joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc7d7
Capabilities:
Hide graphical window

Disassembly:
push 0x9c
mov eax, 0x537604
call fcn.005078a4
mov edi, ecx
mov dword [ebp - 0x98], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x10], eax
mov dword [eax + 0x598], ebx
cmp dword [edi + 4], ebx
jne 0x4dc871
lea eax, [ebp - 0xa8]
push eax
call fcn.004dc3ec
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0xa8]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40000000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0049a266
mov edi, dword [ebp - 0x98]
mov ecx, edi
push eax
call fcn.0049f68a
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.004b8077
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00499e1d
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00496f55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.004967ad
test bl, bl
je 0x4dc8ae
mov eax, dword [edi + 0x10]
add eax, 0x588
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [edi + 0x10]
call fcn.004dc91d
test al, al
je 0x4dc8c1
push 0x544e4c
jmp 0x4dc8c6
push str.yyyy_MM_dd
push 0
push 0x1032
push dword [edi + 4]
call esi
mov eax, dword [edi + 0x10]
mov ebx, 0x588
add eax, ebx
push 0x10
push eax
lea eax, [edi + 0x1a]
push eax
call fcn.00506be0
mov eax, dword [edi + 0x10]
add esp, 0xc
add eax, ebx
push eax
push 0
push 0x1002
push dword [edi + 4]
call esi
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.00507853
ret 4

Function at 0x4dce2f
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x294]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x4dce5b
xor eax, eax
jmp 0x4dced8
push 0xfe
lea eax, [ebp - 0x103]
mov byte [ebp - 0x104], 0
push 0
push eax
call fcn.00507230
add esp, 0xc
lea eax, [ebp - 0x104]
push 0xff
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp - 0x104]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4dce57
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 0x298]
push eax
call fcn.00506be0
mov ecx, dword [ebp - 0x298]
add esp, 0xc
movzx eax, cl
shl eax, 8
movzx ecx, ch
add eax, ecx
movzx ecx, byte [ebp - 0x296]
shl eax, 8
add eax, ecx
movzx ecx, byte [ebp - 0x295]
shl eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005026a3
mov esp, ebp
pop ebp
ret
Function at 0x4dcfd5
Capabilities:
Hide graphical window

Disassembly:
push 0xa4
mov eax, 0x537637
call fcn.005078a4
mov edi, ecx
mov dword [ebp - 0x98], edi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 0x10], eax
mov dword [eax + 0x590], ebx
cmp dword [edi + 4], ebx
jne 0x4dd092
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 8
push eax
mov dword [ebp - 0x9c], 0x800
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
je 0x4dd06a
lea eax, [ebp - 0xb0]
mov ecx, edi
push eax
call fcn.004dcbb4
mov ecx, dword [edi + 0x10]
lea esi, [ebp - 0xb0]
push ebx
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
push ebx
movsd dword es:[edi], dword [esi]
push 0x40030000
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0049a266
mov edi, dword [ebp - 0x98]
mov ecx, edi
push eax
call fcn.0049f68a
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.004b8077
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00499e1d
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00496f55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
mov bl, al
call fcn.004967ad
test bl, bl
je 0x4dd0ce
call fcn.004dce2f
mov ecx, dword [edi + 0x10]
mov dword [ecx + 0x588], eax
mov eax, dword [edi + 0x10]
push dword [eax + 0x588]
push 0
push 0x465
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
call fcn.00507853
ret 4

Function at 0x4decf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004bc514

Function at 0x4decf9
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x6c0
jmp method.DuiLib::CMenuUI.virtual_324
Function at 0x4dfc8e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
push edi
and dword [ebx + 0x770], 0
mov edi, dword [ebp + 0x18]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x76c], ecx
mov dword [ebx + 0x774], eax
test ecx, ecx
jne 0x4dfcf6
call fcn.004dfa75
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
test esi, esi
je 0x4dfcf6
call fcn.004dfa75
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
lea esi, [ebx + 0x10]
call fcn.004dfa75
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov ecx, dword [ebx + 0x76c]
test ecx, ecx
jne 0x4dfd13
mov ecx, edi
jmp 0x4dfd1a
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0049a266
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.00496657
push 0
sub esp, 0x10
mov esi, eax
mov edi, esp
mov ecx, ebx
push 0x88
movsd dword es:[edi], dword [esi]
push SysReAllocString
push 0
push dword [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0049f68a
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x4dfd5d
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x4dfd58
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005026a3
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4e5a66
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, dword [ebp + 0xc]
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov esi, eax
cmp edi, 0x21
jb 0x4e5ab4
cmp edi, 0x28
jbe 0x4e5aae
lea eax, [edi - 0x2d]
cmp eax, 1
ja 0x4e5ab4
or esi, 0x100
cmp dword [ebp + 0x10], 0
je 0x4e5ac0
or esi, 0x1000000
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00507230
add esp, 0xc
shl esi, 0x10
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.004966aa
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005026a3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e5dba
Capabilities:
Hide graphical window

Disassembly:
push 0x98
mov eax, 0x537f63
call fcn.005078a4
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
test eax, eax
je 0x4e5eca
lea eax, [ebp - 0xa4]
push eax
call fcn.004e5550
mov ecx, dword [ebx + 0x10]
lea esi, [ebp - 0xa4]
xor eax, eax
push eax
sub esp, 0x10
mov edi, esp
push eax
movsd dword es:[edi], dword [esi]
push 0x40000080
push eax
mov eax, dword [ecx]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0049a266
push eax
mov ecx, ebx
call fcn.0049f68a
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4e5eca
mov esi, dword [ebx + 0x10]
mov ecx, esi
call fcn.004b8077
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00499e1d
push 1
push dword [eax]
push 0x30
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x10]
movzx eax, word [ecx + 0x7a6]
push eax
movzx eax, word [ecx + 0x7a4]
mov ecx, ebx
push eax
call fcn.004e62f5
lea eax, [ebp - 0x94]
mov ecx, ebx
push eax
call fcn.004e58b4
mov ecx, dword [ebx + 0x10]
and dword [ebp - 4], 0
add ecx, 0x1cc
push eax
call fcn.00496826
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004967ad
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10c]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebx + 0x18], 1
call fcn.00507853
ret 4
Function at 0x4eafa0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004eafb0

Function at 0x4eb230
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4eb23c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004eb250
Function at 0x525ab9
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x58e700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00512000
mov dword [ebp - 0x14], eax
cmp dword [0x595194], esi
jne 0x525bac
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x525b39
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x525c8c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x525c8c
push 0x560ea0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x525c8c
push eax
call ebx
push 0x560eac
push edi
mov dword [0x595194], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x560ebc
push edi
mov dword [0x595198], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x59519c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5951a4], eax
test eax, eax
je 0x525ba9
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5951a0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x525bd1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x525bc4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x525be6
push 4
pop eax
jmp 0x525c8e
cmp dword [ebp - 0x14], esi
je 0x525be6
push dword [0x595194]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x525bcb
mov eax, dword [0x5951a0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x525c44
cmp dword [0x5951a4], edi
je 0x525c44
push eax
call ebx
push dword [0x5951a4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x525c44
test eax, eax
je 0x525c44
call ecx
test eax, eax
je 0x525c39
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x525c39
test byte [ebp - 8], 1
jne 0x525c44
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x525c74
mov eax, dword [0x595198]
cmp eax, edi
je 0x525c71
push eax
call ebx
test eax, eax
je 0x525c71
call eax
mov esi, eax
test esi, esi
je 0x525c71
mov eax, dword [0x59519c]
cmp eax, edi
je 0x525c71
push eax
call ebx
test eax, eax
je 0x525c71
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x595194]
call ebx
test eax, eax
je 0x525c8c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x525c8e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005026a3
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x63535456
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x55aa7750
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10019832
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10019854
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10019904
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10019877
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10019879
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100198f5
jg 0x1001988c
test esi, esi
je 0x100198f5
test eax, eax
jl 0x100198cc
jg 0x10019896
test ebp, ebp
je 0x100198cc
cmp edi, eax
jg 0x100198a6
jl 0x100198a0
cmp esi, ebp
jae 0x100198a6
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100198d0
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100198f5
jg 0x100198da
test esi, esi
je 0x100198f5
cmp dword [ebx + 0x4c], 0
je 0x100198f5
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1001a978
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001a987
pop dword [ebp - 0x24]
mov eax, 0x86ad3acb
add eax, 0x89546ebc
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3c83e
push 0
mov eax, 0xe5399bf1
sub eax, 0xd537ba8d
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x417a88f
add ecx, 0xfbe8ad2a
xor edx, edx
add edx, eax
mov esi, 0x10043e00
add esi, dword [ebp - 0x24]
mov ebx, 0xbeafd416
sub ebx, 0x5682b24a
xor dword [ebp - 0xc], eax
mov edi, dword [esi]
sub dword [ebp - 0x18], 0x1d1a21ff
sub edi, ebx
sub dword [ebp - 8], 0x2aa4d52c
mov dword [edx], edi
xor dword [ebp - 0x10], ebx
add edx, 4
add esi, 0x383bdeb7
add esi, 0xc7c4214d
loop 0x1001a9e2
add eax, 0xdbe2fc0f
sub eax, 0xdbe1b258
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10002370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000237f
pop dword [ebp - 0x28]
mov eax, 0xc07c89f8
add eax, 0x4f839987
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x2042a364
add dword [ebp - 0x38], 0x2e0fa1e7
mov dword [ebp - 0x34], 0x2222adca
add dword [ebp - 0x34], 0x10109e7b
mov dword [ebp - 0x30], 0x42d62c6a
add dword [ebp - 0x30], 0x97617c4
mov dword [ebp - 0x2c], 0x30d36b8e
add dword [ebp - 0x2c], 0xcf2c9472
lea eax, [ebp - 0x38]
push eax
mov eax, 0xd2bfc150
add eax, 0x3d422f54
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x9eb0611f
add dword [ebp - 0x38], 0xd5c20837
mov dword [ebp - 0x34], 0xeb4b6028
sub dword [ebp - 0x34], 0xa9defeb3
mov dword [ebp - 0x30], 0x437dd724
add dword [ebp - 0x30], 0x1ff19548
mov dword [ebp - 0x2c], 0xdd2eb36f
add dword [ebp - 0x2c], 0x22d14c91
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x8862b854
add eax, 0x879f3848
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x37b6d
push 0
call eax
mov ecx, 0xc6fa64ab
add ecx, 0x3905d51c
mov edx, eax
mov esi, 0x39d045a6
sub esi, 0x29cdaba6
add esi, dword [ebp - 0x28]
mov ebx, 0xcf5a5375
sub ebx, 0xf8a53ad6
xor dword [ebp - 8], 0xcb0f0920
mov edi, dword [esi]
sub dword [ebp - 0x10], 0xc58d529
add edi, ebx
sub dword [ebp - 0x18], 0xf091fc6d
mov dword [edx], edi
add edx, 0x3f997038
sub edx, 0x3f997034
add esi, 0xd6fc8812
add esi, 0x290377f2
loop 0x100024a1
add eax, 0x5e2d5f9d
add eax, 0xa1d37a52
mov ebx, eax
add eax, 0xfa45fe5a
sub eax, 0xfa45fe55
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10002370
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10002370
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.10002370
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10002370
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10002370
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c