joyce8/EMBER2024-capa huggingface dataset:
Function at 0x83fc0c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov ecx, 0x1bf8
imul eax, eax, 0xeb052611
mov edx, ebx
mov dword [0x858ff0], eax
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x83fc54
add ecx, eax
cmp ecx, 0x205f
jbe 0x83fc30
mov eax, dword [0x858ce4]
and eax, 0xe6b60a5f
mov dword [0x858ff0], eax
imul ecx, dword [0x858c90], 0xcdda6bd2
mov eax, dword [0x858ce4]
mov esi, ebx
lea edx, [eax + 0x1fee253d]
mov dword [0x858cec], edx
mov dword [0x858c90], ecx
mov dx, word [esi]
test dx, dx
je 0x83fc9b
sub edx, 0x30
cmp dx, 9
jbe 0x83fc96
or ecx, 0x4132c748
mov dword [0x858c90], ecx
jmp 0x83fc9b
add esi, 2
jmp 0x83fc77
sub eax, 0x7162aa97
mov dword [0x858ce4], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov eax, dword [0x858c90]
and eax, 0x550a5a5d
mov dword [0x858ce4], eax
xor eax, eax
cmp word [ebx + eax*2], 0
je 0x83fcda
inc eax
cmp eax, 0xe2d
jne 0x83fcbc
imul eax, dword [0x858ff0], 0xee1ab53
mov dword [0x858ce4], eax
mov eax, dword [0x858ce4]
mov edx, dword [0x858cec]
and eax, 0x78586692
lea ecx, [eax - 0x6f0f4b44]
mov dword [0x858ff0], ecx
xor ecx, ecx
cmp word [ebx + ecx*2], 0
je 0x83fd12
inc ecx
cmp ecx, 0xc8c
jne 0x83fcf8
sub eax, 0x500ea938
mov dword [0x858ff0], eax
mov eax, edx
mov ecx, ebx
mov esi, 0x133d
or eax, 0xd1f1e53d
mov dword [0x858c90], eax
movzx eax, word [ecx]
add ecx, 2
test ax, ax
je 0x83fd49
add esi, eax
cmp esi, 0x1ee0
jbe 0x83fd25
mov eax, dword [0x858ff0]
or eax, 0x7b38d883
mov dword [0x858c90], eax
add edx, 0x5a568120
mov esi, ebx
mov dword [0x858ce4], edx
mov dword [esp], 0x1201
call dword [sym.imp.USER32.dll_IsIconic]
push eax
mov eax, dword [0x858cec]
mov edx, dword [0x858ff0]
and eax, 0x185a3064
mov di, word [esi]
lea ecx, [edi - 0x30]
cmp cx, 9
ja 0x83fd86
add esi, 2
jmp 0x83fd75
or eax, 0xab31352
or edx, 0x9042a7fd
mov esi, ebx
mov edi, 0x7db
movzx ecx, word [esi]
add esi, 2
test cx, cx
je 0x83fdad
add edi, ecx
cmp edi, 0x17f1
jbe 0x83fd98
sub eax, 0x3127eff1
mov edi, 0x72
xor eax, 0xe9296992
mov dword [0x858c90], eax
lea eax, [edx - 0x39285d5a]
mov dword [0x858ce4], eax
imul esi, eax, 0x19d107a8
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
je 0x83fdf2
add edi, ecx
cmp edi, 0x76b
jbe 0x83fdd2
imul eax, eax, 0xb6d3b420
mov dword [0x858ce4], eax
mov eax, dword [0x858ce4]
sub esi, 0x1f5b13f9
sub edx, 0x438f9441
mov dword [0x858cec], esi
add eax, 0x760b7236
mov dword [0x858ff0], edx
mov dword [0x858ce4], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x840654
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov edx, 0x85f1c0
mov ecx, 0x715
movsx eax, byte [edx]
inc edx
test al, al
je 0x84067d
add ecx, eax
cmp ecx, 0x22fb
jbe 0x84066b
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call ebx
mov eax, dword [ebp + 8]
pop edx
pop ebx
pop ebp
add eax, 0x19b4d688
ret
Function at 0x840b18
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov edx, str.This_object_is_not_allowed_to_be_opened_in_a_transaction.
mov ecx, 0xe45
or dword [0x858c78], 0xe6afb73d
and eax, 0xdfa3
mov dword [0x858d30], eax
movsx eax, byte [edx]
inc edx
test al, al
je 0x840b66
add ecx, eax
cmp ecx, 0x14fb
jbe 0x840b45
mov eax, dword [0x858fdc]
and eax, 0xf75fe475
mov dword [0x858d30], eax
mov eax, dword [0x858d30]
mov bl, byte [str.Monitor_descriptor_could_not_be_obtained.]
xor edx, edx
cmp word [edx + str.windows_vista], 0
je 0x840b9a
add edx, 2
cmp edx, 0x4710
jne 0x840b73
lea edx, [eax - 0x756e5442]
imul edx, edx, 0x5f48f5f6
mov dword [0x858c78], edx
lea ecx, [eax - 0x15a161c9]
mov esi, str.Monitor_descriptor_could_not_be_obtained.
mov dl, byte [esi]
test dl, dl
je 0x840bc4
sub edx, 0x30
cmp dl, 9
jbe 0x840bc1
lea edx, [eax - 0x64bd9e6d]
mov dword [0x858c78], edx
jmp 0x840bc4
inc esi
jmp 0x840ba5
xor edx, edx
cmp byte [edx + str.The_process_cannot_switch_to_the_startup_current_directory__hs.], 0
je 0x840be4
inc edx
cmp edx, 0x3c7
jne 0x840bc6
imul edx, eax, 0x4298c03f
mov dword [0x858c78], edx
mov esi, str.windows_vista
mov edi, 0x2096
movzx edx, word [esi]
add esi, 2
test dx, dx
je 0x840c03
add edi, edx
cmp edi, 0x2698
jbe 0x840bee
mov edx, eax
imul eax, eax, 0x389954ff
or edx, 0xf924187b
mov dword [0x858fdc], edx
test bl, bl
je 0x840c27
add edx, 0xbaf3b2c
mov dword [0x858d30], edx
xor ecx, 0x7ff70018
sub eax, 0x1ff5a0b7
mov dword [0x858c04], ecx
mov dword [0x858f80], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
imul eax, eax, 0xd334a44c
mov dword [0x858c04], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x858f80]
mov edx, str.save_initclip
mov ecx, 0xaa1
and eax, 0xaec3e5db
mov dword [0x858c78], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x840c7f
add ecx, eax
cmp ecx, 0x169b
jbe 0x840c6d
imul eax, dword [0x858c04], 0xf4b8043d
mov dword [0x858d30], eax
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x840e1c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x840e32
call dword [sym.imp.USER32.dll_AnyPopup]
mov edx, ebx
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x840e40
inc edx
jmp 0x840e34
mov edx, ebx
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x840e4e
inc edx
jmp 0x840e42
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov al, byte [ebx]
sub eax, 0x30
cmp al, 9
ja 0x840e60
inc ebx
jmp 0x840e54
imul eax, dword [ebp + 0x10], 0x2327ccec
pop edx
pop ebx
pop ebp
ret
Function at 0x8417e8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str.The_provided_event_log_buffer_was_already_marked_as_freed.
mov ebp, esp
push ebx
push ecx
mov ecx, 0x7c4
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x84180c
add ecx, eax
cmp ecx, 0x246c
jbe 0x8417f7
mov edx, dword [0x859070]
mov ecx, str.BinaryHash
mov ebx, 0x1fa
imul eax, edx, 0xa7ddaeb0
mov dword [0x858c70], eax
movzx eax, byte [ecx]
inc ecx
test al, al
je 0x84184b
add ebx, eax
cmp ebx, 0x1c71
jbe 0x841827
add edx, 0x6e3f1ec0
mov dword [0x858f8c], edx
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
mov eax, dword [0x859070]
sub eax, 0x1d71b1a9
mov dword [0x858c70], eax
mov edx, eax
or eax, 0xe7692517
xor edx, 0xec477fe5
xor eax, 0xff658c18
mov dword [0x858f8c], edx
mov dword [0x859070], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, str.The_entry_is_invalid.
mov ecx, 0xf36
movzx eax, byte [edx]
inc edx
test al, al
je 0x8418a3
add ecx, eax
cmp ecx, 0x75a
jbe 0x841887
sub dword [0x858c70], 0x5d0fab56
mov edx, dword [0x859070]
sub dword [0x858c70], 0x2c486df0
mov eax, edx
xor eax, 0xfa0bcaf2
mov dword [0x858f8c], eax
xor eax, eax
cmp word [eax + str.The_device_has_indicated_that_cleaning_is_necessary.], 0
je 0x8418f1
add eax, 2
cmp eax, 0x431a
jne 0x8418c1
xor edx, 0xf264aa99
mov dword [0x858c70], edx
call dword [sym.imp.USER32.dll_GetMessageTime]
or eax, 0x75067442
mov dword [0x858c70], eax
mov eax, dword [0x858c70]
or dword [0x858f8c], 0xd46b004a
xor eax, 0xf442fc60
mov dword [0x859070], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x858c70]
lea edx, [eax + 0x36b6c543]
lea ecx, [eax - 0x50f08051]
and eax, 0xd8994c63
mov dword [0x858c70], eax
mov eax, edx
mov dword [0x859070], edx
mov dword [0x858f8c], ecx
pop edx
pop ebx
pop ebp
ret
Function at 0x8420d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edx
mov ebx, dword [ebp + 8]
cmp byte [ebx], 0
je 0x8420e3
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, ebx
mov al, byte [edx]
test al, al
je 0x8420fd
sub eax, 0x30
cmp al, 9
jbe 0x8420fa
call dword [sym.imp.USER32.dll_AnyPopup]
jmp 0x8420fd
inc edx
jmp 0x8420e5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, ebx
mov ecx, 0x11c3
movzx eax, byte [edx]
inc edx
test al, al
je 0x84211c
add ecx, eax
cmp ecx, 0x1b9e
jbe 0x84210a
mov al, byte [ebx]
sub eax, 0x30
cmp al, 9
ja 0x842128
inc ebx
jmp 0x84211c
call dword [sym.imp.USER32.dll_AnyPopup]
pop eax
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]

Function at 0x842b4c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov edx, str.111019184142Z
mov ecx, 0x2258
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
movsx eax, byte [edx]
inc edx
test al, al
je 0x842b81
add ecx, eax
cmp ecx, 0x256c
jbe 0x842b5f
or dword [0x858d88], 0xe25592e5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x858f90]
mov ecx, str.The_user_data_passed_for_the_reparse_point_is_invalid.
mov ebx, 0x399
or eax, 0x7f9966be
lea edx, [eax + 0x51ea570b]
mov dword [0x858d7c], eax
imul edx, edx, 0x658b3659
mov dword [0x858d88], edx
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x842bcc
add ebx, edx
cmp ebx, 0xa8e
jbe 0x842bac
imul eax, eax, 0x9f3b77f9
mov dword [0x858f04], eax
imul eax, dword [0x858f04], 0xdc82b440
mov ebx, 0xd87
mov dword [0x858f90], eax
sub eax, 0x26176bfc
mov dword [0x858edc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x858edc]
mov ecx, 0x85a200
mov esi, dword [0x858f90]
mov edx, eax
or eax, 0x7be66101
and edx, 0xe00f1e44
lea edi, [eax + 0x6582a8cf]
mov dword [0x858f04], edx
mov edx, esi
and edx, 0xc8382f9c
mov dword [0x858edc], edx
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x842c44
add ebx, edx
cmp ebx, 0xdaa
jbe 0x842c27
imul eax, eax, 0x87524650
mov dword [0x858edc], eax
imul edx, edi, 0xbce6e7e9
mov eax, esi
xor eax, 0x72df54ae
mov dword [0x858d7c], eax
mov dword [0x858d88], edx
call dword [sym.imp.USER32.dll_AnyPopup]
mov eax, dword [0x858d7c]
or dword [0x858f90], 0x799dbd1c
mov edx, eax
xor eax, 0x9b3bfab8
or edx, 0xc8449ae3
and eax, 0x4a8cbf09
mov dword [0x858edc], eax
mov eax, edx
xor eax, 0x837c744a
mov dword [0x858f04], edx
mov dword [0x858d88], eax
add esp, 0xc
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x842ca4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x859044]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [0x858f28]
sub eax, 0x629c19eb
and eax, 0xbb4f87d3
mov dword [0x858f28], eax
imul eax, dword [0x859044], 0x25012bcf
mov edx, eax
and eax, 0x81000c
and edx, 0xd3964d
mov dword [0x859044], eax
mov dword [0x858e8c], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x858e8c]
mov ecx, str.Xbox_One_S
mov edx, eax
or eax, 0xebe9b5e9
or edx, 0xe981a0e9
mov dword [0x858e8c], edx
mov dl, byte [ecx]
test dl, dl
je 0x842d31
sub edx, 0x30
cmp dl, 9
jbe 0x842d2e
imul edx, eax, 0xb0bfcded
mov dword [0x858e8c], edx
jmp 0x842d31
inc ecx
jmp 0x842d12
add eax, 0x15255e7b
cmp byte [str.Xbox_One_S], 0
mov dword [0x858f28], eax
je 0x842d4e
sub dword [0x858e8c], 0x36852506
or eax, 0x8c856869
mov dword [0x859044], eax
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov eax, dword [0x858f28]
leave
ret

Function at 0x843460
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [0x858ed4]
mov ebx, dword [ebp + 8]
lea edx, [eax + 0x46ea5dd4]
mov ecx, ebx
mov dword [0x858ee8], edx
lea edx, [eax - 0x5b295d1e]
mov dword [0x858de4], edx
mov dx, word [ecx]
test dx, dx
je 0x8434b2
sub edx, 0x30
cmp dx, 9
jbe 0x8434ad
add eax, 0x6928618a
mov dword [0x858ed4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jmp 0x8434b2
add ecx, 2
jmp 0x84348a
mov eax, dword [0x858ed4]
mov ecx, ebx
mov esi, 0x76d
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x8434d3
add esi, edx
cmp esi, 0x15d4
jbe 0x8434be
and eax, 0x44614a18
mov ecx, ebx
mov esi, 0x730
or eax, 0x40604810
sub eax, 0x23c5feaf
or eax, 0xe87aed78
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x843503
add esi, edx
cmp esi, 0xd5a
jbe 0x8434ee
xor eax, 0xc5d1f6af
lea edx, [eax + 0x777fbae9]
and eax, 0x8ec66ec
mov dword [0x858de4], edx
mov dword [0x858ed4], eax
mov ax, word [ebx]
test ax, ax
je 0x843540
sub eax, 0x30
cmp ax, 9
jbe 0x84353b
mov dword [0x858ed4], 0x8aaf4bf4
jmp 0x843540
add ebx, 2
jmp 0x84351e
imul eax, dword [0x858ed4], 0x38775fbe
mov dword [0x858ee8], eax
mov dword [esp], 0x25
call dword [sym.imp.USER32.dll_IsIconic]
imul eax, eax, 0x7bfa77fe
push edx
mov dword [0x858ed4], eax
mov eax, dword [0x858de4]
mov edx, eax
or eax, 0xd2d4c270
and edx, 0xc196e258
mov dword [0x858de4], eax
mov dword [0x858ee8], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x858ee8]
or eax, 0x79222fbf
mov dword [0x858de4], eax
mov eax, dword [0x858ed4]
sub eax, 0x5a303f47
mov dword [0x858ee8], eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x1002d03
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.010024c0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01002475
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
cld
invalid
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.010024c0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
adc al, 0xe8
sbb dh, dh
invalid
inc dword [ebx - 0x7a76f33c]
enter 0xfffffffffffffffa, 0xffffffffffffffff
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
Function at 0x1002efd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.010024c0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01002475
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.010024b0
inc eax
xor cl, ch
cld
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.010024c0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01002475
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.010024b0
sahf
mov dh, 0x17
in eax, dx
and byte [ebp - 0x664], 0
and byte [ebp - 0x663], 0
mov byte [ebp - 0x662], 7
and byte [ebp - 0x661], 0
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.010024c0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01002475
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.010024c0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01002475
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.010024b0
daa
or al, byte [eax - 0x5135b]
inc dword [eax]
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
invalid
invalid
Function at 0x100342e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x38fffffc], esp
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.010024c0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01002475
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.010024b0
mov esi, 0x68cfc321
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.010024b0
and eax, dword [ebx + 0x6580a549]
loopne 0x10034ce
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.010024c0
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01002475
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x100355c
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x100357c
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x1003599
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
invalid
invalid
invalid

Function at 0x10047b3
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b2d0]
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10047fa
push eax
push 0x10
push eax
push eax
push 0x4f0
push eax
call fcn.01003ebe
call fcn.01003aa1
mov dword [0x100ba5c], eax
xor eax, eax
jmp 0x100480a
push 2
push 2
lea eax, [ebp - 0x108]
push eax
call fcn.0100456a
mov ecx, dword [ebp - 4]
call fcn.010064de
leave
ret
Function at 0x1004e73
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x14], edi
je 0x1004f8f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHBrowseForFolder
push edi
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1004f7c
push 0xc3
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x1004f7c
push str.SHGetPathFromIDList
push edi
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1004f7c
cmp byte [0x100ba80], bl
mov esi, 0x100ba80
jne 0x1004f19
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.USER32.dll_CharPrevA]
add eax, esi
push eax
push esi
call edi
cmp byte [eax], 0x5c
mov dword [ebp - 4], eax
jne 0x1004f19
push eax
push esi
call edi
cmp byte [eax], 0x3a
je 0x1004f19
mov eax, dword [ebp - 4]
mov byte [eax], bl
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
mov byte [edi], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x1002d5a
mov dword [ebp - 0x1c], esi
call dword [ebp - 8]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x1004f6a
push esi
push eax
call dword [ebp - 0xc]
cmp byte [0x100ba80], bl
je 0x1004f64
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
call dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
cmp byte [edi], bl
setne al
jmp 0x1004fa3
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push 0x10
push ebx
push ebx
push 0x4c1
jmp 0x1004f99
push ebx
push 0x10
push ebx
push ebx
push 0x4c2
push dword [ebp + 8]
call fcn.01003ebe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1004faf
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
inc ebx
call fcn.0100672a
test eax, eax
je 0x100501d
cmp dword [0x100bc3c], 0
jne 0x1005011
test byte [0x100c898], bl
jne 0x1005011
push 6
push 0
push 0x1003e28
push dword [0x100ba4c]
mov dword [0x100be64], esi
push 0x7d3
push dword [0x100c4a4]
call fcn.01004819
sub eax, 6
je 0x1005011
dec eax
je 0x1005025
sub eax, 0x832
jne 0x1005011
mov dword [0x100bc3c], ebx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
xor ebx, ebx
jmp 0x100501d

Function at 0x100672a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006741
xor eax, eax
jmp 0x1006749
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4