joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1000bb8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000bb9a
pop dword [ebp - 0x1c]
mov eax, 0x777edd0
sub eax, 0xf7773236
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x35c16
push 0
mov eax, 0x888ccca7
add eax, 0x87740461
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xf762e56b
add ecx, 0x89d5c1a
xor esi, esi
add esi, eax
mov edi, 0x2e4a5c40
add edi, 0xe1b7b7c0
add edi, dword [ebp - 0x1c]
mov ebx, 0x78a8215f
add dword [ebp - 0x14], 0xe0a3fa20
mov edx, dword [edi]
xor dword [ebp - 8], 0x6c336703
xor edx, ebx
mov dword [esi], edx
add esi, 0x4f839a91
sub esi, 0x4f839a8d
add edi, 0x48569ac2
sub edi, 0x48569abe
loop 0x1000bbf5
add eax, 0x9b2200a9
sub eax, 0x9b2107c2
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x85544579
add ecx, 0x8aabba87
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40d528
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408c67
mov dword [ebp - 0x14], eax
cmp dword [0x4363e0], esi
jne 0x40d61b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d5a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d6fb
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d6fb
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d6fb
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4363e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4363e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4363e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4363f0], eax
test eax, eax
je 0x40d618
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4363ec], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d640
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d633
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d655
push 4
pop eax
jmp 0x40d6fd
cmp dword [ebp - 0x14], esi
je 0x40d655
push dword [0x4363e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d63a
mov eax, dword [0x4363ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d6b3
cmp dword [0x4363f0], edi
je 0x40d6b3
push eax
call ebx
push dword [0x4363f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d6b3
test eax, eax
je 0x40d6b3
call ecx
test eax, eax
je 0x40d6a8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d6a8
test byte [ebp - 8], 1
jne 0x40d6b3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d6e3
mov eax, dword [0x4363e4]
cmp eax, edi
je 0x40d6e0
push eax
call ebx
test eax, eax
je 0x40d6e0
call eax
mov esi, eax
test esi, esi
je 0x40d6e0
mov eax, dword [0x4363e8]
cmp eax, edi
je 0x40d6e0
push eax
call ebx
test eax, eax
je 0x40d6e0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4363e0]
call ebx
test eax, eax
je 0x40d6fb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d6fd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040d0
mov esp, ebp
pop ebp
ret
Function at 0x10009276
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94c
mov eax, dword [0x10046040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.100119dd
test eax, eax
js 0x10009504
push 0x104
lea eax, [ebp - 0x13c]
push eax
push dword [0x1004603c]
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
mov edi, 0x100012dc
push edi
lea eax, [ebp - 0x34]
push 0x2d
push eax
call fcn.1002c95d
add esp, 0xc
xor ebx, ebx
push ebx
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x10001354
push 2
push 0x10003584
mov byte [ebp - 0x2f], 0x5c
call fcn.1002c95d
test eax, eax
je 0x100092f3
mov eax, 0x80040201
jmp 0x10009504
push ebx
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x1000136c
push 3
push 0x10003234
call fcn.1002c95d
test eax, eax
jne 0x100092e9
push 1
lea eax, [ebp - 0x13c]
push eax
push ebx
push 0x10001388
push 4
mov esi, 0x10003304
push esi
call fcn.1002c95d
test eax, eax
jne 0x100092e9
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
push 0x800
lea eax, [ebp - 0x93c]
push eax
push 5
push dword [0x1004603c]
call ebx
test eax, eax
jne 0x10009357
mov byte [ebp - 0x93c], al
lea eax, [ebp - 0x93c]
push eax
push 0
push 0
push 0x100013a4
call fcn.1002c95d
test eax, eax
jne 0x100092e9
lea eax, [ebp - 0x2e]
push eax
push esi
call fcn.1002c95d
lea eax, [ebp - 0x2e]
push eax
push edi
push 0
push 0x100013a4
call fcn.1002c95d
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013c0
push 6
push 0x10003434
call fcn.1002c95d
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013dc
push 7
push 0x10003444
call fcn.1002c95d
test eax, eax
jne 0x100092e9
push eax
lea eax, [ebp - 0x13c]
push eax
push 0
push 0x100013fc
push 9
push 0x10003454
call fcn.1002c95d
test eax, eax
jne 0x100092e9
push 0x10001424
mov dword [ebp - 0x940], eax
mov dword [ebp - 0x944], eax
mov dword [ebp - 0x94c], eax
call dword [sym.imp.kernel32.dll_lstrlenA]
mov esi, eax
lea eax, [ebp - 0x940]
push eax
push 1
push 0
push 0x10001434
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009502
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x944]
push eax
push 0
lea eax, [ebp - 0x948]
push eax
push 0
push 0x100012a8
push dword [ebp - 0x940]
call edi
test eax, eax
jne 0x10009502
mov eax, dword [ebp - 0x944]
inc eax
add eax, esi
mov dword [ebp - 0x944], eax
call fcn.10009f0e
mov esi, esp
test esi, esi
je 0x10009502
lea eax, [ebp - 0x94c]
push eax
push esi
lea eax, [ebp - 0x948]
push eax
push 0
push 0x100012a8
push dword [ebp - 0x940]
call edi
test eax, eax
jne 0x10009502
push dword [ebp - 0x940]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10001424
push dword [ebp - 0x944]
push esi
call fcn.1002c95d
push 0x10001450
lea eax, [ebp - 0x13c]
push 0x106
push eax
call fcn.1002c95d
add esp, 0xc
push 0x800
lea eax, [ebp - 0x93c]
push eax
push 1
push dword [0x1004603c]
call ebx
test eax, eax
jne 0x10009502
mov eax, 0xc7ce0017
jmp 0x10009504
xor eax, eax
lea esp, [ebp - 0x958]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009f00
leave
ret
Function at 0x10009bb9
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x10042958
call fcn.1000aecb
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10009c47
call fcn.1000ae99
test eax, eax
jne 0x10009bdd
xor eax, eax
jmp 0x10009d13
call fcn.1000a293
test eax, eax
jne 0x10009bed
call fcn.1000aeb7
jmp 0x10009bd6
call fcn.1000ae4d
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10049d38], eax
call fcn.1002c95d
mov dword [0x10048aa4], eax
call fcn.1002c95d
test eax, eax
jns 0x10009c17
call fcn.10009f6a
jmp 0x10009be6
call fcn.1002c95d
test eax, eax
js 0x10009c40
call fcn.1000aa85
test eax, eax
js 0x10009c40
push 0
call fcn.1002c95d
pop ecx
test eax, eax
jne 0x10009c40
inc dword [0x10048aa0]
jmp 0x10009d10
call fcn.1000aa32
jmp 0x10009c10
xor edi, edi
cmp eax, edi
jne 0x10009ca6
cmp dword [0x10048aa0], edi
jle 0x10009bd6
dec dword [0x10048aa0]
mov dword [ebp - 4], edi
cmp dword [0x10048ad8], edi
jne 0x10009c6b
call fcn.1000a7c0
cmp dword [ebp + 0x10], edi
jne 0x10009c7f
call fcn.1000aa32
call fcn.10009f6a
call fcn.1000aeb7
mov dword [ebp - 4], 0xfffffffe
call fcn.10009c92
jmp 0x10009d10
cmp eax, 2
jne 0x10009d04
call fcn.10009f36
push 0x214
push 1
call fcn.1002c95d
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x10009bd6
push esi
push dword [0x10046048]
push dword [0x10048ab8]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x10009cf8
push edi
push esi
call fcn.10009fad
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x10009d10
push esi
call fcn.1002c95d
pop ecx
jmp 0x10009bd6
cmp eax, 3
jne 0x10009d10
push edi
call fcn.1002c95d
pop ecx
xor eax, eax
inc eax
call fcn.1000af10
ret 0xc

Function at 0x10009f00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10046040]
jne 0x1000b4a0
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10048cf8], eax
mov dword [0x10048cf4], ecx
mov dword [0x10048cf0], edx
mov dword [0x10048cec], ebx
mov dword [0x10048ce8], esi
mov dword [0x10048ce4], edi
mov word [0x10048d10], ss
mov word [0x10048d04], cs
mov word [0x10048ce0], ds
mov word [0x10048cdc], es
mov word [0x10048cd8], fs
mov word [0x10048cd4], gs
pushfd
pop dword [0x10048d08]
mov eax, dword [ebp]
mov dword [0x10048cfc], eax
mov eax, dword [ebp + 4]
mov dword [0x10048d00], eax
lea eax, [ebp + 8]
mov dword [0x10048d0c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10048c48], 0x10001
mov eax, dword [0x10048d00]
mov dword [0x10048bfc], eax
mov dword [0x10048bf0], 0xc0000409
mov dword [0x10048bf4], 1
mov eax, dword [0x10046040]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10046044]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10048c40], eax
push 1
call fcn.1000ce11
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10001564
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10048c40], 0
jne 0x1000b58c
push 1
call fcn.1000ce11
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x1001100d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100418d8
call fcn.10037358
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1001106e
call fcn.1000e3e2
mov esi, eax
jmp 0x10011146
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1001108c
call fcn.1000e3e2
jmp 0x1001113d
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x10011082
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100110bf
mov esi, 0x8007000e
jmp 0x1001113f
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1002c95d
mov dword [ebp - 4], 1
jmp 0x100110f3
cmp dword [ebp - 0x418], 0
je 0x100110b5
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10011082
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.1002c95d
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1001115f
lea ecx, [ebp - 0x418]
call fcn.10011269
mov eax, esi
call fcn.100373b1
ret 0x10
Function at 0x1002c95d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1002c96c
pop dword [ebp - 0x3c]
mov eax, 0xba445dc5
sub eax, 0xaa419459
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x2216ecac
sub dword [ebp - 0x4c], 0xd3c4a761
mov dword [ebp - 0x48], 0xdf1bd82f
sub dword [ebp - 0x48], 0xace88bea
mov dword [ebp - 0x44], 0x2ddf1a5f
sub dword [ebp - 0x44], 0xe192d631
mov dword [ebp - 0x40], 0x9b1bce2e
sub dword [ebp - 0x40], 0x9b1bce2e
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xac34c6d
sub dword [ebp - 0x4c], 0x9650e317
mov dword [ebp - 0x48], 0xbbd33940
sub dword [ebp - 0x48], 0x7a66d7cb
mov dword [ebp - 0x44], 0x36d57523
add dword [ebp - 0x44], 0x2c99f749
mov dword [ebp - 0x40], 0x188c3419
add dword [ebp - 0x40], 0xe773cbe7
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x8f786ed8
add eax, 0x8087a128
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x437ae
push 0
call eax
mov ecx, 0x8533f071
add ecx, 0x7acc55d0
xor esi, esi
add esi, eax
mov edi, 0x10051800
add edi, dword [ebp - 0x3c]
mov edx, 0x88055eac
add dword [ebp - 0x1c], eax
mov ebx, dword [edi]
mov dword [ebp - 0x24], 0xe4d74f8c
xor ebx, edx
sub dword [ebp - 0x1c], eax
mov dword [esi], ebx
add dword [ebp - 0x20], 0x71a9a459
add esi, 0x94345b56
add esi, 0x6bcba4ae
add edi, 0x465d7fbc
sub edi, 0x465d7fb8
loop 0x1002ca7f
add eax, 0xd0669c4f
sub eax, 0xd0659078
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x40ce94
Capabilities:
Get disk information

Disassembly:
mov eax, 0x44561c
call fcn.00420850
sub esp, 0x50
push esi
mov esi, ecx
lea eax, [ebp - 0x5c]
push edi
mov ecx, dword [esi + 0x154]
push eax
call fcn.00403154
and dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
push 0
push ecx
mov ecx, eax
call fcn.00401bdc
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00401d5e
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004014d4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.004014d4
cmp edi, 2
je 0x40cf13
cmp edi, 5
je 0x40cf13
cmp edi, 3
je 0x40cf0f
cmp edi, 4
je 0x40cf0f
cmp edi, 6
je 0x40cf0f
mov ecx, esi
call fcn.0040c991
dec ax
neg ax
sbb eax, eax
neg eax
jmp 0x40cf15
xor al, al
jmp 0x40cf15
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41856e
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x446990
call fcn.00420850
sub esp, 0x34
push ebx
push esi
push dword [0x458b74]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [ebp - 0x40]
call fcn.0040f524
push 4
xor ebx, ebx
sub esp, 0x1c
mov ecx, 0x458b4c
mov esi, esp
mov dword [ebp - 0x14], esp
push 1
mov dword [ebp - 4], ebx
call fcn.004148c9
push eax
mov ecx, esi
call fcn.0041865d
lea ecx, [ebp - 0x40]
call fcn.0040f693
cmp al, bl
je 0x418621
push dword [0x458b78]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 2
push ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x10], eax
call fcn.0040f7d9
lea eax, [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push eax
lea eax, [ebp - 0x10]
push 4
push eax
push dword [ebp - 0x3c]
call esi
push 0x21
lea ecx, [ebp - 0x14]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push dword [0x458b78]
call fcn.0041f4e8
mov eax, dword [0x458b78]
lea ecx, [ebp - 0x18]
push ebx
push ecx
push dword [ebp - 0x10]
push eax
push dword [ebp - 0x3c]
call esi
lea ecx, [ebp - 0x40]
call fcn.0040f807
push dword [0x458b74]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x40], vtable.is::file_lite.0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 1
call fcn.0040f807
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0040ee1e
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x41a254
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x41a42e
cmp dword [ebp + 0xc], 1
je 0x41a42e
cmp dword [ebp + 0xc], 8
jne 0x41a3f6
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
invalid
test dword [ecx - 7], edx
invalid
invalid

Function at 0x41a47c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041954e
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
Function at 0x41a4e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00419580
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00419535
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00419570
sub eax, 0x68625252
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
invalid
Function at 0x1000a732
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000a741
pop dword [ebp - 0x3c]
mov eax, 0x1000a741
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xdb1b73d7
add dword [ebp - 0x4c], 0x7336d174
mov dword [ebp - 0x48], 0x145b0966
add dword [ebp - 0x48], 0x1dd842df
mov dword [ebp - 0x44], 0x323aaba1
sub dword [ebp - 0x44], 0xe5ee6773
mov dword [ebp - 0x40], 0x54dcdc5c
add dword [ebp - 0x40], 0xab2323a4
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xa12cdd8c
add eax, 0x6ed572f8
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xf8e537f
sub dword [ebp - 0x4c], 0x9b1bea29
mov dword [ebp - 0x48], 0x316dbea1
sub dword [ebp - 0x48], 0xf0015d2c
mov dword [ebp - 0x44], 0x3e4d6dbc
add dword [ebp - 0x44], 0x2521feb0
mov dword [ebp - 0x40], 0xd9e345fe
sub dword [ebp - 0x40], 0xd9e345fe
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b4a0
push 0
call eax
mov ecx, 0x470a
mov edi, eax
mov ebx, 0x58d585b0
add ebx, 0xb72d8650
add ebx, dword [ebp - 0x3c]
mov esi, 0x989b4789
sub dword [ebp - 0x38], ebx
mov edx, dword [ebx]
add dword [ebp - 0x34], 0x57d7e6fa
xor edx, esi
mov dword [edi], edx
add edi, 0x35560b56
sub edi, 0x35560b52
add ebx, 0xba9648a3
sub ebx, 0xba96489f
loop 0x1000a84d
add eax, 0x10efb
mov ebx, eax
add eax, 0x77dd4654
add eax, 0x8822b9b1
mov ecx, 0xd0bd841a
sub ecx, 0xc0bd841a
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x1001ca50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001caeb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001caa2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001caa2
cmp esi, ebx
jge 0x1001caa2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001cae5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001cae5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e0]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e0]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001cafd
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001cd20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
mov eax, dword [ebp + 8]
je 0x1001cd48
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cd62
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1000a732
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022ac0
leave
ret 4

Function at 0x1001cf30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cf66
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cfc5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1000a732
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1000a732
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1000a732
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022ac0
leave
ret 0x10

Function at 0x1001cfe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d00c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d03d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d03b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1000a732
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d03d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022ac0
leave
ret 8