joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x49121a40
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3e5e36ec
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4116b0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], 0x6b343584
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
sub eax, 0xc7a6c9de
je 0x4117ee
jmp 0x4116d6
mov eax, dword [ebp - 0x14]
sub eax, 0xd46f580f
je 0x4117b9
jmp 0x4116e9
mov eax, dword [ebp - 0x14]
sub eax, 0x214819a5
je 0x4117fa
jmp 0x4116fc
mov eax, dword [ebp - 0x14]
sub eax, 0x3a94bc54
je 0x411806
jmp 0x41170f
mov eax, dword [ebp - 0x14]
sub eax, 0x591bad6c
je 0x411772
jmp 0x411722
mov eax, dword [ebp - 0x14]
sub eax, 0x6b343584
je 0x411760
jmp 0x411735
mov eax, dword [ebp - 0x14]
sub eax, 0x75a3b534
je 0x4117d3
jmp 0x411748
mov eax, dword [ebp - 0x14]
sub eax, 0x7ce5975c
je 0x41179b
jmp 0x41175b
jmp 0x41180b
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x591bad6c
jmp 0x41180b
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov edx, eax
mov eax, 0x3a94bc54
mov ecx, 0x7ce5975c
cmp edx, 0xffffffff
cmovne eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x41180b
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0xd46f580f
jmp 0x41180b
mov eax, dword [ebp - 8]
cmp eax, 0
setne al
and al, 1
mov byte [ebp - 1], al
mov dword [ebp - 0x10], 0x75a3b534
jmp 0x41180b
mov dl, byte [ebp - 1]
mov eax, 0xc7a6c9de
mov ecx, 0x214819a5
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x41180b
mov dword [ebp - 0x10], 0x3a94bc54
jmp 0x41180b
mov dword [ebp - 0x10], 0x3a94bc54
jmp 0x41180b
add esp, 0x18
pop ebp
ret
jmp 0x4116c0
Function at 0x42a8fb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42a93a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42a93a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42a93a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42a93a
cmp dword [ecx + 0x74], 0xe
jbe 0x42a93a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x432ce0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x432d7d
push ebx
push esi
call fcn.00432ca9
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00432c3d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x432d2a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x432d7c
push edi
push eax
call fcn.00431935
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x432d4a
call fcn.00430412
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x432d7b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00432c3d
add esp, 0x20
test eax, eax
jne 0x432d69
push edi
call fcn.00430412
jmp 0x432d71
push ebx
call fcn.00430412
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x433f8c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43d090
push 0x43d088
push str.FlsAlloc
push 0x1f
call fcn.00433e4b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x433fc0
push dword [ebp + 8]
mov ecx, esi
call dword [0x43a14c]
call esi
jmp 0x433fc6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x43400a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43d0a0
push 0x43d098
push str.FlsGetValue
push 0x21
call fcn.00433e4b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x434041
push dword [ebp + 8]
mov ecx, esi
call dword [0x43a14c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x434049
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43d0a8
push 0x43d0a0
push str.FlsSetValue
push 0x22
call fcn.00433e4b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x434083
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43a14c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x439980
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4399ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4399ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
sub esp, 0x10
xor ecx, ecx
test edx, edx
je 0x405515
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
cmp edx, 0x20
jb 0x4054f3
lea eax, [ebx - 1]
add eax, edx
cmp esi, eax
ja 0x40547a
lea eax, [esi - 1]
add eax, edx
cmp eax, ebx
jae 0x4054f3
lea eax, [edi - 1]
add eax, edx
cmp esi, eax
ja 0x40548c
lea eax, [esi - 1]
add eax, edx
cmp eax, edi
jae 0x4054f3
mov eax, edx
mov edx, edi
sub edx, ebx
and eax, 0xffffffe0
mov dword [ebp - 4], edx
mov edx, esi
sub edx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edx
mov eax, ebx
mov ebx, dword [ebp - 8]
mov edx, edi
mov edi, dword [ebp - 4]
sub edx, esi
mov dword [ebp - 0xc], edx
lea edx, [esi + 0x10]
movups xmm0, xmmword [eax]
mov esi, dword [ebp - 0xc]
add ecx, 0x20
lea eax, [eax + 0x20]
lea edx, [edx + 0x20]
movups xmm1, xmmword [edi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [ebx + eax - 0x20], xmm1
movups xmm1, xmmword [esi + edx - 0x20]
mov esi, dword [ebp + 0x10]
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [edx - 0x20], xmm1
cmp ecx, dword [ebp - 0x10]
jb 0x4054b4
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp ecx, edx
jae 0x405512
sub edi, ebx
lea eax, [ecx + ebx]
sub esi, ebx
sub edx, ecx
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
sub edx, 1
jne 0x405500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5609e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd5f71a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0xda90c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.00ce5a77
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x560aa0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.00d3944d
