joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414fe5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x477048]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x415028
cmp word [esi], dx
jne 0x415028
or byte [edi + eax + 0x28], 4
jmp 0x41502d
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x415180
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x415160
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41506f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4150a5
cmp eax, edx
jae 0x4150b1
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x415047
jmp 0x415180
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x41515c
cmp dword [ebp - 0x14], 0
je 0x41515c
mov eax, dword [ebx*4 + 0x477048]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x415134
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4150fd
mov word [esi], cx
jmp 0x415130
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x477048]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x477048]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x477048]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x415180
pop ebx
cmp word [ebp - 4], bx
jne 0x415145
cmp esi, dword [ebp + 0xc]
jne 0x415145
mov word [esi], bx
jmp 0x41517d
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00415a19
add esp, 0x10
cmp word [ebp - 4], bx
je 0x415180
push 0xd
jmp 0x415179
mov ecx, dword [ebx*4 + 0x477048]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x415177
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x415180
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0x10c1f4e6
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
pushal
call 0x10c1f4ec
pop ebp
sub ebp, 0x10
sub ebp, 0xc1f4dc
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10c1f510
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10c1f519
mov eax, 0xc1f4dc
add eax, ebp
add eax, 0x63
mov ecx, 0x5b5
mov edx, 0x984a8eb5
xor byte [eax], dl
inc eax
dec ecx
jne 0x10c1f530
jmp 0x10c1f543
js 0x10c1f584
cmp al, 0x89
mov ch, 0xb5
mov ch, 0x34
je 0x10c1f59b
mov ch, 0xb5
mov ch, 0xb6
js 0x10c1f561
mov ch, 0xb5
mov dh, 0x78
or eax, 0xb5b5b5b3
mov bl, 0xb5
mov ch, 0xb5
mov ch, 0xb5
mov ch, 0xf
popfd
mov ch, 0xb5
mov ch, 0x42
push edi
setge byte [ebp + 0x5742b5b5]
mov dh, 0x7d
xor al, 0xb9
mov ch, 0xb5
mov ch, 0xb6
jo 0x10c1f54f
in eax, 0xdd
jge 0x10c1f5cf
xchg esp, eax
mov ch, 0xdd
movsb byte es:[edi], byte [esi]
xchg ebp, eax
adc eax, 0x9199b4b5
fst st(0)
scasb al, byte es:[edi]
xor esp, dword [edx]
pop ebp
mov al, 0xb5
mov ch, 0xb5
pop esp
wait
mov ch, 0xb5
mov ch, 0xe0
pop ecx
xor byte ds:[ebp + 0x3eb5b5b5], bh
and byte [ecx + 0x3eb5b5b5], bh
cmp byte [ebp + 0x74b5b5b5], ah
mov ch, 0x74
pop esp
mov bh, 0x84
mov bh, 0x36
ja 0x10c1f555
cld
mov edx, 0x4a4a4130
dec edx
cdq
xchg ecx, eax
cmp cl, dl
xchg ecx, eax
mov cl, 0x77
mov ecx, 0x91393eb5
mov cl, 0xb5
mov ch, 0xb5
fnstsw word [ebp + 0x61]
xchg esp, eax
mov ch, 0xdd
movsb byte es:[edi], byte [esi]
xchg ebp, eax
adc eax, 0x9199b4b5
in al, 0x5d
mov al, 0xb5
mov ch, 0xb5
pop esp
invalid
Function at 0x487118
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004263e4
cmp ebx, dword [ebp - 8]
jge 0x48717b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042679c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042679c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004267c8
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x487141
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x487184
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004263e4
cmp ebx, dword [ebp - 8]
jge 0x4871e7
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042679c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042679c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004267c8
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4871ad
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x48f168
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404628
xor eax, eax
push ebp
push 0x48f1bc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x48f1a6
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404638
push eax
push 0x48f1c8
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f1c3
lea eax, [ebp - 4]
call fcn.00404178
ret
Function at 0x497044
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffeec
push 0
push 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push pe_nt_image_headers32
lea eax, [esp + 0x2c]
push eax
push 0x4970a4
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x497084
mov eax, dword [esp + 8]
xor edx, edx
mov dword [esp], eax
mov dword [esp + 4], edx
jmp 0x497093
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x114
ret

Function at 0x4972e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404628
mov eax, dword [ebp - 8]
call fcn.00404628
xor eax, eax
push ebp
push 0x497441
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x497397
mov ebx, 1
lea esi, [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.00404438
push eax
mov eax, ebx
dec eax
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 4]
mov al, byte [eax + edx]
push eax
mov eax, dword [ebp - 4]
call fcn.00404438
pop edx
xor dl, al
xor dl, bl
mov byte [esi], dl
inc ebx
inc esi
cmp ebx, 0xa
jne 0x497330
mov eax, dword [ebp - 4]
call fcn.00404438
mov esi, eax
test esi, esi
jle 0x497397
mov ebx, 1
mov eax, dword [ebp - 4]
call fcn.00404438
sub eax, ebx
mov edx, dword [ebp - 4]
mov cl, byte [edx + eax]
mov eax, ebx
dec eax
push ecx
mov ecx, 9
cdq
idiv ecx
pop ecx
xor byte [ebp + edx - 0x11], cl
inc ebx
dec esi
jne 0x497372
cmp dword [ebp - 8], 0
je 0x4973d6
mov ebx, 1
lea esi, [ebp - 0x11]
mov eax, dword [ebp - 8]
call fcn.00404438
push eax
mov eax, ebx
dec eax
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 8]
mov al, byte [eax + edx]
xor al, byte [esi]
push eax
mov eax, dword [ebp - 8]
call fcn.00404438
pop edx
xor dl, al
xor dl, bl
mov byte [esi], dl
inc ebx
inc esi
cmp ebx, 0xa
jne 0x4973a5
lea eax, [ebp - 0x18]
call fcn.00404178
mov ebx, 9
lea esi, [ebp - 0x11]
lea eax, [ebp - 0x1c]
mov dl, byte [esi]
call fcn.00404360
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00404440
inc esi
dec ebx
jne 0x4973e6
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.004971a4
mov edx, dword [ebp - 0x20]
mov eax, edi
mov ecx, 0xff
call fcn.00404414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x497448
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040419c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040419c
ret
Function at 0x497f48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404628
mov eax, dword [ebp - 8]
call fcn.00404628
mov eax, dword [ebp - 0xc]
call fcn.00404628
xor eax, eax
push ebp
push 0x4980e8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x497ffe
mov ebx, 1
lea esi, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00404438
push eax
mov eax, ebx
dec eax
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 4]
mov al, byte [eax + edx]
push eax
mov eax, dword [ebp - 4]
call fcn.00404438
pop edx
xor dl, al
xor dl, bl
mov byte [esi], dl
inc ebx
inc esi
cmp ebx, 0xd
jne 0x497f99
mov eax, dword [ebp - 4]
call fcn.00404438
mov esi, eax
test esi, esi
jle 0x497ffe
mov ebx, 1
mov eax, dword [ebp - 4]
call fcn.00404438
sub eax, ebx
mov edx, dword [ebp - 4]
mov cl, byte [edx + eax]
mov eax, ebx
dec eax
mov edi, 0xc
cdq
idiv edi
xor byte [ebp + edx - 0x1c], cl
inc ebx
dec esi
jne 0x497fdb
cmp dword [ebp - 8], 0
je 0x49803d
mov ebx, 1
lea esi, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00404438
push eax
mov eax, ebx
dec eax
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 8]
mov al, byte [eax + edx]
xor al, byte [esi]
push eax
mov eax, dword [ebp - 8]
call fcn.00404438
pop edx
xor dl, al
xor dl, bl
mov byte [esi], dl
inc ebx
inc esi
cmp ebx, 0xd
jne 0x49800c
cmp dword [ebp - 0xc], 0
je 0x49807c
mov ebx, 1
lea esi, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00404438
push eax
mov eax, ebx
dec eax
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 0xc]
mov al, byte [eax + edx]
xor al, byte [esi]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404438
pop edx
xor dl, al
xor dl, bl
mov byte [esi], dl
inc ebx
inc esi
cmp ebx, 0xd
jne 0x49804b
lea eax, [ebp - 0x10]
call fcn.00404178
mov ebx, 0xc
lea esi, [ebp - 0x1c]
lea eax, [ebp - 0x20]
mov dl, byte [esi]
call fcn.00404360
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
call fcn.00404440
inc esi
dec ebx
jne 0x49808c
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.004971a4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
mov ecx, 0xff
call fcn.00404414
