joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405315
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004055ae
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405349
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7c77e8], eax
jmp 0x4054c8
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405367
test eax, eax
je 0x405479
test byte [ebp + 0xc], 2
je 0x405479
mov esi, 0x7ba578
push edi
push esi
call fcn.004059c1
test ebx, ebx
je 0x405384
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x40538a
push edi
call fcn.00405515
push 0x40900c
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40546f
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.004054f9
cmp byte [eax], 0
je 0x4053db
cmp byte [ebp - 0x18], 0
je 0x4053db
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4053eb
mov al, byte [esi + 1]
cmp al, 0x2e
je 0x40544e
test al, al
je 0x40544e
push esi
push ebx
call fcn.004059c1
mov eax, dword [ebp - 0x148]
test al, 0x10
je 0x405411
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x40544e
push dword [ebp + 0xc]
push edi
call fcn.00405315
jmp 0x40544e
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405446
test byte [ebp + 0xc], 4
je 0x40543e
push edi
push 0xfffffffffffffff1
call fcn.00404d7d
push 0
push edi
call fcn.00405709
jmp 0x40544e
inc dword [0x7c77e8]
jmp 0x40544e
push edi
push 0xfffffffffffffff2
call fcn.00404d7d
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4053b9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x405479
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4054c8
cmp dword [ebp - 8], esi
jne 0x40548e
inc dword [0x7c77e8]
jmp 0x4054c8
push edi
call fcn.00405c96
test eax, eax
je 0x4054c8
push edi
call fcn.004054ce
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4054c0
test byte [ebp + 0xc], 4
je 0x405486
push edi
push 0xfffffffffffffff1
call fcn.00404d7d
push esi
push edi
call fcn.00405709
jmp 0x4054c8
push edi
push 0xffffffffffffffe5
call fcn.00404d7d
pop edi
pop esi
leave
ret 8
Function at 0x4055ae
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7bc578
push esi
call fcn.004059c1
push esi
call fcn.00405561
mov edi, eax
test edi, edi
jne 0x4055cf
xor eax, eax
jmp 0x405621
push edi
call fcn.00405bfd
test byte [0x7c7770], 0x80
je 0x4055e8
mov al, byte [edi]
test al, al
je 0x4055cb
cmp al, 0x5c
je 0x4055cb
sub edi, esi
jmp 0x405600
call fcn.00405c96
test eax, eax
je 0x4055fa
test byte [eax], 0x10
je 0x4055cb
push esi
call fcn.00405515
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x4055ec
call fcn.004054ce
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405692
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4056c1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405705
test edi, edi
jne 0x4056cc
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4056ff
Function at 0x405709
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00405cd4
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405735
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40587b
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x7bef00], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x7bef00
je 0x405779
push 1
push 0
push esi
call fcn.00405692
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405881
cmp eax, edi
jg 0x405881
mov esi, 0x7be978
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405881
cmp eax, edi
jg 0x405881
push esi
push ebp
push str._s_s_r_n
push 0x7be578
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call sub.KERNEL32.dll_lstrcatA
xor eax, eax
push eax
push 0x8000080
push 4
push eax
push eax
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40587b
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405874
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405874
cmp edi, dword [esp + 0x18]
jne 0x405874
push str._Rename__r_n
push esi
call fcn.00405626
test eax, eax
jne 0x405888
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.004059c1
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x7be578
push eax
call fcn.00405672
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x7c77f0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409300