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0xda5844
push eax
call fcn.00d37914
push edi
push esi
call fcn.00ce60ee
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00ce7031
mov esp, ebp
pop ebp
ret 4
Function at 0x565b40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0xda90c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call edi
test al, 0x80
mov eax, 1
push 0x12
cmovne esi, eax
call edi
test al, al
jns 0x565b8c
or esi, 2
push 0x10
call edi
test al, al
jns 0x565b97
or esi, 4
push 0x5b
call edi
test al, al
jns 0x565ba2
or esi, 8
push 0x5c
call edi
test al, al
jns 0x565bad
or esi, 8
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
test ebx, 0x1000000
je 0x565bd5
cmp ecx, 0xd
jne 0x565bf5
mov dword [ebp - 0x14], 0x23
jmp 0x565c77
xor eax, eax
mov edx, 0x24
nop dword [eax]
cmp edx, ecx
je 0x565c6d
mov edx, dword [eax*8 + 0xd690f0]
inc eax
cmp edx, 0x2c
jne 0x565be0
xor eax, eax
mov edx, 0x1b
nop dword [eax]
cmp edx, ecx
je 0x565c64
mov edx, dword [eax*8 + 0xd69150]
inc eax
cmp edx, 0x2c
jne 0x565c00
xor eax, eax
mov edx, 0x11
cmp edx, ecx
je 0x565c51
mov edx, dword [eax*8 + 0xd69230]
inc eax
cmp edx, 0x2c
jne 0x565c18
lea eax, [ebp - 0x18]
sar ebx, 0x10
push eax
movzx eax, bl
push eax
call fcn.005576a0
add esp, 8
test eax, eax
jne 0x565c77
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ce7031
mov esp, ebp
pop ebp
ret
mov eax, dword [eax*8 + 0xd6922c]
mov dword [ebp - 0x10], eax
not eax
and eax, esi
mov dword [ebp - 0xc], eax
jmp 0x565c77
mov eax, dword [eax*8 + 0xd6914c]
jmp 0x565c74
mov eax, dword [eax*8 + 0xd690ec]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
push edx
push ecx
mov eax, dword [ecx + 0x64]
push eax
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00ce7031
mov esp, ebp
pop ebp
ret
Function at 0x568f90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.005575b0
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push 0
push dword [ebp + 0x18]
mov ecx, dword [eax]
push 0
push 0
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.00d3ee9d
mov esi, eax
or eax, 0xffffffff
test esi, esi
push str.char__
cmovs esi, eax
inc esi
push esi
call fcn.005649f0
push dword [ebp + 0x1c]
mov edi, eax
mov eax, dword [ebp - 4]
push 0
push dword [ebp + 0x18]
push esi
push edi
push dword [eax + 4]
push dword [eax]
call fcn.00d3eec1
add esp, 0x40
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._libui___hs:_hs:_hs____hs_hs_n
call fcn.0056f550
push edi
mov esi, eax
call fcn.00564aa0
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call fcn.00564aa0
add esp, 4
call dword [sym.imp.KERNEL32.dll_DebugBreak]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x56b7b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0
push 0
push 0xe
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
push str.WCHAR__
lea ecx, [esi*2 + 2]
push ecx
call fcn.005649f0
add esp, 8
lea ecx, [esi + 1]
mov ebx, eax
push ecx
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, esi
je 0x56b7f4
xor eax, eax
mov word [ebx], ax
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x56b800
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0xda90c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0
push 0xe
push ebx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
push str.WCHAR__
mov dword [ebp - 0x10], esi
lea ecx, [esi*2 + 2]
push ecx
call fcn.005649f0
add esp, 8
lea ecx, [esi + 1]
mov edi, eax
push ecx
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, esi
je 0x56b87e
xor eax, eax
mov word [edi], ax
push edi
call fcn.00564aa0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ce7031
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x56b862
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x56b862
push dword [0xdaa2d8]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x56b8ad
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x56b862
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push edi
push esi
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
jne 0x56b8c6
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push dword [ebp - 0x14]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push edi
call fcn.00564aa0
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0xc]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00ce7031
mov esp, ebp
pop ebp
ret
Function at 0x5b76f0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0xc708f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
push 0xc70910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0xc71080
Capabilities:
Access peb ldr_data
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd6057b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0xda90c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0xc710c4
mov eax, dword [ecx]
jmp 0xc710c6
mov eax, ecx
mov byte [eax], 0
push 0
push 0xd6749c
mov dword [ebp - 4], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
call fcn.00451dd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xcf0820
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
push edi
lea edi, [esi + eax]
cmp esi, edi
jae 0xcf0856
mov al, byte [esi]
push eax
call fcn.00cfed70
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0xcf0838
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0xcfb360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x6d7], 0
