joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e388b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
push ebx
push esi
mov esi, dword [0x1019fa94]
push edi
push dword [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x100e38fe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, 0xffffffff
je 0x100e38fe
test eax, eax
je 0x100e38fe
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x100e38fe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x100e38fe
push esi
call fcn.10100af4
test eax, eax
pop ecx
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
je 0x100e38fe
push esi
push ebx
push eax
call fcn.10102a40
mov eax, dword [esp + 0x24]
mov dword [eax], esi
xor eax, eax
add esp, 0xc
inc eax
jmp 0x100e3900
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x100e39a8
Capabilities:
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push ebx
push esi
mov esi, dword [0x1019fa90]
push edi
push str.BASIC_RC
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x100e3a4f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, 0xffffffff
je 0x100e3a4f
test eax, eax
je 0x100e3a4f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x100e3a4f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x100e3a4f
and dword [ebp + 0xc], 0
push 0x10160f5c
push dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.101035c0
add esp, 0xc
test eax, eax
jne 0x100e3a4f
push dword [ebp + 0xc]
push esi
push 1
push ebx
call fcn.10103ca7
add esp, 0x10
cmp eax, esi
push dword [ebp + 0xc]
jne 0x100e3a40
call fcn.10103005
pop ecx
lea ecx, [ebp + 8]
call fcn.100015d9
xor eax, eax
inc eax
jmp 0x100e3a59
call fcn.10103005
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 8]
call fcn.100015d9
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100e4be9
Capabilities:
Check mutex on windows

Disassembly:
push esi
push str.26112016_98AA_40f6_8A05_A8438858979B
push 0
mov ecx, 0x1019ee80
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x100e4c15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100e4c2c
push 1
call fcn.100e48ec
test eax, eax
pop ecx
jne 0x100e4c2c
push 0x10166bbc
call fcn.1007695c
pop ecx
test esi, esi
je 0x100e4c37
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x100e4da8
Capabilities:
Delete registry value

Disassembly:
push 4
mov eax, 0x1014bd22
call fcn.101018b2
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
xor esi, esi
cmp dword [eax - 8], esi
je 0x100e4e38
lea eax, [ebp + 8]
push eax
push 0x10155e24
lea eax, [ebp - 0x10]
push eax
call fcn.1000c27f
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.10005459
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.100015d9
lea eax, [ebp + 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings
lea eax, [ebp - 0x10]
push eax
call fcn.1000c27f
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.10005459
lea ecx, [ebp - 0x10]
call fcn.100015d9
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.Flags
push dword [ebp + 8]
mov edi, SysReAllocString
push edi
call esi
push str.Version
push dword [ebp + 8]
push edi
call esi
xor esi, esi
inc esi
lea ecx, [ebp + 8]
call fcn.100015d9
mov eax, esi
call fcn.1010198a
ret
Function at 0x100e544b
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.101027c0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
push 0x10000000
push dword [ebp + 8]
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
neg eax
sbb eax, eax
neg eax
leave
ret

Function at 0x100e996a
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
mov esi, ecx
mov dword [esi + 4], 0x1015330c
push edi
xor edi, edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
lea eax, [esi + 0x3c]
push eax
mov dword [esi], fcn.100e9005
mov dword [esi + 4], 0x10167b94
mov dword [esi + 8], 0x10167b84
call ebx
lea eax, [esi + 0x54]
push eax
call ebx
mov dword [esi + 0x6c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], 0x7530
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
cmp dword [0x1019f9cc], edi
jne 0x100e99f8
push 0x1019f9cc
push 4
push esi
push 0x100e98f3
push edi
push edi
call fcn.1010370a
mov ebx, eax
add esp, 0x18
cmp ebx, edi
je 0x100e99f8
push 0x4000
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1019f9f4
call fcn.10079810
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x100e9ad3
Capabilities:
Terminate thread

Disassembly:
mov dword [ecx], 0x10167c64
mov dword [ecx + 4], 0x10167c5c
mov dword [ecx + 8], 0x10167c4c
jmp fcn.100e8f44
Function at 0x100eb3cf
Capabilities:
Check mutex on windows
Log keystrokes via polling

Disassembly:
push 0xc
mov eax, 0x1014d4c9
call fcn.101018b2
mov edi, ecx
mov eax, dword [ebp + 0x14]
and dword [eax], 0
push str.4389F869_D241_4d55_B61B_846DC2319405
push 0
mov ecx, 0x1019ee80
call fcn.1001018e
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov eax, dword [0x1019a028]
mov dword [ebp + 0x14], eax
and dword [ebp - 4], 0
push 0xe4
lea ecx, [ebp + 0x14]
call fcn.1000201d
test esi, esi
je 0x100eb440
push 1
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
push esi
jne 0x100eb433
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100eb4a4
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], 0x2e
jne 0x100eb48a
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
je 0x100eb4a4
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100eb4a4
and dword [ebp - 0x18], 0
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x18]
push ecx
mov eax, 0x161
push eax
push 0x4e
push esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xfffffffe
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x100eb4a4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x100eb4a4
cmp dword [ebp + 0xc], 0x41
jne 0x100eb4a4
mov ecx, edi
call fcn.100eacf3
lea ecx, [ebp + 0x14]
call fcn.100015d9
xor eax, eax
call fcn.1010198a
ret 0x10

Function at 0x100ebcb4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
push edi
mov esi, ecx
jl 0x100ebdae
lea edi, [esi + 0x44]
mov ecx, edi
call fcn.10047e43
cmp ebx, eax
jge 0x100ebdae
mov ecx, dword [esi + 0x54]
call fcn.10002742
cmp ebx, eax
jge 0x100ebdae
mov ecx, dword [esi + 0x54]
push ebx
call fcn.10002755
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x100ebdae
and dword [ebp + 8], 0
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x54]
push eax
push dword [eax + 4]
lea ecx, [ebp - 8]
call fcn.1000e28d
push ebx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
call fcn.1002736b
push dword [eax + 4]
mov ecx, dword [esi + 0x54]
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.100eb800
push edi
push dword [edi + 4]
lea ecx, [ebp - 8]
call fcn.10048b57
push ebx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
call fcn.10048ac0
push dword [eax + 4]
mov ecx, edi
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.100eb4bb
cmp dword [ebp + 0xc], 0
je 0x100ebda9
push 1
mov ecx, esi
call fcn.100eabe4
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0xc]
jmp 0x100ebdb0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100ebdb7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea ecx, [edi + 0x44]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.10047e43
mov esi, eax
dec esi
js 0x100ebf17
push esi
lea ecx, [edi + 0x44]
call fcn.100ea83e
cmp dword [eax + 8], ebx
je 0x100ebec5
mov ebx, dword [edi + 0x54]
mov ecx, ebx
mov dword [ebp - 0xc], 1
call fcn.10002742
cmp esi, eax
jge 0x100ebec3
push esi
mov ecx, ebx
call fcn.10002755
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100ebec3
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add dword [ebp - 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [edi + 0x54]
mov ecx, ebx
call fcn.10002742
cmp esi, eax
jge 0x100ebe89
push ebx
push dword [ebx + 4]
lea ecx, [ebp - 0x18]
call fcn.1000e28d
push esi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x18]
call fcn.1002736b
push dword [eax + 4]
mov ecx, dword [edi + 0x54]
push dword [eax]
lea eax, [ebp - 0x30]
push eax
call fcn.100eb800
lea ebx, [edi + 0x44]
mov ecx, ebx
call fcn.10047e43
cmp esi, eax
jge 0x100ebec0
push ebx
push dword [ebx + 4]
lea ecx, [ebp - 0x20]
call fcn.10048b57
push esi
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
call fcn.10048ac0
push dword [eax + 4]
mov ecx, ebx
push dword [eax]
lea eax, [ebp - 0x40]
push eax
call fcn.100eb4bb
mov dword [ebp - 4], esi
xor ebx, ebx
dec esi
jns 0x100ebddf
cmp dword [ebp - 4], 0xffffffff
je 0x100ebefe
lea esi, [edi + 0x44]
mov ecx, esi
call fcn.10047e43
cmp eax, dword [ebp - 4]
jge 0x100ebeeb
mov ecx, esi
call fcn.10047e43
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, ebx
mov ecx, edi
jne 0x100ebef7
push ebx
jmp 0x100ebef9
dec eax
push eax
call fcn.100eaca2
cmp dword [ebp - 0xc], ebx
je 0x100ebf17
push ebx
mov ecx, edi
call fcn.100eabe4
push 1
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100ed3e0
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x1014d794
call fcn.101018b2
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x100ed3fa
xor eax, eax
jmp 0x100ed4b6
mov dword [ebp + 8], esi
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], esi
call fcn.100de6a3
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
mov dword [esp], str.AdFilter
call fcn.1001c185
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], esi
jle 0x100ed43d
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100ed43d
push esi
push 1
push dword [ebp - 0x10]
call fcn.100dd8c3
add esp, 0xc
push esi
lea eax, [ebp + 8]
push eax
push 0x1015417c
push esi
call fcn.100da62b
add esp, 0x10
cmp eax, esi
jl 0x100ed49a
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x100ed49a
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.1000b1e5
mov eax, dword [ebp + 8]
push dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
mov byte [ebp - 4], 2
call dword [ecx + 0xc]
push dword [ebp + 8]
mov ecx, 0x1019e6e0
call fcn.100ae71f
mov eax, dword [ebp - 0x14]
cmp eax, esi
mov byte [ebp - 4], 1
je 0x100ed49a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.100015d9
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp eax, esi
je 0x100ed4b3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
call fcn.1010198a
ret 4
Function at 0x100f880c
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push 1
mov edi, dword [esi + 4]
pop ebx
cmp edi, 2
jae 0x100f8878
test edi, edi
je 0x100f882b
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov al, byte [eax]
mov byte [ecx], al
call fcn.10107e51
and dword [eax], 0
push dword [esi + 0x40]
mov eax, 0x4000
mov ecx, edi
sar eax, cl
push eax
mov eax, dword [esi + 0x44]
add eax, edi
push ebx
push eax
call fcn.101034cc
add esp, 0x10
test eax, eax
jne 0x100f8860
mov ecx, dword [esi + 0x40]
test byte [ecx + 0xc], 0x20
je 0x100f8860
or dword [esi + 0x38], 0xffffffff
add dword [esi + 4], eax
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x44]
cmp eax, 2
mov dword [esi], ecx
jae 0x100f8878
mov dword [esi + 0x58], eax
jmp 0x100f8956
mov eax, dword [esi]
movzx ecx, byte [eax]
cmp ecx, dword [0x10169158]
jne 0x100f8953
movzx ecx, byte [eax + 1]
cmp ecx, dword [0x1016915c]
jne 0x100f8953
add dword [esi + 4], 0xfffffffe
add eax, 2
push esi
mov dword [esi], eax
call fcn.100f895a
push esi
mov edi, eax
call fcn.100f895a
pop ecx
cmp edi, 8
pop ecx
mov ebx, eax
jne 0x100f894a
test bl, 0xe0
jne 0x100f894a
push 6
pop edi
push esi
call fcn.100f895a
dec edi
pop ecx
jne 0x100f88c9
test bl, 4
je 0x100f8900
push esi
call fcn.100f895a
push esi
mov edi, eax
call fcn.100f895a
pop ecx
shl eax, 8
pop ecx
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x100f8900
push esi
call fcn.100f895a
cmp eax, 0xffffffff
pop ecx
jne 0x100f88ed
test bl, 8
je 0x100f8915
push esi
call fcn.100f895a
test eax, eax
pop ecx
je 0x100f8915
cmp eax, 0xffffffff
jmp 0x100f8903
test bl, 0x10
je 0x100f892a
push esi
call fcn.100f895a
test eax, eax
pop ecx
je 0x100f892a
cmp eax, 0xffffffff
jmp 0x100f8918
test bl, 2
je 0x100f893c
push 2
pop edi
push esi
call fcn.100f895a
dec edi
pop ecx
jne 0x100f8932
mov eax, dword [esi + 0x3c]
neg eax
sbb eax, eax
and al, 0xfd
mov dword [esi + 0x38], eax
jmp 0x100f8956
mov dword [esi + 0x38], 0xfffffffd
jmp 0x100f8956
mov dword [esi + 0x58], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x100f895a
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x3c], 0
je 0x100f896a
or eax, 0xffffffff
pop esi
ret
cmp dword [esi + 4], 0
jne 0x100f89b1
call fcn.10107e51
and dword [eax], 0
push dword [esi + 0x40]
push 0x4000
push 1
push dword [esi + 0x44]
call fcn.101034cc
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x100f89ac
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x3c], 1
or eax, 0xffffffff
test byte [ecx + 0xc], 0x20
je 0x100f89bc
mov dword [esi + 0x38], eax
pop esi
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
pop esi
ret
Function at 0x100f8d24
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100f8dc4
cmp byte [esi + 0x5c], 0x77
jne 0x100f8dc4
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push edi
test ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
je 0x100f8da8
mov edi, 0x4000
cmp dword [esi + 0x10], 0
jne 0x100f8d75
push dword [esi + 0x40]
mov eax, dword [esi + 0x48]
mov dword [esi + 0xc], eax
push edi
push 1
push eax
call fcn.10103ca7
add esp, 0x10
cmp eax, edi
jne 0x100f8da4
mov dword [esi + 0x10], edi
mov eax, dword [esi + 4]
push 0
add dword [esi + 0x64], eax
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push esi
call fcn.100f981b
mov edx, dword [esi + 0x10]
pop ecx
sub dword [esi + 0x68], edx
pop ecx
mov ecx, dword [esi + 4]
mov dword [esi + 0x38], eax
sub dword [esi + 0x64], ecx
test eax, eax
jne 0x100f8da8
test ecx, ecx
jne 0x100f8d53
jmp 0x100f8da8
or dword [esi + 0x38], 0xffffffff
push ebx
push dword [esp + 0x18]
push dword [esi + 0x4c]
call fcn.100fc5e4
add esp, 0xc
mov dword [esi + 0x4c], eax
mov eax, ebx
sub eax, dword [esi + 4]
pop edi
pop ebx
pop esi
ret
push 0xfffffffffffffffe
pop eax
pop esi
ret

Function at 0x100f8e90
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x100f8f3a
cmp byte [esi + 0x5c], 0x77
jne 0x100f8f3a
mov dword [esi + 4], ebx
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x100f8eda
push dword [esi + 0x40]
push edi
push 1
push dword [esi + 0x48]
call fcn.10103ca7
add esp, 0x10
cmp eax, edi
jne 0x100f8f24
mov eax, dword [esi + 0x48]
mov dword [esi + 0x10], 0x4000
mov dword [esi + 0xc], eax
test ebx, ebx
jne 0x100f8f2c
push dword [esp + 0x14]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push esi
call fcn.100f981b
pop ecx
mov dword [esi + 0x38], eax
pop ecx
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
test edi, edi
jne 0x100f8f05
cmp eax, 0xfffffffb
jne 0x100f8f05
and dword [esi + 0x38], edi
test ecx, ecx
jne 0x100f8f13
cmp dword [esi + 0x38], 1
je 0x100f8f13
xor ebx, ebx
jmp 0x100f8f16
push 1
pop ebx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x100f8eae
cmp eax, 1
jne 0x100f8f2c
jmp 0x100f8eae
or eax, 0xffffffff
mov dword [esi + 0x38], eax
jmp 0x100f8f3d
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
and eax, esi
jmp 0x100f8f3d
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
ret
Function at 0x100fa415
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x2c]
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x2c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
lea ecx, [edi + ecx - 0x106]
sub ebx, eax
cmp eax, ecx
jb 0x100fa49d
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.10102a40
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
mov dword [ebp + 8], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x100fa460
mov eax, dword [esi + 0x40]
mov dword [ebp + 8], edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp + 8]
mov word [eax], cx
jne 0x100fa482
add ebx, edi
mov eax, dword [esi]
cmp dword [eax + 4], 0
je 0x100fa4f8
mov ecx, dword [esi + 0x74]
push ebx
add ecx, dword [esi + 0x6c]
add ecx, dword [esi + 0x38]
push ecx
push eax
call fcn.100fa4fd
add dword [esi + 0x74], eax
mov ebx, dword [esi + 0x74]
add esp, 0xc
cmp ebx, 3
jb 0x100fa4e4
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x100fa4f8
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x100fa421
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100ff965
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1019c8c8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.100ff7c4
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.101027c0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x100ff9b4
cmp dword [ebp - 0x1c], 5
jb 0x100ff9cc
jmp 0x100ff9c8
cmp dword [ebp - 0x10], 1
jne 0x100ff9cc
cmp dword [ebp - 0x1c], 4
ja 0x100ff9c8
jne 0x100ff9cc
cmp dword [ebp - 0x18], 0
jbe 0x100ff9cc
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10171d68
call fcn.100104b2
test eax, eax
jge 0x100ff9ed
mov byte [0x1019e012], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.101018a3
add ebp, 0x78
leave
ret

Function at 0x100ffc06
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x1019faf4], 0
push esi
jne 0x100ffb74
call fcn.100ffa92
test eax, eax
je 0x100ffbb7
mov eax, dword [0x1019faf4]
cmp eax, 1
jne 0x100ffb95
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x100ffbb7
pop esi
ret
push eax
call dword [0x1019fafc]
test eax, eax
jne 0x100ffbff
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100ffbbb
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x1019faf4]
call dword [0x1019fafc]
mov edi, eax
test edi, edi
je 0x100ffbe2
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x100ffbfe
lea edi, [esi + 0xff0]
push esi
push dword [0x1019faf4]
call dword [0x1019faf8]
add esi, 0x10
cmp esi, edi
jb 0x100ffbe8
mov eax, esi
pop edi
pop esi
ret
jmp 0x100ffb61

Function at 0x101018a3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1019c8c8]
jne 0x101018ad
repz ret
jmp fcn.1010e6ec
Function at 0x101064e6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x10106513
call fcn.10107e64
mov dword [eax], esi
call fcn.10107e51
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10101afa
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x101064ef
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10106542
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10107e77
pop ecx
call fcn.10107e51
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x10106569
test al, 1
je 0x10106569
test byte [esp + 0xc], 2
je 0x10106569
call fcn.10107e64
mov dword [eax], 5
call fcn.10107e51
mov dword [eax], 0xd
jmp 0x10106539
xor eax, eax
pop esi
ret