joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100090e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 4], edx
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], eax
mov ebx, dword [eax + 0xc]
push edi
test ebx, ebx
je 0x10009137
mov al, byte [edx]
mov edi, edx
test al, al
je 0x10009120
movzx eax, al
lea edi, [edi + 1]
movzx ecx, byte [eax + 0x100f67d0]
lea eax, [esi*8]
xor ecx, eax
mov al, byte [edi]
xor esi, ecx
test al, al
jne 0x10009102
mov ecx, dword [ebp - 8]
mov eax, esi
xor edx, edx
div dword [ecx]
mov esi, edx
mov edx, dword [ebp - 4]
mov edi, dword [ebx + esi*8 + 4]
mov ecx, dword [ebx + esi*8]
jmp 0x1000913d
mov edi, dword [eax + 8]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [eax], esi
test ecx, ecx
je 0x1000919d
mov esi, dword [edi + 0xc]
dec ecx
mov dword [ebp + 8], ecx
mov bl, byte [esi]
test bl, bl
je 0x10009179
sub esi, dword [ebp - 4]
mov al, bl
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x100f67d0]
cmp al, byte [ecx + 0x100f67d0]
jne 0x10009179
mov al, byte [esi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x10009158
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x100f67d0]
movzx eax, bl
movzx eax, byte [eax + 0x100f67d0]
sub eax, ecx
je 0x100091a6
mov ecx, dword [ebp + 8]
mov edi, dword [edi]
mov edx, dword [ebp - 4]
test ecx, ecx
jne 0x10009146
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e550
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], ebx
cmp edx, dword [ebx + 0x2c]
jbe 0x1001e58c
push 0x100f4b6c
push 0xe96c
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.10007190
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
push 0
push eax
call fcn.100174f0
add esp, 8
test eax, eax
jne 0x1001e718
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
movzx eax, word [esi + 0x12]
movzx edi, byte [esi + 6]
mov edx, eax
mov dword [esp + 0x1c], edi
cmp cx, ax
jae 0x1001e661
nop dword [eax + eax]
mov eax, dword [esi + 0x40]
movzx edi, byte [eax + ecx*2 + 1]
movzx eax, byte [eax + ecx*2]
shl eax, 8
or edi, eax
movzx eax, word [esi + 0x14]
and edi, eax
add edi, dword [esi + 0x38]
cmp byte [esi + 5], 0
jne 0x1001e627
movzx edx, byte [edi]
mov ecx, ebx
movzx eax, byte [edi + 1]
push dword [ebp + 0xc]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
push 1
call fcn.1001e550
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1001e70e
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.1001be60
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1001e70e
mov ecx, dword [esp + 0x14]
movzx eax, word [esi + 0x12]
inc ecx
mov ebx, dword [esp + 0x18]
mov edx, eax
mov dword [esp + 0x14], ecx
cmp ecx, eax
jl 0x1001e5d0
mov edi, dword [esp + 0x1c]
cmp byte [esi + 5], 0
movzx eax, dx
jne 0x1001e6a5
mov ecx, dword [esi + 0x38]
push dword [ebp + 0xc]
add ecx, edi
push 1
movzx edx, byte [ecx + 8]
movzx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xa]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xb]
shl edx, 8
mov ecx, ebx
or edx, eax
call fcn.1001e550
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1001e70e
jmp 0x1001e6ae
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1001e6ae
add dword [ecx], eax
cmp dword [ebp + 8], 0
je 0x1001e6d7
push dword [esi + 0x48]
mov ecx, dword [esi + 0x34]
mov edx, esi
call fcn.1001b9f0
mov ecx, dword [esi + 0x44]
add esp, 4
mov ebx, eax
call fcn.10012590
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x44]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x1001e6f2
call fcn.10012c80
jmp 0x1001e6f7
call fcn.10012970
mov ebx, eax
test ebx, ebx
jne 0x1001e70e
mov eax, dword [esi + 0x38]
mov ecx, esi
movzx edx, byte [eax + edi]
or edx, 8
call fcn.10017410
mov ecx, dword [esi + 0x44]
call fcn.10012590
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.10004a20
mov esi, eax
add esp, 8
test esi, esi
jne 0x10031570
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x100ffbec], 0
mov edi, dword [ebp + 8]
je 0x100315a3
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x100073d0
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.100c29d7
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x100315b0
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x100315c9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], edx
xor eax, eax
mov edx, ecx
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edi
cmp dword [edx + 0x14], eax
jle 0x10041c7b
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edi
xor esi, 1
cmp edi, 2
cmovge esi, edi
test ebx, ebx
je 0x10041c34
mov eax, dword [edx + 0x10]
mov ecx, esi
add ecx, ecx
mov edx, dword [eax + ecx*8]
mov ecx, dword [ebp + 8]
mov bl, byte [ecx]
test bl, bl
je 0x10041c16
sub ecx, edx
mov al, bl
mov dword [ebp - 0x10], ecx
mov edi, ecx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x100f67d0]
cmp al, byte [ecx + 0x100f67d0]
jne 0x10041c13
mov al, byte [edi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x10041bf2
mov edi, dword [ebp - 8]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x100f67d0]
movzx eax, bl
mov ebx, dword [ebp + 8]
movzx eax, byte [eax + 0x100f67d0]
sub eax, ecx
jne 0x10041c66
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
add esi, esi
push eax
mov eax, dword [edx + 0x10]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax + esi*8 + 0xc]
add ecx, 8
call fcn.100090e0
add esp, 4
test eax, eax
je 0x10041c5f
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10041c79
jmp 0x10041c69
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x10041c69
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
inc edi
mov dword [ebp - 8], edi
cmp edi, dword [edx + 0x14]
jl 0x10041bc7
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10041d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0xc], edx
push edi
xor ecx, ecx
xor edi, edi
mov dword [ebp - 4], ecx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x10], edx
test edx, edx
jle 0x10041dfd
mov edx, dword [eax + 0x10]
push ebx
mov dword [ebp - 0x14], edx
push esi
nop dword [eax]
mov ecx, dword [ebp + 8]
mov eax, edi
xor eax, 1
cmp edi, 2
cmovge eax, edi
add eax, eax
mov esi, dword [edx + eax*8 + 0xc]
mov dword [ebp - 8], esi
test ecx, ecx
je 0x10041dbc
mov bl, byte [ecx]
mov edx, dword [edx + eax*8]
test bl, bl
je 0x10041da4
mov esi, ecx
mov al, bl
sub esi, edx
nop word [eax + eax]
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x100f67d0]
cmp al, byte [ecx + 0x100f67d0]
jne 0x10041da1
mov al, byte [esi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x10041d80
mov esi, dword [ebp - 8]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x100f67d0]
movzx eax, bl
movzx eax, byte [eax + 0x100f67d0]
sub eax, ecx
jne 0x10041dec
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea ecx, [esi + 0x18]
call fcn.100090e0
add esp, 4
test eax, eax
je 0x10041de5
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x10041def
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x10041def
mov ecx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp - 0x10]
jge 0x10041ddc
mov edx, dword [ebp - 0x14]
jmp 0x10041d50
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10084080
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 4
mov edi, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0x67452301
mov dword [ebp - 0x20], 0xefcdab89
mov dword [ebp - 0x1c], 0x98badcfe
mov dword [ebp - 0x18], 0x10325476
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
call fcn.100b1b10
mov ebx, eax
lea eax, [ebp - 0x24]
push 0x10
push eax
push ebx
lea esi, [ebx + 0x10]
call fcn.100bfbc0
lea eax, [ebp - 0x14]
add esp, 0xc
cmp edi, eax
je 0x1008411d
mov eax, dword [edi]
test eax, eax
je 0x10084113
mov ecx, dword [edi + 8]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10084109
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100841d9
mov eax, edx
push ecx
push eax
call fcn.100bd5f4
add esp, 8
mov dword [edi], ebx
mov dword [edi + 4], esi
mov dword [edi + 8], esi
jmp 0x1008414e
test ebx, ebx
je 0x1008414e
sub esi, ebx
and esi, 0xfffffffc
cmp esi, 0x1000
jb 0x10084144
mov ecx, dword [ebx - 4]
add esi, 0x23
sub ebx, ecx
lea eax, [ebx - 4]
cmp eax, 0x1f
ja 0x100841d9
mov ebx, ecx
push esi
push ebx
call fcn.100bd5f4
add esp, 8
mov eax, dword [edi + 0xc]
test eax, eax
je 0x10084165
push eax
call fcn.100bd2a5
add esp, 4
mov dword [edi + 0xc], 0
sub esp, 0x18
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.100b1340
mov ecx, edi
call fcn.100841e0
mov ebx, dword [edi + 0x10]
xor esi, esi
shr ebx, 6
test ebx, ebx
je 0x10084193
push esi
mov ecx, edi
call fcn.100843d0
inc esi
cmp esi, ebx
jl 0x10084186
mov esi, dword [ebp - 8]
mov ecx, edi
push esi
call fcn.100846f0
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x100841ce
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100841c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100841d9
push edx
push ecx
call fcn.100bd5f4
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
call fcn.100c93fd
int3
Function at 0x10086540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100ff008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x118], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x114], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10086590
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.100b1950
push 0x100f965c
lea ecx, [ebp - 0x128]
call fcn.100b11c0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x114]
cmp edx, 0x10
jb 0x10086627
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1008661d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10086638
push edx
push ecx
call fcn.100bd5f4
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bd09a
mov esp, ebp
pop ebp
ret
call fcn.100c93fd
int3
Function at 0x10086fb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100ff008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x118], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x114], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10087002
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.100b1950
push 0x100f965c
lea ecx, [ebp - 0x128]
call fcn.100b11c0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x114]
cmp edx, 0x10
jb 0x10087099
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1008708f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100870aa
push edx
push ecx
call fcn.100bd5f4
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bd09a
mov esp, ebp
pop ebp
ret
call fcn.100c93fd
int3
Function at 0x100871d0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ff008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x1c]
mov eax, edx
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 1
jb 0x10087207
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x18], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
mov word [eax + ecx], 0
jmp 0x1008721c
push 0
push 1
mov byte [ebp - 0x28], 0
lea ecx, [ebp + 8]
push dword [ebp - 0x28]
push 1
call fcn.100b2880
mov edx, dword [ebp + 0x34]
mov eax, edx
mov ecx, dword [ebp + 0x30]
sub eax, ecx
cmp eax, 1
jb 0x10087243
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov word [eax + ecx], 0
jmp 0x10087258
push 0
push 1
mov byte [ebp - 0x28], 0
lea ecx, [ebp + 0x20]
push dword [ebp - 0x28]
push 1
call fcn.100b2880
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
xorps xmm0, xmm0
cmp dword [ebp + 0x34], 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, 0x614
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
movlpd qword [ebp - 0x12], xmm0
mov dword [ebp - 0xa], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
cmp edx, 0x10
jb 0x100872d7
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100872cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008732a
push edx
push ecx
call fcn.100bd5f4
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x10087319
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1008730f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008732a
push edx
push ecx
call fcn.100bd5f4
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bd09a
mov esp, ebp
pop ebp
ret
call fcn.100c93fd
int3
Function at 0x10087330
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ff008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x1c]
mov eax, edx
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 1
jb 0x10087367
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x18], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
mov word [eax + ecx], 0
jmp 0x1008737c
push 0
push 1
mov byte [ebp - 0x28], 0
lea ecx, [ebp + 8]
push dword [ebp - 0x28]
push 1
call fcn.100b2880
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, 0x215
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x18], 0x100f0188
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
cmp edx, 0x10
jb 0x100873e5
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100873db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100873f6
push edx
push ecx
call fcn.100bd5f4
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bd09a
mov esp, ebp
pop ebp
ret
call fcn.100c93fd
int3
Function at 0x10087400
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100ff008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10101540]
push ebx
push esi
inc eax
mov dword [ebp - 0xc], edx
push edi
push eax
mov byte [0x10107358], 0
call fcn.100bd602
add esp, 4
mov esi, eax
cmp dword [0x10101544], 0x10
mov ecx, 0x10101530
mov edx, esi
cmovae ecx, dword [0x10101530]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10087445
push 0
push 0
push 4
push 0
push 0
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10087509
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x10087509
push esi
call fcn.100c2de3
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100874a1
push esi
push 0
push ebx
call fcn.100bfa00
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10087509
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.100c2de3
mov edi, eax
add esp, 4
test edi, edi
je 0x100874d6
push esi
push 0
push edi
call fcn.100bfa00
add esp, 0xc
xor ecx, ecx
test esi, esi
je 0x10087509
lea eax, [ebx + 2]
nop
cmp byte [eax - 2], 0x6b
jne 0x10087503
cmp byte [eax - 1], 0x65
jne 0x10087503
cmp byte [eax], 0x79
jne 0x10087503
cmp byte [eax + 1], 0x22
jne 0x10087503
cmp byte [eax + 2], 0x3a
jne 0x10087503
cmp byte [eax + 3], 0x22
je 0x1008751c
inc ecx
inc eax
cmp ecx, esi
jb 0x100874e0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bd09a
mov esp, ebp
pop ebp
ret
mov al, byte [ecx + ebx + 6]
cmp al, 0x22
je 0x1008753e
add ecx, 6
mov edx, edi
add ecx, ebx
nop dword [eax + eax]
mov byte [edx], al
lea ecx, [ecx + 1]
mov al, byte [ecx]
lea edx, [edx + 1]
cmp al, 0x22
jne 0x10087530
push ebx
call fcn.100c2dc8
add esp, 4
push edi
push 0x10107358
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10107358
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0xc]
push edi
mov dword [ecx], eax
call fcn.100c2dc8
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.100bd09a
mov esp, ebp
pop ebp
ret
Function at 0x10087590
Capabilities:
Decode data using base64 via dword translation table
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100ff008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x1c], eax
push edi
push ebx
call fcn.100c2de3
add esp, 4
mov edi, eax
push ebx
push 0
push edi
call fcn.100bfa00
add esp, 0xc
xor esi, esi
test bl, 3
jne 0x1008763a
xor edx, edx
test ebx, ebx
je 0x1008763a
nop
mov al, byte [edx + 0x10107358]
cmp al, 0x3d
je 0x1008763a
cmp al, 0x2b
jl case.default.0x100875f5
cmp al, 0x7a
jg case.default.0x100875f5
movsx eax, al
mov cl, byte [eax + 0x100f8840]
cmp cl, 0xff
je case.default.0x100875f5
mov eax, edx
and eax, 3
jmp dword [eax*4 + 0x10087704]
shl cl, 2
mov byte [esi + edi], cl
jmp 0x10087631
mov al, cl
shr al, 4
and al, 3
or byte [esi + edi], al
inc esi
shl cl, 4
mov byte [esi + edi], cl
jmp 0x10087631
mov al, cl
shr al, 2
and al, 0xf
or byte [esi + edi], al
inc esi
shl cl, 6
mov byte [esi + edi], cl
jmp 0x10087631
or byte [esi + edi], cl
lea eax, [esi + edi]
inc esi
inc edx
cmp edx, ebx
jb 0x100875d0
jmp 0x1008763a
xor esi, esi
lea eax, [esi - 5]
push eax
mov dword [ebp - 0xc], eax
call fcn.100c2de3
add esp, 4
mov ebx, eax
lea eax, [esi - 5]
mov dword [ebp - 0x20], ebx
push eax
push 0
push ebx
call fcn.100bfa00
mov ecx, 5
add esp, 0xc
cmp esi, ecx
jbe 0x10087672
mov al, byte [ecx + edi]
mov byte [ebx + ecx - 5], al
inc ecx
cmp ecx, esi
jb 0x10087666
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x100876ef
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100876be
mov esi, dword [ebp - 0xc]
mov edx, ebx
mov ecx, dword [ebp - 0x1c]
sub esi, ecx
nop dword [eax + eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x100876b0
mov eax, dword [ebp - 0x1c]
push edi
mov byte [ebx + eax], 0
call fcn.100c2dc8
add esp, 4
push dword [ebp - 0x20]
call fcn.100c2dc8
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100bd09a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bd09a
mov esp, ebp
pop ebp
ret
Function at 0x1008af20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100ff008]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
mov eax, 0x7fffffff
sub eax, ecx
push esi
cmp eax, 0xc
jb 0x1008b096
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0xc
cmovae eax, dword [ebp + 8]
push str.logins.json
push ecx
push eax
push ecx
push dword [ebp - 8]
lea ecx, [ebp - 0x20]
call fcn.100b40e0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp + 8]
call fcn.100b1280
mov edx, dword [ebp - 0xc]
cmp edx, 0x10
jb 0x1008afa4
mov ecx, dword [ebp - 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1008af9a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008b0a0
push edx
push ecx
call fcn.100bd5f4
add esp, 8
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0x100f96cc
cmovae eax, dword [ebp + 8]
push eax
call fcn.100c64bd
add esp, 8
test eax, eax
je 0x1008b057
push eax
call fcn.100c654b
push 0x186a0
call fcn.100c2de3
add esp, 8
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
mov esi, eax
cmovae ecx, dword [ebp + 8]
push 0
push 0x80
push 4
push 0
push 7
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x1008b016
push 0
lea ecx, [ebp - 8]
push ecx
push 0x186a0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x1008b046
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1008b03c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008b09b
push edx
push ecx
call fcn.100bd5f4
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bd09a
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x1008b087
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1008b07d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008b0a0
push edx
push ecx
call fcn.100bd5f4
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100bd09a
mov esp, ebp
pop ebp
ret
call fcn.10083390
call fcn.100c93fd
call fcn.100c93fd
int3