je 0xcfb3f8
cmp dword [esi + 0x1ac], 0
je 0xcfb3b5
push esi
call fcn.00cec070
push 1
push esi
mov byte [ebp + 8], al
call fcn.00cec2f0
push dword [esi + 0x15c]
mov eax, dword [esi + 0x1ac]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
push dword [ebp + 8]
push esi
call fcn.00cec2f0
add esp, 0x28
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, ecx
sub eax, 0
je 0xcfb3c9
sub eax, 1
je 0xcfb3c9
sub eax, 1
jne 0xcfb3f8
push dword [esi + 0x158]
lea eax, [ecx*2 + 0xd8d04c]
push 1
add eax, ecx
push 2
push eax
call fcn.00d4a5c2
push dword [esi + 0x158]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00d4a5c2
add esp, 0x20
pop esi
pop ebp
ret
Function at 0xcfcf30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.00cfcf70
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.00d590b9

Function at 0xcfd1b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push 0xd8d250
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0xcfd1d0
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0xd8d264
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0xd8d274
push esi
mov dword [ebp - 8], ebx
call fcn.00d4b6e3
add esp, 8
test eax, eax
je 0xcfd21c
test ebx, ebx
je 0xcfd20c
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0xcfd245
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0xcfd245
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0xcfd308
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xcfd261
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0xda90f4]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0xcfd2fe
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0xcfd2fe
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xcfd2a0
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xcfd2c0
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0xcfd2d5
mov eax, dword [ebp - 8]
test eax, eax
je 0xcfd2f5
push 8
push 0
push ebx
call eax
jmp 0xcfd2fc
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0xda90f8]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0xcffcd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0xcffcfb
cmp dword [esi + 0x84], 0
je 0xcffcfb
push 2
push 3
push esi
call fcn.00cff4c0
push dword [ebp + 0xc]
call fcn.00cff790
add esp, 0x10
jmp 0xcffd0a
push dword [ebp + 0xc]
call fcn.00cff790
add esp, 4
test esi, esi
je 0xcffd1e
cmp dword [esi + 0x84], 0
je 0xcffd1e
push 3
push esi
call fcn.00cff500
add esp, 8
pop esi
pop ebp
ret
Function at 0xd0da00
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00cf1180
push dword [ebp + 8]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x10], xmm0
call fcn.00d0bcb0
push dword [ebp + 0xc]
mov edi, eax
call fcn.00d0bcb0
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0xd0da87
lea eax, [ebp - 0x20]
push eax
call fcn.00cf1180
movups xmm0, xmmword [ebp - 0x10]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.00cf1230
add esp, 0x20
test edx, edx
ja 0xd0daaa
jb 0xd0da75
cmp eax, 0x3e8
ja 0xd0daaa
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
push edi
call ebx
test eax, eax
je 0xd0da40
test edi, edi
je 0xd0da94
push edi
call fcn.00d3c5ea
add esp, 4
test esi, esi
je 0xd0daa1
push esi
call fcn.00d3c5ea
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0xd0dab7
push edi
call fcn.00d3c5ea
add esp, 4
test esi, esi
je 0xd0dac4
push esi
call fcn.00d3c5ea
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xd0e380
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.00d4f49d
add esp, 0x18
test eax, eax
je 0xd0e3a2
cmp eax, 0xffffffff
jne 0xd0e3a4
xor eax, eax
pop ebp
ret

Function at 0xd0e500
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00d382e0
add esp, 0xc
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
pop ebp
ret
Function at 0xd102b0
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0x14]
push esi
push 0
push dword [ebp + 0x10]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
mov dword [ebp + 0x14], esi
call fcn.00d382e0
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000040
push dword [ebp + 0x18]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xd1037e
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0xd10360
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0xd10360
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0xd10360
cmp esi, dword [ebp - 0xc]
jb 0xd10360
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 4]
test eax, eax
je 0xd1036e
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0xd1037e
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xd117f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00d11760

Function at 0xd1d6e0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0x18]
cmp eax, 0x64
jb 0xd1d712
push str.Couldnt_set_desired_mode
push esi
call fcn.00cfb400
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0xd1d729
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.00cfb4c0
add esp, 0xc
mov al, byte [ebp + 0x10]
cmp al, 0x13
jne 0xd1d741
push ebx
push esi
call fcn.00d1d3b0
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x14
jne 0xd1d755
push esi
call fcn.00d1c410
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x15
jne 0xd1d769
push esi
call fcn.00d1d390
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp al, 0x16
jne 0xd1d778
push esi
call fcn.00d1d5c0
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret