joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029fa6
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 6
pop ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
push esi
rep stosd dword es:[edi], eax
call fcn.10029d17
pop ecx
test al, al
jne 0x10029fd0
inc al
jmp 0x1002a03c
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1002a037
cmp dword [esi + 0x18], 8
jb 0x10029fef
mov eax, dword [esi + 4]
jmp 0x10029ff2
lea eax, [esi + 4]
push 0x24
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x1002a032
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 4
jne 0x1002a02c
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, eax
jmp 0x1002a02f
xor ebx, ebx
inc ebx
push esi
call edi
push dword [ebp - 4]
call edi
test ebx, ebx
setne al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002a041
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
xor ebx, ebx
call fcn.10029d17
pop ecx
test al, al
je 0x1002a0df
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1002a0dd
cmp dword [esi + 0x18], 8
jb 0x1002a07a
mov esi, dword [esi + 4]
jmp 0x1002a07d
add esi, 4
push edi
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x1002a0d7
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x18], 8
jb 0x1002a0a5
mov ecx, dword [eax + 4]
jmp 0x1002a0a8
lea ecx, [eax + 4]
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x18], 8
jb 0x1002a0b6
mov eax, dword [eax + 4]
jmp 0x1002a0b9
add eax, 4
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
push 1
push dword [ebp + 0x14]
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x1002a0d4
mov bl, 1
push esi
call edi
push dword [ebp - 4]
call edi
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x1002a8e7
Capabilities:
Get file size

Disassembly:
push 0x1c
push 0x10056420
call fcn.10036518
xor esi, esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], 0x20
push esi
mov edi, 0x80
push edi
push 3
push esi
push 7
push 0xa0000000
push dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
call ebx
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x1002a95d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x1002a953
push esi
push edi
push 3
push esi
push 7
push 0x80000000
push dword [ebp + 8]
call ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x1c], 0xffffffff
je 0x1002aa49
cmp dword [ebp - 0x20], 1
jne 0x1002a968
push 2
pop eax
jmp 0x1002a96b
mov eax, dword [ebp - 0x24]
push esi
push esi
push esi
or eax, 0x1000000
push eax
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x1002a993
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002aa49
push esi
push esi
push esi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov dword [ebp - 0x28], ebx
cmp ebx, esi
jne 0x1002a9bd
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
jmp 0x1002aa49
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [ebp - 0x2c]
push ecx
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], esi
lea eax, [ebp - 0x24]
push eax
push ebx
call fcn.1002a773
pop ecx
pop ecx
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x34]
cmp ebx, ecx
je 0x1002aa0f
cmp eax, esi
je 0x1002aa0f
push dword [ebp - 0x24]
push eax
push ecx
push ebx
push ebx
call fcn.1002a878
add esp, 0x14
cmp eax, esi
jge 0x1002aa0f
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
jmp 0x1002aa3a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, ebx
jmp 0x1002aa4b
call fcn.1002a8c8
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.1003655d
ret
Function at 0x1002b1c6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.10035820
push dword [ebp + 0x18]
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 8], esi
call fcn.1002b887
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], edx
cdq
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], edx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x18]
cdq
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x38], edx
cdq
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], edx
cdq
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], edx
cdq
add esp, 0x14
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x44
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x48], esi
mov esi, dword [ebp + 0x20]
push eax
push 6
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], edx
call fcn.1001fdbb
mov ecx, eax
call fcn.10022f58
test al, al
jne 0x1002b296
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtReadFile]
jmp 0x1002b2a7
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x18]
call fcn.1002b8a8
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x1002b2ab
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.10035820
push dword [ebp + 0x18]
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 8], esi
call fcn.1002b887
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], edx
cdq
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], edx
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
lea eax, [ebp - 0x18]
cdq
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x38], edx
cdq
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], edx
cdq
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], edx
cdq
add esp, 0x14
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x44
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x48], esi
mov esi, dword [ebp + 0x20]
push eax
push 7
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], edx
call fcn.1001fdbb
mov ecx, eax
call fcn.10022f58
test al, al
jne 0x1002b37b
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtWriteFile]
jmp 0x1002b38c
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x18]
call fcn.1002b8a8
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x1002b390
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 8], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
push eax
lea eax, [ebp - 0x14]
push eax
add esi, 8
call fcn.1002b813
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 4
call fcn.1001fdbb
mov ecx, eax
call fcn.10022f58
test al, al
je 0x1002b3ea
mov eax, dword [ebp - 4]
cmp eax, 0xc0000368
jne 0x1002b3ff
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and eax, 0x3fffffff
add eax, 0xc0000001
pop edi
pop esi
leave
ret
Function at 0x1002b403
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
xor eax, eax
and dword [ebp - 0x18], eax
and dword [ebp - 8], eax
push 8
pop ecx
push dword [ebp + 0xc]
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
call fcn.1002b887
mov eax, dword [ebp + 8]
cdq
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
lea eax, [ebp - 0x18]
cdq
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
mov dword [ebp - 0x2c], edx
cdq
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x20
lea eax, [ebp - 0x38]
push eax
push 8
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
call fcn.1001fdbb
mov ecx, eax
call fcn.10022f58
test al, al
jne 0x1002b495
push edi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
jmp 0x1002b4a6
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.1002b8a8
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop edi
pop esi
leave
ret

Function at 0x1002b4aa
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
xor eax, eax
and dword [ebp - 0x18], eax
and dword [ebp - 8], eax
push 8
pop ecx
push dword [ebp + 0xc]
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
call fcn.1002b887
mov eax, dword [ebp + 8]
cdq
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
lea eax, [ebp - 0x18]
cdq
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
mov dword [ebp - 0x2c], edx
cdq
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x20
lea eax, [ebp - 0x38]
push eax
push 9
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
call fcn.1001fdbb
mov ecx, eax
call fcn.10022f58
test al, al
jne 0x1002b53c
push edi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
jmp 0x1002b54d
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.1002b8a8
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop edi
pop esi
leave
ret
Function at 0x1002b551
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
push 0x42
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.10035820
push dword [ebp + 0x18]
xor eax, eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 8], ebx
call fcn.1002b887
add esp, 0x14
cmp dword [ebp + 0x2c], ebx
je 0x1002b5ac
push dword [ebp + 0x2c]
lea eax, [ebp - 0x14]
push eax
call fcn.1002b813
pop ecx
pop ecx
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x64], edx
cdq
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], edx
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0x24]
cdq
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], edx
cdq
mov dword [ebp - 0x40], eax
mov al, byte [ebp + 0x28]
mov byte [ebp - 0x30], al
mov dword [ebp - 0x54], ebx
mov ebx, dword [ebp + 0x24]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], ebx
cmp dword [ebp + 0x2c], eax
jne 0x1002b605
mov dword [ebp - 0x2b], eax
jmp 0x1002b60c
lea eax, [ebp - 0x14]
cdq
mov dword [ebp - 0x2b], edx
mov dword [ebp - 0x2f], eax
mov al, byte [ebp + 0x30]
mov byte [ebp - 0x27], al
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x42
lea eax, [ebp - 0x68]
push eax
push 0xa
call fcn.1001fdbb
mov ecx, eax
call fcn.10022f58
test al, al
jne 0x1002b65a
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push ebx
push edi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
jmp 0x1002b66b
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x18]
call fcn.1002b8a8
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002b7a0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
and dword [ebp - 8], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
push eax
lea eax, [ebp - 0x14]
push eax
add esi, 8
call fcn.1002b813
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 5
call fcn.1001fdbb
mov ecx, eax
call fcn.10022f58
test al, al
je 0x1002b7fa
mov eax, dword [ebp - 4]
cmp eax, 0xc0000368
jne 0x1002b80f
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
and eax, 0x3fffffff
add eax, 0xc0000001
pop edi
pop esi
leave
ret
Function at 0x1002bd89
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, pe_nt_image_headers32
push edi
mov ebx, eax
or esi, eax
shl dword [ebp + 0x10], 1
mov eax, esi
shr eax, 7
and eax, 1
push eax
mov eax, ebx
and eax, dword [ebp + 0x10]
mov ecx, esi
add eax, ebx
shr ecx, 8
add ecx, eax
mov eax, dword [ebp + 0xc]
lea edi, [eax + ecx*2]
mov eax, dword [ebp + 8]
call fcn.1002bd00
add esi, esi
mov eax, esi
xor eax, dword [ebp + 0x10]
not eax
and ebx, eax
cmp esi, 0x10000
jb 0x1002bd9a
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x1002be1d
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
or ecx, 0x100
push esi
mov esi, dword [esp + 8]
mov edx, ecx
shr edx, 8
movzx edx, word [esi + edx*2]
mov esi, ecx
shr esi, 7
and esi, 1
neg esi
sar esi, 4
and esi, 0x7f
shr edx, 4
xor edx, esi
mov esi, dword [esp + 0xc]
add eax, dword [esi + edx*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x1002be26
pop esi
ret 8

Function at 0x1002be5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, pe_nt_image_headers32
push esi
xor eax, eax
or edx, ecx
push edi
shl dword [ebp + 0xc], 1
mov esi, ecx
and esi, dword [ebp + 0xc]
mov edi, edx
add esi, ecx
shr edi, 8
add edi, esi
mov esi, dword [ebp + 8]
movzx esi, word [esi + edi*2]
mov edi, edx
shr edi, 7
and edi, 1
neg edi
shr esi, 4
sar edi, 4
and edi, 0x7f
xor esi, edi
mov edi, dword [ebp + 0x10]
add eax, dword [edi + esi*4]
add edx, edx
mov esi, edx
xor esi, dword [ebp + 0xc]
not esi
and ecx, esi
cmp edx, 0x10000
jb 0x1002be6b
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1002bf69
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
push esi
mov esi, eax
xor eax, eax
inc edx
test esi, esi
je 0x1002bfa9
push ebx
push edi
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
movzx edi, word [edi + edx*2]
shr dword [esp + 0x14], 1
and ecx, 1
mov ebx, ecx
neg ebx
sar ebx, 4
and ebx, 0x7f
shr edi, 4
xor edi, ebx
mov ebx, dword [esp + 0x18]
add eax, dword [ebx + edi*4]
add edx, edx
or edx, ecx
dec esi
jne 0x1002bf77
pop edi
pop ebx
pop esi
ret 0xc

Function at 0x10030d70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
xor edx, edx
mov dword [eax + 0x30], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x20], edx
call fcn.10030d56
push esi
lea ecx, [eax + 0x70]
push edi
push 8
mov eax, edx
pop esi
mov edi, eax
and edi, 1
dec edi
not edi
and edi, 0xedb88320
shr eax, 1
xor eax, edi
dec esi
jne 0x10030d8c
mov dword [ecx], eax
inc edx
add ecx, 4
cmp edx, 0x100
jb 0x10030d87
pop edi
pop esi
ret

Function at 0x10031b5c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push dword [ebp + 8]
mov esi, ecx
push edx
push eax
push eax
call fcn.10035545
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.10031b25
pop esi
pop ebp
ret 4

Function at 0x10032bd7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005ce10]
jne 0x10032be1
repz ret
jmp fcn.1003902c
Function at 0x1004386c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10039a2d
