10012db6
Capabilities:
Create directory

Disassembly:
push 0x48
mov eax, 0x1004dc17
call fcn.10035d35
mov esi, ecx
mov eax, dword [esi + 0x14]
xor edi, edi
mov dword [ebp - 0x54], esi
cmp eax, edi
je 0x10012e6e
cmp eax, 3
jb 0x10012e6e
mov eax, esi
call fcn.1001320e
cmp word [eax], 0x3a
jne 0x10012e6e
push esi
lea ecx, [ebp - 0x48]
call fcn.100055d8
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x34]
dec eax
push eax
lea ecx, [ebp - 0x48]
call fcn.100131e6
movzx eax, word [eax]
push 0x5c
pop ebx
cmp ax, bx
je 0x10012e20
cmp ax, 0x2f
je 0x10012e20
lea esi, [ebp - 0x48]
call fcn.1001319f
push 1
push edi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x4c], ebx
call fcn.1000b8b5
push 1
mov esi, eax
push edi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x4c], 0x2f
call fcn.1000b8b5
or ecx, 0xffffffff
cmp esi, ecx
jne 0x10012e53
mov esi, ecx
cmp eax, ecx
jne 0x10012e59
mov eax, ecx
cmp esi, eax
jb 0x10012e5f
mov esi, eax
cmp esi, ecx
jne 0x10012e76
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.10002a1b
xor eax, eax
call fcn.10035db8
ret
mov dword [ebp - 0x4c], 1
mov ecx, dword [ebp - 0x54]
push esi
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.100026fc
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10012e97
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x10012ec7
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10012eae
lea eax, [ebp - 0x28]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10012ec7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10012f20
push 1
inc esi
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x50], ebx
call fcn.1000b8b5
push 1
mov edi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x50], 0x2f
call fcn.1000b8b5
or ecx, 0xffffffff
cmp edi, ecx
jne 0x10012efb
mov edi, ecx
cmp eax, ecx
jne 0x10012f01
mov eax, ecx
mov esi, edi
cmp edi, eax
jb 0x10012f09
mov esi, eax
push 0
cmp esi, ecx
push 1
lea ecx, [ebp - 0x2c]
je 0x10012f30
call fcn.10002a1b
xor edi, edi
jmp 0x10012e7d
push edi
push 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x4c], edi
call fcn.10002a1b
jmp 0x10012f37
call fcn.10002a1b
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.10002a1b
mov eax, dword [ebp - 0x4c]
jmp 0x10012e70
Function at 0x10012f4a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor bl, bl
cmp dword [esi + 0x18], 8
push edi
lea edi, [esi + 4]
jb 0x10012f61
mov eax, dword [edi]
jmp 0x10012f63
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10012ffa
mov eax, dword [esi + 0x14]
xor ecx, ecx
push 2
add eax, 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003237c
cmp dword [esi + 0x18], 8
mov ebx, eax
pop ecx
mov dword [ebp - 4], ebx
jb 0x10012f9a
mov edi, dword [edi]
mov eax, dword [esi + 0x14]
push edi
add eax, 3
push eax
push ebx
call fcn.10034bf9
mov ecx, dword [esi + 0x14]
xor eax, eax
lea edi, [ebx + ecx*2]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0x24]
mov ecx, 0x414
push eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x14], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push dword [ebp - 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
call fcn.100333a9
pop ecx
pop edi
mov al, bl
pop ebx
leave
ret

Function at 0x10013108
Capabilities:
Check mutex on windows

Disassembly:
push 0x20
mov eax, 0x1004dbea
call fcn.10035d35
mov esi, ecx
push 0x10054dc8
lea ecx, [ebp - 0x2c]
call fcn.10002683
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 8
jb 0x10013132
mov esi, dword [esi + 4]
jmp 0x10013135
add esi, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100026af
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10013151
lea eax, [ebp - 0x28]
push eax
xor esi, esi
inc esi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x10013185
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10013185
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10002a1b
mov eax, esi
call fcn.10035db8
ret
xor esi, esi
jmp 0x10013171