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4980ef
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040419c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040419c
ret
Function at 0x4983d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4984a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov ecx, 4
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
inc eax
call fcn.00402790
mov dword [ebp - 0xc], eax
xor edi, edi
push ebp
push 0x498485
push dword fs:[edi]
mov dword fs:[edi], esp
cmp dword [ebp - 8], 0
jle 0x498431
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov cl, byte [ebp - 8]
mov edx, dword [ebp - 8]
dec edx
test edx, edx
jl 0x49844c
inc edx
xor eax, eax
mov esi, dword [ebp - 0xc]
add esi, eax
xor byte [esi], cl
mov cl, byte [esi]
inc eax
dec edx
jne 0x49843f
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004093c0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004041cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49848c
mov edx, dword [ebp - 8]
inc edx
mov eax, dword [ebp - 0xc]
call fcn.004027b0
ret
Function at 0x404ed5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40a140
cmp edx, dword [eax]
je 0x404ef7
add eax, 8
inc ecx
cmp eax, 0x40a1d0
jl 0x404ee8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40a140]
jne 0x405025
mov eax, dword [0x40cd0c]
cmp eax, 1
je 0x404fff
test eax, eax
jne 0x404f28
cmp dword [0x408064], 1
je 0x404fff
cmp edx, 0xfc
je 0x405025
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404f5f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004061b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004062a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404fa2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004062a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4073f8
push edi
call fcn.004063b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004061b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004061c0
lea eax, [ebp - 0xa0]
push 0x4073d8
push eax
call fcn.004061c0
push dword [esi + 0x40a144]
lea eax, [ebp - 0xa0]
push eax
call fcn.004061c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040631b
add esp, 0x2c
pop edi
jmp 0x405025
lea eax, [ebp + 8]
lea esi, [esi + 0x40a144]
push 0
push eax
push dword [esi]
call fcn.004062a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1009b454
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1014fef1
call fcn.10147df8
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.1008f6dc
xor ebx, ebx
mov dword [esi], vtable.ScObjects::Thread.0
push 0x10
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
je 0x1009b49b
mov dword [eax], vtable.ScObjects::ThreadData.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x1009b49d
mov eax, ebx
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push 0x1009b680
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
cmp ecx, 0xffffffff
jne 0x1009b4d0
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0x20
mov dword [esi + 0xc], ebx
mov dword [eax + 4], ebx
jmp 0x1009b4dc
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov dword [eax + 4], ecx
mov eax, esi
call fcn.10147dc1
ret

Function at 0x1009b790
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0x10], 0
jne 0x1009b7a2
mov eax, dword [ecx + 8]
push dword [eax + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x100a1d60
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x2c
mov eax, 0x10150bd0
call fcn.10147e2c
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x38], esi
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], edi
call fcn.1009b955
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], 1
call fcn.100a1e88
test eax, eax
jne 0x100a1da4
push 0xffffffffffffffff
push 0x10159980
mov ecx, esi
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
jmp 0x100a1dea
lea ecx, [ebp - 0x20]
push ecx
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ecx, esi
push 0xffffffffffffffff
push 0x10159980
test eax, eax
je 0x100a1d9d
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
movzx eax, byte [ebp + edi - 0x20]
push eax
lea eax, [ebp - 0x30]
push 0x10165c80
push eax
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea eax, [ebp - 0x30]
push eax
push esi
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
add esp, 0x14
inc edi
cmp edi, 0x10
jb 0x100a1dc3
mov eax, esi
call fcn.10147dd6
ret
Function at 0x100a1e88
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push esi
mov esi, dword [0x107d4410]
test esi, esi
jne 0x100a1edc
push edi
push esi
push 1
push esi
push esi
mov edi, 0x107d4410
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100a1ed5
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x100a1ed5
push 8
push 1
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100a1ed5
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [0x107d4410], esi
jmp 0x100a1edb
mov esi, dword [0x107d4410]
pop edi
mov eax, esi
pop esi
ret
Function at 0x100afdae
Capabilities:
Create mailslot

Disassembly:
push 0x14
mov eax, 0x10152d8e
call fcn.10147df8
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [0x10191e8c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100ab64a
xor ebx, ebx
mov dword [esi], vtable.WinInterAppStream.0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.1009b955
lea eax, [esi + 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [esi + 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
pop ecx
pop ecx
push eax
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
push 0xc
lea edi, [esi + 0x56]
push ebx
push edi
call sub.VCRUNTIME140.dll_memset
push edi
mov ecx, ebx
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
add esp, 0x18
test al, al
je 0x100afe21
cmp dword [esi + 0x5a], ebx
cmovne ecx, edi
push ecx
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_CreateMailslotA]
lea ecx, [ebp - 0x20]
mov dword [esi + 0x52], eax
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
mov eax, esi
call fcn.10147dc1
ret 8

Function at 0x100affb0
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x101509dd
call fcn.10147df8
mov esi, ecx
push esi
lea ecx, [ebp - 0x1c]
call fcn.1008f6a9
and dword [ebp - 4], 0
lea eax, [esi + 0x30]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1009b803
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
push dword [eax + 8]
push dword [eax + 4]
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
push 0
xor ecx, ecx
lea eax, [esi + 0x56]
cmp dword [esi + 0x5a], ecx
push 0x80
push 3
cmovne ecx, eax
push ecx
push ebx
push 0x40000000
push dword [ebp - 0x28]
call dword [sym.imp.kernel32.dll_CreateFileA]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x100b004b
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push 0
push ecx
push dword [edi + 8]
push dword [edi + 4]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x100b004b
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi + 8]
je 0x100b004d
xor bl, bl
lea ecx, [ebp - 0x2c]
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea ecx, [ebp - 0x1c]
call sym.rt3d.dll_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
mov al, bl
call fcn.10147dc1
ret 8
Function at 0x100b50b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100b50bf
pop dword [ebp - 0x48]
mov eax, 0x100b50bf
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x56375fc
add dword [ebp - 0x58], 0x48eecf4f
mov dword [ebp - 0x54], 0x73336429
add dword [ebp - 0x54], 0xbeffe81c
mov dword [ebp - 0x50], 0xda86385a
sub dword [ebp - 0x50], 0x8e39f42c
mov dword [ebp - 0x4c], 0x416779ca
add dword [ebp - 0x4c], 0xbe988636
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x6e8d4311
add dword [ebp - 0x58], 0x5e52645
mov dword [ebp - 0x54], 0x6d94b44d
sub dword [ebp - 0x54], 0x2c2852d8
mov dword [ebp - 0x50], 0x9df572c5
sub dword [ebp - 0x50], 0x3a860659
mov dword [ebp - 0x4c], 0x3359b163
sub dword [ebp - 0x4c], 0x3359b163
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xc0559ee2
sub eax, 0xb0404c46
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x71cb9
push 0
call eax
mov ecx, 0x7d5a6dde
sub ecx, 0x7d5a29e0
mov esi, eax
mov edx, 0x8ff03aab
sub edx, 0x7f7176ab
add edx, dword [ebp - 0x48]
mov ebx, 0x8d323a01
sub ebx, 0x460f4765
mov dword [ebp - 0x34], 0x1339029e
mov edi, dword [edx]
xor dword [ebp - 0x3c], 0xb4e2a855
xor edi, ebx
sub dword [ebp - 0x1c], 0x716defb7
mov dword [esi], edi
sub dword [ebp - 0x24], edx
add esi, 4
add edx, 0x563b4e9b
add edx, 0xa9c4b169
loop 0x100b51d7
add eax, 0x1137ef7
sub eax, 0x1127c2c
xor ebx, ebx
add ebx, eax
add eax, 0x2e283b77
sub eax, 0x2e283b72
mov ecx, 0x949263bd
sub ecx, 0x849263bd
add ecx, dword [ebp - 0x48]
call ebx
leave
ret