joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024fd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d4968
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], ebx
call fcn.100240a0
add esp, 4
test al, al
jne 0x1002503e
push str.Failed_to_contruct_temp_path_to_construct_the_marker_file_path
call fcn.10006760
mov ecx, 0x100dcd14
call fcn.10006e40
add esp, 4
lea esi, [ebx + 8]
jmp 0x100250ef
xor edx, edx
push 1
mov eax, 0x100dc9f4
lea esi, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], dx
call fcn.10001b30
mov eax, esi
push eax
mov edx, str.asuap.txt
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.10001fd0
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.10001900
mov esi, 8
cmp dword [ebp - 0x50], esi
jb 0x1002509a
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.100b2e51
add esp, 4
xor edx, edx
mov byte [ebp - 4], bl
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], ebx
mov word [ebp - 0x64], dx
cmp dword [ebp - 0x34], esi
jb 0x100250be
mov eax, dword [ebp - 0x48]
push eax
call fcn.100b2e51
add esp, 4
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x100250c9
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100250ed
push str.File_does_not_exist
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006de0
add esp, 4
jmp 0x100250ef
mov bl, 1
cmp dword [ebp - 0x18], esi
jb 0x10025100
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.100b2e51
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret

Function at 0x1002ac80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0x1c
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x1002acda
push str.Unable_to_retreive_Local_App_Data_Path_from_Win_library:_n
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006e40
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
lea edi, [ebp - 0x214]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1002ace3
mov ecx, 9
mov esi, str.AdobeOOBEPDApp_
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x214]
movsw word es:[edi], word [esi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002ad06
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x214]
mov esi, ebx
call fcn.10001b30
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
Function at 0x1002ad40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x2b
lea eax, [ebp - 0x210]
push eax
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x1002ad95
push str.Unable_to_retreive_commonPath:_n
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006e40
add esp, 4
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1002ada0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
call fcn.10001b30
push 6
push 0x100e6048
mov eax, esi
call fcn.10001a00
cmp dword [esi + 0x14], 8
jb 0x1002add1
mov esi, dword [esi]
push esi
push str.ACF_Path_retreived_:_ls_n
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006db0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov al, 1
pop esi
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret

Function at 0x1002af90
Capabilities:
Create directory

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x1002af9b
mov eax, dword [esi]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x1002afe1
cmp eax, 0xb7
je 0x1002afe1
cmp eax, 0x50
je 0x1002afe1
cmp dword [esi + 0x14], 8
jb 0x1002afbe
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Unable_to_create_directoryPath_...Error_Code_is:__d_._At_desired_location:_s
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006e10
add esp, 0xc
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x1002aff0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ecx
push ebx
push esi
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x1002affd
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002b025
push str.File_does_not_exist
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006de0
add esp, 4
mov al, 1
pop esi
pop ebx
pop ecx
ret
xor bl, bl
cmp dword [esi + 0x14], 8
jb 0x1002b031
mov eax, dword [esi]
jmp 0x1002b033
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1002b046
mov bl, 1
mov al, bl
pop esi
pop ebx
pop ecx
ret
cmp dword [esi + 0x14], 8
jb 0x1002b04e
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to__delete_directory_at_path:_ls_error:_d_n
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006e40
add esp, 0xc
pop esi
mov al, bl
pop ebx
pop ecx
ret
Function at 0x1002c2a0
Capabilities:
Check if file exists

Disassembly:
push ecx
cmp dword [eax + 0x14], 8
jb 0x1002c2a9
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002c2cf
push str.File_does_not_exist
call fcn.10006760
mov ecx, str.Utilities
call fcn.10006de0
add esp, 4
xor al, al
pop ecx
ret
mov al, 1
pop ecx
ret

Function at 0x1002f1a0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi]
mov edx, ecx
xor edx, eax
shr ecx, 8
and edx, 0xff
mov edx, dword [edi + edx*4]
xor edx, ecx
movzx ecx, dl
add ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [edi + ecx*4]
mov dword [esi + 8], edx
ret
Function at 0x100308d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
je 0x10030966
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10030966
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003090a
and al, 0x10
xor ecx, ecx
cmp al, 0x10
sete cl
pop edi
pop ebx
mov eax, ecx
pop ebp
ret 4
push esi
push edi
call fcn.100b4b9d
mov esi, eax
push 0x5c
push esi
call fcn.100b4ae4
add esp, 0xc
test eax, eax
je 0x1003095a
xor edx, edx
push esi
mov ecx, ebx
mov word [eax], dx
call fcn.100308d0
push esi
test eax, eax
jne 0x10030945
call fcn.100b3773
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret 4
call fcn.100b3773
add esp, 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1003093c
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret 4
pop edi
xor eax, eax
pop ebx
pop ebp
ret 4