push eax
call fcn.00405626
test eax, eax
je 0x40583f
inc eax
lea edx, [esi + edi]
cmp eax, edx
mov ecx, eax
jae 0x4058b1
mov dl, byte [ecx]
mov byte [ecx + ebx], dl
inc ecx
lea edx, [esi + edi]
cmp ecx, edx
jb 0x4058a4
sub eax, esi
jmp 0x405841
Function at 0x4058b5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405919
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405908
cmp dword [ebp + 0x14], 1
je 0x40590a
cmp dword [ebp + 0x14], 2
je 0x40590a
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4059e3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x405a04
mov ecx, dword [0x7c373c]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x7c7798]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x7bf700
sub ecx, eax
mov edi, eax
cmp ecx, 0x4000
jae 0x405bd7
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405bd7
mov edx, edi
sub edx, eax
cmp edx, 0x2000
jge 0x405be4
inc ebx
cmp cl, 0xfc
jbe 0x405bca
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
or ecx, edx
or eax, edx
inc ebx
mov dword [ebp - 0x14], ecx
inc ebx
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0xc], eax
jne 0x405b75
and dword [ebp + 0xc], 0
and byte [edi], 0
push 4
pop esi
cmp dword [ebp - 0x10], esi
jne 0x405a98
mov dword [ebp + 0xc], str.MicrosoftInternet_ExplorerQuick_Launch
jmp 0x405b10
mov eax, dword [ebp - 0x18]
cmp eax, 0x2b
jne 0x405ab7
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058b5
jmp 0x405b0b
cmp eax, 0x26
jne 0x405ae7
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.004058b5
cmp byte [edi], 0
jne 0x405b6d
push str.C:Program_Files
push edi
call fcn.004059c1
jmp 0x405b0b
cmp eax, 0x25
jne 0x405afa
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405b0b
cmp eax, 0x24
jne 0x405b10
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
jne 0x405b6d
cmp dword [0x7c77e4], 0
jne 0x405b1c
push 2
pop esi
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x18]
push dword [0x7c7764]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405b52
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.00405230
cmp dword [ebp - 8], 0
jne 0x405b59
jmp 0x405b55
and byte [edi], 0
test esi, esi
jne 0x405b1c
cmp byte [edi], 0
je 0x405b6d
cmp dword [ebp + 0xc], 0
je 0x405b6d
push dword [ebp + 0xc]
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00405bfd
jmp 0x405bbb
cmp byte [ebp + 0xf], 0xfd
jne 0x405ba9
cmp esi, 0x1b
jne 0x405b8e
push dword [0x7c7764]
push edi
call fcn.0040591f
jmp 0x405b9f
mov eax, esi
shl eax, 0xd
add eax, section..ndata
push eax
push edi
call fcn.004059c1
add esi, 0xffffffeb
cmp esi, 6
jae 0x405bbb
jmp 0x405b6d
cmp byte [ebp + 0xf], 0xff
jne 0x405bbb
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.004059e3
push edi
call sub.KERNEL32.dll_lstrlenA
add edi, eax
mov eax, 0x7bf700
jmp 0x405bd7
jne 0x405bd4
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405bd7
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405a2f
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405bf9
push eax
push dword [ebp + 8]
call fcn.004059c1
leave
ret 8
Function at 0x405d31
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7bf304], 0
push esi
jne 0x405d68
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d42
mov dword [ecx*4 + 0x7bf300], eax
inc ecx
cmp ecx, 0x100
jl 0x405d3d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d99
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7bf300]
xor eax, esi
inc ecx
dec edx
jne 0x405d7b
pop edi
not eax
pop esi
ret 0xc
Function at 0x401cb0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x208
test eax, eax
push esi
push edi
jne 0x401cda
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x401d02
mov byte [esp + 8], al
jmp 0x401d02
mov edi, dword [esp + 0x218]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10c]
xor esi, esi
push ecx
push esi
lea edx, [esp + 0x10]
push 0x4042e4
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x401d6b
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00401b90
mov edx, eax
lea edi, [esp + 0x110]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x208
ret
mov eax, esi
pop edi
pop esi
add esp, 0x208
ret