and dword [ebp - 4], 0
cmp dword [0x1006017c], 0
mov ebx, eax
jne 0x1004391d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100439ce
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100439ce
push eax
call fcn.100399bb
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1006017c], eax
call esi
push eax
call fcn.100399bb
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10060180], eax
call esi
push eax
call fcn.100399bb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10060184], eax
call esi
push eax
call fcn.100399bb
pop ecx
mov dword [0x1006018c], eax
test eax, eax
je 0x1004391d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100399bb
pop ecx
mov dword [0x10060188], eax
mov eax, dword [0x10060188]
cmp eax, ebx
je 0x10043975
cmp dword [0x1006018c], ebx
je 0x10043975
push eax
call fcn.10039a36
push dword [0x1006018c]
mov esi, eax
call fcn.10039a36
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10043975
test edi, edi
je 0x10043975
call esi
test eax, eax
je 0x1004396c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1004396c
test byte [ebp - 0xc], 1
jne 0x10043975
or dword [ebp + 0x10], 0x200000
jmp 0x100439ae
mov eax, dword [0x10060180]
cmp eax, ebx
je 0x100439ae
push eax
call fcn.10039a36
pop ecx
test eax, eax
je 0x100439ae
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100439ae
mov eax, dword [0x10060184]
cmp eax, ebx
je 0x100439ae
push eax
call fcn.10039a36
pop ecx
test eax, eax
je 0x100439ae
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1006017c]
call fcn.10039a36
pop ecx
test eax, eax
je 0x100439ce
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100439d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10045c0e
Capabilities:
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x3c0]
sub esp, 0x440
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp + 0x3bc], eax
mov eax, dword [ebp + 0x3cc]
or dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x3d0]
push esi
mov esi, dword [ebp + 0x3c8]
mov dword [ebp - 0x7c], eax
xor eax, eax
cmp esi, eax
jne 0x10045c54
or eax, 0xffffffff
jmp 0x10045dd1
push ebx
push edi
mov dword [ebp - 0x58], eax
cmp dword [esi + 0x4044], eax
jbe 0x10045dcd
mov dword [ebp - 0x64], eax
mov ebx, 0x208
jmp 0x10045c71
xor eax, eax
mov edi, dword [esi + 0x4038]
mov edx, dword [ebp - 0x58]
add edi, dword [ebp - 0x64]
push eax
lea ecx, [esi + 0x4028]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x78], eax
call fcn.10047bf5
cmp eax, ebx
jae 0x10045dfd
push ebx
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.10035820
mov edx, dword [ebp - 0x58]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
lea ecx, [esi + 0x4028]
call fcn.10047bf5
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x1b4]
push eax
call fcn.10041725
add esp, 0xc
cmp dword [ebp - 0x70], 0
je 0x10045cff
push dword [ebp - 0x7c]
lea eax, [ebp + 0x1b4]
push eax
movzx eax, byte [edi + 0x19]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [ebp - 0x70]
cmp eax, 0xffffffff
je 0x10045de9
test eax, eax
je 0x10045db7
lea ecx, [esi + 0x4080]
push ecx
lea eax, [esi + 0x4078]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x58]
lea edx, [esi + 0xc]
lea ecx, [esi + 0x4028]
call fcn.1004853b
test eax, eax
jne 0x10045dfd
cmp byte [edi + 0x19], al
je 0x10045d4d
lea eax, [ebp + 0x1b4]
push eax
call fcn.10045ae8
jmp 0x10045db7
lea edx, [ebp + 0x1b4]
lea ecx, [ebp - 0x6c]
call fcn.10045b05
test eax, eax
jne 0x10045dee
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x74]
lea edx, [ecx + eax]
lea ecx, [ebp - 0x6c]
call fcn.100468c0
test eax, eax
jne 0x10045dee
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x60]
jne 0x10045dee
lea ecx, [ebp - 0x6c]
call fcn.1004683d
cmp byte [edi + 0x1d], 0
je 0x10045da8
push dword [edi + 0x14]
lea eax, [ebp + 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp - 0x5c]
lea ecx, [esi + 0x4078]
call dword [esi + 0x407c]
inc dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
add dword [ebp - 0x64], 0x20
cmp eax, dword [esi + 0x4044]
jb 0x10045c6f
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x3bc]
xor ecx, ebp
pop esi
call fcn.10032bd7
add ebp, 0x3c0
leave
ret 0xc
or eax, 0xffffffff
jmp 0x10045dcf
mov edx, dword [ebp - 0x5c]
lea ecx, [esi + 0x4078]
call dword [esi + 0x407c]
push 0xb
pop eax
jmp 0x10045dcf