Function at 0x100309b0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
jne 0x100309e1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea esi, [eax - 1]
neg esi
sbb esi, esi
inc esi
je 0x10030a3b
lea ecx, [ebp - 0x14]
push ecx
push ebx
shr ebx, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov esi, eax
test esi, esi
je 0x10030a3b
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov esi, eax
test esi, esi
je 0x10030a3b
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100311e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x100311f3
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x1003126d
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.100b6420
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x10031241
sub eax, edi
jmp 0x10031243
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x10031232
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x10031260
sub eax, edi
jmp 0x10031262
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x10031251
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x10031323
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x10031293
mov ebx, ecx
test ebx, ebx
je 0x100312e7
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x100312b4
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
call fcn.10030a50
jmp 0x100312cc
cmp eax, 2
jne 0x100312d5
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x100312c6
xor eax, eax
jmp 0x100312d2
push ebx
call fcn.10030cd0
mov edx, dword [ebp - 8]
add esp, 4
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.100b6420
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x1003130f
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x10031323
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x100311f0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003aac0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x1003aaed
push esi
push edi
jmp 0x1003aad0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x100e7f68]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x1003aad0
pop edi
pop esi
ret

Function at 0x1003ab50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi*8]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x400
jbe 0x1003ab72
mov esi, 0x80
cmp esi, dword [edi]
jne 0x1003ab7f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1010f708]
test eax, eax
je 0x1003ab8a
call eax
lea ecx, [esi*8]
push ecx
call fcn.10037920
mov esi, eax
mov eax, dword [0x1010f70c]
add esp, 4
mov dword [ebp - 4], esi
test eax, eax
je 0x1003abaa
call eax
test esi, esi
je 0x1003ab76
mov edx, dword [edi + 0xc]
push edx
call fcn.10037c20
add esp, 4
push esi
mov dword [edi + 0xc], esi
call dword [0x1010a8bc]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call fcn.100b8f90
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x1003ac8f
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x1003ac23
movzx edi, byte [esi]
movzx edi, byte [edi + 0x100e7f68]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc esi
test edx, edx
jg 0x1003ac02
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x1003ac6b
mov esi, dword [eax]
test esi, esi
je 0x1003ac41
mov edx, dword [eax + 4]
jmp 0x1003ac43
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x1003ac6b
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x1003ac63
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x1003ac84
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x1003ac84
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x1003ac7a
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x1003abf6
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c170
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10109610]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea ecx, [ebp - 0x110]
push ecx
push 0x104
push eax
push edx
mov dword [ebp - 0x118], 0x200
call fcn.1003c010
add esp, 0x10
test eax, eax
jne 0x1003c25d
lea ecx, [ebp - 0x110]
call fcn.1003b8a0
mov esi, eax
test esi, esi
je 0x1003c248
call fcn.1003aef0
test eax, eax
mov eax, esi
je 0x1003c207
cmp word [esi], 0
je 0x1003c1ec
cmp word [eax], 0x5c
je 0x1003c1e7
add eax, 2
cmp word [eax], 0
jne 0x1003c1d6
jmp 0x1003c1ec
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x114]
push edx
mov eax, edx
push eax
lea ecx, [ebp - 0x118]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1003c239
cmp byte [esi], 0
je 0x1003c220
lea esp, [esp]
cmp byte [eax], 0x5c
je 0x1003c21d
inc eax
cmp byte [eax], 0
jne 0x1003c210
jmp 0x1003c220
mov byte [eax], 0
lea eax, [ebp - 0x114]
push eax
mov ecx, eax
push ecx
lea edx, [ebp - 0x118]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.100b3773
add esp, 4
test edi, edi
jne 0x1003c25d
mov eax, 0x200
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x118]
pop edi
xor ecx, ebp
pop esi
call fcn.100b2e5c
mov esp, ebp
pop ebp
ret
Function at 0x10052a23
Capabilities:
Terminate process