Function at 0x401f50
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x401fb9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.00401b90
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x402110
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4021a2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x402194
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x40218c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x402155
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x4021b0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x4021d0
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.00401b90
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x402227
push ebx
push edi
call fcn.00401be0
push esi
mov ebx, esi
call fcn.00401b90
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x4021fe
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x1a82048
Capabilities:
Encode data using xor

Disassembly:
fisub dword [ebp - 0x170a0008]
inc edx
push esp
push esi
not ah
lea eax, [0x1a7fae7]
not ah
lea eax, [0x1a7fae7]
pushfd
pushal
call fcn.01a82a8f
add eax, 0xf8f70dd7
sub bl, byte [eax + ebx*2 + 0x22e8e3e8]
sbb eax, 0x9d9c9a24
add dword [eax], ecx
sbb al, 0xaf
fsub st(0)
or eax, 0x1ca0d91c
scasd eax, dword es:[edi]
xor cl, ah
add al, 5
xchg byte [ecx], cl
xchg ecx, eax
push ds
shl byte [eax + 0x19348845], cl
cld
cmp eax, 0x660ec344
sbb ebp, ebp
popfd
stosb byte es:[edi], al
jns 0x1a8203e
mov word [ebp + eax*8 + 0x18413a55], ds
add eax, 0x93a54aa0
pop esi
xor bh, byte cs:[ebx + 0x3e]
lcall 0x6505, 0x29f9598b
jae 0x1a820da
retf
add eax, ebp
aas
sub dh, byte [0x554c49f1]
inc esp
inc edi
xchg dword [ecx], esi
loope 0x1a82148
dec ecx
nop
mov bl, 0xb8
xor dword [ecx + 0x2b], 0x44
adc al, 0xf0
ja 0x1a8209f
invalid
mov al, 0x1a
sub al, 0xa3
inc esi
inc ebx
push ebx
inc ebp
push ebx
push ebx
push ecx
invalid
Function at 0x10003f6e
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 0
xor eax, eax
mov byte [ebp - 3], al
mov ecx, dword [ebp + 8]
push ecx
call fcn.100194b0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jne 0x10003faa
push 0x100b41d0
mov edx, dword [ebp + 8]
push edx
call fcn.10019a50
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.100194b0
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x10003fcd
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jl 0x10004021
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
lea edx, [ecx + ecx - 0x60]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 9
jle 0x10003ff2
mov eax, dword [ebp - 0x10]
sub eax, 9
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jge 0x1000400c
jmp 0x10004021
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx - 0x30]
mov dword [ebp - 0x14], eax
jmp 0x10003fc4
mov eax, dword [ebp - 0x14]
cdq
mov ecx, 0xa
idiv ecx
mov eax, 0xa
sub eax, edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xa
jne 0x10004043
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
mov byte [ebp - 4], cl
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10019a50
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x10015ad0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x100b7098
push 0x101c4f60
call fcn.10022de5
add esp, 8
mov ecx, 0x101c4f60
call fcn.100157c0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [0x101c4f64], 0
mov ecx, dword [ebp - 4]
call fcn.10015bb0
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
mov byte [eax + 0x71], cl
mov ecx, dword [ebp - 4]
call fcn.10016020
mov esp, ebp
pop ebp
ret 4
Function at 0x1b77451
Capabilities:
Encode data using xor

Disassembly:
xor edx, 0xd9b11a15
inc eax
not edx
sar ecx, 0xc3
ror cx, 0x4e
rol edx, 1
xor ebx, edx
dec eax
sal word [esp + ecx*2 - 0x5b3a21e], 0xa1
dec ax
add ebp, edx
mov byte [esp + ecx*2 - 0x5b3a220], al
call fcn.02ecc44a
in al, dx
sbb eax, dword [edi - 0x1ca490d6]
pushfd
leave
invalid

Function at 0x1b7f046
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + edx*4 - 0x70c], 0x43224131
call fcn.02ec168e

Function at 0x1b8813a
Capabilities:
Encode data using base64

Disassembly:
inc ecx
bswap edi
inc ecx
pop eax
inc ecx
mov edx, ecx
dec eax
mov dword [esp + eax*2 - 0x7934f52e], ebp
inc ecx
ror edi, 2
inc ecx
xor edi, 0x4b1ccfa5
sub ebp, dword [esp + ebp - 0x96]
neg word [esp + eax - 0x3c9a7a93]
dec eax
add eax, 0x23f7d33
inc ecx
ror edi, 1
dec eax
xchg dword [esp + eax - 0x3ed9f7ca], eax
call fcn.01bd01b8

Function at 0x1b89071
Capabilities:
Encode data using base64

Disassembly:
mov cl, byte [esi + ecx*8 - 0xbe4]
ror dword [esp + eax*2 - 0xf1], 0x21
jne 0x22312f5
mov edx, 0x53a08001
jmp 0x2e7542c
dec word [esp + 1]
imul dl
mov word [ebp], ax
sub esi, 4
jmp 0x2e7d3fb
ror eax, 0x6d
sal dl, cl
mov word [esi + eax - 0x3e7fffc], dx
movzx ecx, byte [esp + eax*2 - 0x7cffff6]
mov dword [esp + eax*8 - 0x1f400000], ecx
lea esi, [esi + eax*4 - 0xf9ffffc]
and dword [esp + eax*2 - 0x7cffff4], ecx
dec al
mov dword [esp + eax - 0x3e800ff], ebp
ret 0xc
movsx ecx, dx
mov dl, byte [ebp + edx - 0x53a08001]
movzx ax, byte [ebp + 2]
push ecx
inc byte [esp + 1]
ror cl, 0x42
adc ebp, 2
jmp 0x1bc6eee
xchg dword [esp], ecx
mov eax, dword [esi]
sar ecx, cl
xor dword [esp], ecx
xchg word [esp + 1], cx
xor eax, ebx
dec eax
and cx, word [esp + 1]
movsx edx, byte [esp]
ror eax, 3
call fcn.021c9f11

Function at 0x1b97089
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [edi + eax*2 - 0x15550]
and word [esp + ecx - 0x429fa2a4], 0x8c82
shr dword [esp + ecx - 0x429fa2a5], 0x38
movzx edx, cl
mov dl, byte [esi + ecx - 0x429fa2a6]
sbb ecx, ecx
lea esi, [ecx + esi + 5]
sbb cx, cx
xor dl, bl
xor ecx, ecx
neg dl
rol dl, 1
dec dl
call fcn.021c206f

Function at 0x1b970c4
Capabilities:
Encode data using base64

Disassembly:
bswap edx
sal eax, 0xc
sbb cx, 0xf717
lea edx, [ecx + edx - 0x18e632cd]
xor edx, 0x8a36e1b3
neg edx
call fcn.02efd9e8

Function at 0x1b9fc04
Capabilities:
Encode data using base64

Disassembly:
push 0x4413b2b3
push ebp
pushfd
mov ebp, 0x72952d86
mov dword [esp + 0x18], 0x894bb138
mov ebp, dword [esp + ebp - 0x72952d82]
shr dword [esp + 8], 0x4e
setns byte [esp + 8]
call fcn.021a6dc2
lea esp, [esp + 0x10]
jne 0x2ef3f88
mov eax, 0x78341c3d
xor al, ah
mov edx, eax
pop ebx
mov edx, 0xbab3701f
sal dx, 4
lea eax, [edx + edx*2 + 0x65af449b]
not ecx
push edx
jns 0x2e17ed0
shl dword [esp + eax], 0xe8
add edi, edx
mov dword [esp + eax], edi
ret
and dx, 0x22b1
mov dword [ebp], ecx
sar ax, 0x88
sbb esi, 4
xor edx, eax
sal byte [esp + edx*2 - 0x5ef601f4], 0x66
mov ecx, dword [esi + edx - 0x2f7b00fa]
sar ax, 0xab
xor ecx, ebx
call fcn.02e35a7f
mov ebx, 0xb3347d11
call int.02e5f339
Function at 0x1ba26da
Capabilities:
Encode data using xor

Disassembly:
dec edx
mov dword [esp - 0x76a6d288], 0xd2ad948c
inc edx
mov cl, byte [esi - 0x76a6d286]
dec esi
lea esi, [0x81bc129d]
dec ecx
lea esi, [esp + esi - 0x76a6d286]
inc esi
sub dword [esp - 0x76a6d287], esp
call fcn.02ecc053

Function at 0x1ba8b57
Capabilities:
Get number of processors

Disassembly:
xor ebx, edx
not cl
shl ecx, 0x64
mov dword [esp + ecx*8 - 0x7f80], ecx
mov dword [ebp + ecx*8 - 0x7f82], edx
lea ebp, [ebp + ecx - 0xff2]
xchg dword [esp + ecx*2 - 0x1fdf], eax
mov eax, dword [esi + ecx*2 - 0x1fe8]
setne cl
movsx edx, cl
or ecx, ecx
lea esi, [esi + ecx*2 - 0x1e0a]
dec byte [esp + ecx - 0xefd]
xor eax, ebx
inc edx
rol eax, 2
shl byte [esp + ecx*2 - 0x1dfe], cl
lea eax, [eax + ecx + 0x1bac7e7f]
ror ecx, 0x72
xor eax, 0x24b69c09
neg cl
lea ecx, [ecx + 0x448e898f]
neg eax
dec dword [esp + edx*2]
xor ebx, eax
add edi, eax
pop edx
pop ecx
jmp fcn.021b7ec4

Function at 0x1bac706
Capabilities:
Encode data using base64

Disassembly:
pop ecx
neg eax
movsx ecx, dl
dec eax
neg eax
sar edx, cl
rol dx, 6
bswap edx
sbb eax, 0x9fb5a08e
sal cx, 0x6b
setns cl
rol eax, 2
xor ebx, eax
add edi, eax
push ecx
mov cx, word [edx + ebp]
shl dword [esp + edx*2], 0xfc
movzx eax, dx
jbe 0x2e43cf6

Function at 0x1bb0515
Capabilities:
Get number of processors

Disassembly:
mov dword [esp + esi - 0x3c1aa6b], ecx
pushfd
rol ebp, 0x5a
sal eax, 0xb3
push edi
movzx edi, bl
push edx
movzx ecx, di
sub ecx, ebp
mov ebx, 0
push edi
push ebp
mov dword [esp + esi - 0x3c1aa47], ebx
call fcn.01b8a3bc
dec eax
sub ebx, 4
inc bp
xchg esi, eax
inc ebp
movzx edi, al
inc edx
mov ebp, dword [ebx + edi*2 - 0x134]
inc ecx
neg eax
inc ecx
sete bh
call fcn.02e4eb5f