Disassembly:
sub esp, 0x5c
mov eax, dword [str.KERNEL32.dll]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and byte [ecx + 0x3068100d], dl
jne 0x10052a36
invalid
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, eax
mov eax, dword [0x1010bfa0]
push eax
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
mov eax, ebp
mov edx, dword [0x1010bfa0]
call fcn.10052b2b
push 0x104
push ebp
mov edx, dword [0x1010bfb0]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
movzx esi, word [ebp]
xor ebx, ebx
mov ecx, dword [str.pythonw.exe]
test esi, esi
je 0x10052b11
inc edx
lea esi, [ebp + edx*2]
movzx edi, word [esi]
test edi, edi
jne 0x10052a8c
movzx esi, word [esi - 2]
cmp esi, 0x5c
je 0x10052ab1
mov word [ebp + edx*2], bx
dec edx
movzx esi, word [ebp + edx*2 - 2]
cmp esi, 0x5c
jne 0x10052aa1
movzx esi, word [ecx]
test esi, esi
je 0x10052acd
mov esi, ebx
movzx edi, word [ecx + esi*2]
inc esi
mov word [ebp + edx*2], di
inc edx
movzx edi, word [ecx + esi*2]
test edi, edi
jne 0x10052aba
mov edx, 0x44
lea edi, [esp + 8]
mov eax, edi
call fcn.10052b2b
mov edx, 0x10
lea esi, [esp + 0x4c]
mov eax, esi
call fcn.10052b2b
push esi
push edi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, ebp
jmp case.0x10051d33.133
Function at 0x1005a0e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x1005a0fa
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ecx, 0x44
call fcn.10037ea0
mov edi, eax
test edi, edi
je 0x1005a0f1
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
or eax, 2
push eax
push ecx
push esi
call fcn.10059c70
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov dword [edi], eax
mov eax, dword [ebx + 8]
push edx
push eax
push esi
call fcn.10059da0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
push ecx
push eax
push esi
call fcn.10059900
mov edx, dword [ebp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
push edx
push eax
push esi
call fcn.10059c70
mov ecx, dword [ebp + 0x10]
add esp, 0x1c
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
push ecx
push eax
push esi
call fcn.10059900
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
push edx
push eax
push esi
call fcn.10059c70
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov cl, byte [ebx + 4]
add esp, 0x1c
mov byte [edi + 4], cl
mov eax, dword [ebx + 0x1c]
push edx
push eax
push esi
call fcn.1005a0e0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x28]
push ecx
push eax
push esi
call fcn.10059900
mov edx, dword [ebp + 0x10]
push 0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push edx
push eax
push esi
call fcn.10059900
mov dword [edi + 0x2c], eax
add esp, 0x20
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov cx, word [ebx + 6]
mov edx, 0xfff7
mov dword [edi + 0x24], eax
and cx, dx
or eax, 0xffffffff
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov word [edi + 6], cx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10061220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, edx
cmp byte [edx], al
je 0x10061239
inc ecx
cmp byte [ecx], al
jne 0x10061234
sub ecx, edx
and ecx, 0x3fffffff
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
push esi
xor esi, esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ecx
test ecx, ecx
jle 0x10061336
push edi
nop
cmp esi, 2
jge 0x10061268
xor esi, 1
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100612b9
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
lea edx, [esi + esi*2]
mov edi, dword [eax + edx*8]
mov dl, byte [ecx]
test dl, dl
je 0x1006129e
movzx eax, byte [edi]
movzx edx, dl
mov dl, byte [edx + 0x100e7f68]
cmp dl, byte [eax + 0x100e7f68]
jne 0x1006129e
mov dl, byte [ecx + 1]
inc ecx
inc edi
test dl, dl
jne 0x10061281
movzx ecx, byte [ecx]
movzx edx, byte [edi]
movzx edx, byte [edx + 0x100e7f68]
movzx ecx, byte [ecx + 0x100e7f68]
sub ecx, edx
mov eax, dword [ebp - 4]
jne 0x10061325
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
lea edx, [esi + esi*2]
mov esi, dword [ecx + edx*8 + 0x14]
cmp dword [esi + 0x10], 0
je 0x10061305
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x100612fe
jmp 0x100612e0
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x100e7f68]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x100612e0
mov ebx, dword [ebp - 0xc]
xor edx, edx
div dword [esi + 4]
jmp 0x10061307
xor edx, edx
mov eax, dword [ebp + 0xc]
push ebx
push eax
lea eax, [esi + 4]
call fcn.1003aca0
add esp, 8
test eax, eax
je 0x1006133c
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10061335
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
cmp esi, dword [ebp - 0x10]
jl 0x10061260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x10061325
Function at 0x100613f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp byte [eax], 0
mov dword [ebp - 8], esi
mov ecx, eax
je 0x1006140d
inc ecx
cmp byte [ecx], 0
jne 0x10061407
sub ecx, eax
and ecx, 0x3fffffff
mov ebx, ecx
mov ecx, dword [edx + 4]
xor eax, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x1006151f
mov ecx, dword [edx + 8]
mov dword [ebp - 0xc], ecx
push edi
mov ecx, eax
cmp eax, 2
jge 0x1006143e
xor ecx, 1
lea edx, [ecx + ecx*2]
mov ecx, dword [ebp - 0xc]
mov edi, dword [ecx + edx*8 + 0x14]
lea ecx, [ecx + edx*8]
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x10061498
mov esi, dword [ecx]
mov cl, byte [edx]
test cl, cl
je 0x10061480
lea ebx, [ebx]
movzx eax, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x100e7f68]
cmp cl, byte [eax + 0x100e7f68]
jne 0x1006147d
mov cl, byte [edx + 1]
inc edx
inc esi
test cl, cl
jne 0x10061460
mov eax, dword [ebp - 4]
movzx edx, byte [edx]
movzx ecx, byte [esi]
movzx ecx, byte [ecx + 0x100e7f68]
movzx edx, byte [edx + 0x100e7f68]
sub edx, ecx
jne 0x100614f9
test edi, edi
je 0x100614f2
cmp dword [edi + 0x20], 0
lea esi, [edi + 0x14]
je 0x100614d4
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x100614ce
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x100e7f68]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x100614b0
mov ebx, dword [ebp - 0x10]
xor edx, edx
div dword [esi]
jmp 0x100614d6
xor edx, edx
mov eax, dword [ebp + 8]
push ebx
push eax
mov eax, esi
call fcn.1003aca0
add esp, 8
test eax, eax
je 0x10061510
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x1006151c
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x14]
jl 0x10061434
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov dword [ebp - 8], 0
jmp 0x100614f9
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret