joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x10018141
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x1001819b
inc edi
cmp edi, esi
jl 0x10018135
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x100181d0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x1001818a
cmp byte [eax], bl
je 0x100181a5
cmp byte [eax + 1], bl
je 0x100181ae
cmp byte [eax + 2], bl
je 0x100181b8
cmp byte [eax + 3], bl
je 0x100181c4
add eax, 4
cmp eax, edi
jb 0x10018161
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x100183b0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x100183be
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
pop ecx
ret

Function at 0x100183c0
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ecx
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0xc]
push edi
test eax, eax
jne 0x100183ed
push 0x1000
call sub.KERNEL32.dll_OpenProcess
add esp, 4
mov dword [ebx + 0xc], eax
test eax, eax
je 0x1001847b
mov dword [ebx + 4], 0x200
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
cmp ecx, eax
jl 0x10018455
lea esi, [eax + eax]
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x10], esi
lea edi, [esi*8]
push edi
push eax
call sub.KERNEL32.dll_QueryDosDeviceW
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x1001844f
push edi
call sub.KERNEL32.dll_OpenProcess
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x1001847b
mov ecx, dword [ebx + 4]
mov esi, dword [ebx + 0xc]
shl ecx, 3
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov esi, dword [esp + 0x14]
add esp, 4
mov dword [ebx + 0xc], ebp
mov dword [ebx + 4], esi
mov ecx, dword [ebx]
mov edx, dword [ebx + 0xc]
mov eax, dword [esp + 0x18]
mov dword [edx + ecx*8], eax
mov ecx, dword [ebx]
mov edx, dword [ebx + 0xc]
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*8 + 4], eax
mov edx, dword [ebx]
mov ecx, dword [ebx + 8]
inc edx
add ecx, eax
mov dword [ebx], edx
mov dword [ebx + 8], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x10018820
Capabilities:
Query environment variable

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [0x1001e03c]
add esp, 4
test eax, eax
jne 0x10018837
pop esi
pop ecx
ret
push ebx
push ebp
push edi
lea edi, [esi + eax]
inc eax
mov dword [esp + 0x1c], edi
push eax
call sub.KERNEL32.dll_OpenProcess
mov ebp, eax
push 0x1001e040
push esi
mov dword [esp + 0x1c], ebp
mov ebx, ebp
call sub.KERNEL32.dll_Module32First
add esp, 0xc
test eax, eax
je 0x1001889f
mov edx, eax
sub edx, esi
je 0x10018882
mov ecx, edx
mov edi, ebx
mov ebp, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov ebp, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x1c]
lea esi, [eax + 2]
push 0x1001e040
mov byte [edx + ebx], 0x5c
push esi
lea ebx, [edx + ebx + 1]
call sub.KERNEL32.dll_Module32First
add esp, 8
test eax, eax
jne 0x10018862
sub edi, esi
mov eax, edi
je 0x100188b9
mov ecx, eax
mov edi, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
add ebx, eax
rep movsb byte es:[edi], byte [esi]
push ebp
mov byte [ebx], 0
call dword [0x1001e03c]
mov esi, eax
lea edi, [esi + 1]
push edi
call fcn.10015980
add esp, 8
mov ebx, eax
push edi
push ebx
push esi
push ebp
push 0x400000
push 0x804
call dword [0x100190c0]
push ebp
call sub.KERNEL32.dll_GetEnvironmentVariableA
add esp, 4
mov eax, ebx
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x40133f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401399
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40138b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x401387
cmp esi, ecx
jae 0x40138b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x401375
cmp esi, ecx
jb 0x40138f
xor eax, eax
jmp 0x401398
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401942
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov ebx, ecx
push 0x529
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x40198c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40198c
movzx eax, word [esi]
add esi, 2
test ax, ax
je 0x401986
mov dword [ebp - 4], eax
cmp edi, 0xc
je 0x4019a2
lea esi, [esi + eax*2]
inc edi
cmp edi, 0x10
jl 0x401970
call fcn.00401462
push eax
mov ecx, ebx
call fcn.004032b2
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00401462
push eax
push dword [ebp - 4]
mov ecx, ebx
push esi
call fcn.00403251
jmp 0x401999

Function at 0x401b34
Capabilities:
Delete directory
Delete file

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0xc], 0x8004ffff
je 0x401b7b
push esi
xor esi, esi
cmp dword [edi + 0x14], esi
je 0x401b61
push ebx
push esi
lea ecx, [edi + 0x10]
call fcn.004029b6
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, dword [edi + 0x14]
jne 0x401b49
pop ebx
lea ecx, [edi + 0x10]
call fcn.004029e0
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [edi + 0x1c]
call fcn.00402d00
pop esi
lea ecx, [edi + 0x20]
call fcn.00403236
lea ecx, [edi + 0x1c]
call fcn.00403236
lea ecx, [edi + 0x10]
call fcn.004029e0
lea ecx, [edi + 8]
call fcn.00403236
lea ecx, [edi + 4]
pop edi
jmp fcn.00403236
Function at 0x402035
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 4], ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402063
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402063
xor al, al
jmp 0x4020de
call fcn.00401462
push eax
lea ecx, [ebp + 8]
call fcn.004032b2
or dword [ebp - 8], 0xffffffff
lea eax, [ebp + 8]
push 0x104
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00402cc8
push eax
push ebx
push 0x41ca80
push dword [edi]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x10]
mov edi, eax
call fcn.00402ca2
test edi, edi
je 0x4020d4
cmp edi, 0x6f
je 0x4020d4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4020d4
mov ecx, dword [ebp - 4]
lea eax, [ebp + 8]
push eax
add ecx, 0x1c
call fcn.00402bcc
mov bl, 1
lea ecx, [ebp + 8]
call fcn.00403236
mov al, bl
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4020e6
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x4020fd
xor al, al
jmp 0x40216b
push ebx
push esi
call fcn.00401462
push eax
lea ecx, [ebp - 4]
call fcn.004032b2
or dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
push 0x104
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00402cc8
push eax
xor ebx, ebx
mov dword [ebp - 0xc], eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00402ca2
test esi, esi
js 0x40215f
lea eax, [ebp - 4]
mov ecx, edi
push eax
call fcn.00402035
test al, al
je 0x40215f
lea eax, [ebp - 4]
push eax
lea ecx, [edi + 0x20]
call fcn.00402bcc
mov bl, 1
lea ecx, [ebp - 4]
call fcn.00403236
pop esi
mov al, bl
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4021ef
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41f018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push eax
mov edi, ecx
or esi, 0xffffffff
call fcn.004066f0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x41ca88
push dword [edi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4022ec
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x214]
call fcn.00402c5f
lea eax, [ebp - 0x214]
push eax
lea ecx, [edi + 0x10]
call fcn.00402a16
lea ecx, [ebp - 0x214]
call fcn.00403236
push 0x41c97c
push 0x66
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4022ec
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4022ec
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4022ec
xor eax, eax
push eax
push eax
push 4
push eax
push eax
push 0xc0000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4022ec
push esi
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov ecx, edi
call fcn.004025ac
pop ecx
test eax, eax
jne 0x4022e2
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x4022ec
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406238
mov esp, ebp
pop ebp
ret
Function at 0x4025ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x41f018]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x9c], eax
push edi
mov edi, ecx
cmp esi, 0xd
jae 0x4025dc
or eax, 0xffffffff
jmp 0x402769
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x402590
push eax
xor ebx, ebx
mov dword [ebp - 0x90], 0x40259e
push ecx
mov edx, edi
mov dword [ebp - 0x68], ebx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x6c], ebx
call fcn.004054fd
xor eax, eax
mov dword [ebp - 0x58], ebx
inc eax
mov dword [ebp - 0x34], ebx
add edi, 5
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
sub esi, 0xd
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x50], ebx
mov eax, dword [edi]
push eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x80], esi
call fcn.004144d4
add esp, 0xc
mov dword [ebp - 0x84], ebx
mov edi, eax
lea eax, [ebp - 0x84]
mov edx, edi
push eax
push ecx
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x7c]
add eax, 8
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0040539e
add esp, 0x14
mov esi, eax
lea eax, [ebp - 0x94]
push dword [ebp - 0x6c]
push eax
call dword [ebp - 0x90]
push dword [ebp - 0x68]
lea eax, [ebp - 0x94]
mov dword [ebp - 0x6c], ebx
push eax
call dword [ebp - 0x90]
add esp, 0x10
mov dword [ebp - 0x68], ebx
test esi, esi
je 0x4026ab
or ebx, 0xffffffff
jmp 0x402760
mov edx, dword [edi]
lea ecx, [edi + 4]
mov eax, dword [ecx]
push 4
pop esi
add ecx, esi
mov dword [ebp - 0x98], eax
push edx
mov dword [ebp - 0x80], edx
mov eax, dword [ecx]
add ecx, esi
mov dword [ebp - 0x88], eax
mov eax, dword [ecx]
add ecx, esi
mov dword [ebp - 0x8c], eax
mov ebx, dword [ecx]
add ecx, esi
mov dword [ebp - 0x84], ecx
call fcn.004144d4
mov edx, dword [ebp - 0x88]
mov esi, eax
pop ecx
push dword [ebp - 0x80]
mov ecx, dword [ebp - 0x8c]
push esi
push ebx
mov ebx, dword [ebp - 0x98]
lea eax, [ecx + edx]
add eax, ebx
add eax, dword [ebp - 0x84]
push eax
push ecx
mov ecx, dword [ebp - 0x84]
lea eax, [edx + ebx]
add eax, ecx
push eax
push edx
lea eax, [ebx + ecx]
mov edx, ebx
push eax
call fcn.00405571
add esp, 0x20
xor ebx, ebx
test eax, eax
je 0x40272f
inc ebx
jmp 0x402759
push ebx
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x80]
push esi
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402756
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0xa0], eax
je 0x402759
or ebx, 0xffffffff
push esi
call fcn.00414252
pop ecx
push edi
call fcn.00414252
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406238
mov esp, ebp
pop ebp
ret
Function at 0x403826
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.004038c3
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4038b9
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x4038b2
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
je 0x4038a9
push 6
pop ecx
mov dword [ebp - 0x1c], edi
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4038a9
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [esi + 0x10], ecx
jmp 0x4038bb
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.004038c3
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x403a5e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 0x10]
cmp esi, 0x40
jae 0x403a6e
xor eax, eax
jmp 0x403ac3
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x403a6a
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0x403a6a
cmp dword [edx + ecx], 0x4550
jne 0x403a6a
movzx eax, word [edx + ecx + 4]
push edi
mov edi, 0x14c
cmp ax, di
je 0x403aab
mov edi, 0x8664
cmp ax, di
je 0x403ac0
lea eax, [ecx + 0x98]
add eax, edx
mov ecx, dword [eax]
test ecx, ecx
je 0x403ac0
add ecx, 0xc
cmp esi, ecx
jae 0x403ac2
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x403ac8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40228
call fcn.00414220
mov eax, dword [0x41f018]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40218]
xor ebx, ebx
mov dword [ebp - 0x40214], 1
push ebx
push eax
mov esi, ecx
lea eax, [ebp - 0x4020c]
push 0x200
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403cd8
cmp dword [ebp - 0x40218], 0x200
jne 0x403cd8
push 4
lea eax, [ebp - 0x4010b]
push 0x41cb10
push eax
call fcn.004146fe
add esp, 0xc
test eax, eax
jne 0x403b49
inc eax
mov byte [edi], al
jmp 0x403cda
push 5
lea eax, [ebp - 0x4010b]
push str.ustar
push eax
call fcn.004146fe
add esp, 0xc
test eax, eax
jne 0x403cd8
mov ecx, dword [esi + 4]
sub ecx, 0x10
call fcn.00403321
add eax, 0x10
lea ecx, [ebp - 0x40210]
push 0x41cb44
mov dword [ebp - 0x40210], eax
call fcn.00403ced
lea eax, [ebp - 0x4020c]
push eax
lea ecx, [ebp - 0x40210]
call fcn.00403ced
push ebx
push 0x100
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x40210]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40224], eax
cmp eax, 0xffffffff
je 0x403cc9
push 8
lea eax, [ebp - 0x40190]
push ebx
push eax
call fcn.0040d97e
add esp, 0xc
mov dword [ebp - 0x40220], eax
push 1
push ebx
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x40220]
mov edi, ecx
neg edi
add eax, ecx
and edi, 0x1ff
add edi, eax
test ecx, ecx
je 0x403c77
mov eax, 0x40000
mov dword [ebp - 0x4021c], eax
cmp ecx, eax
jae 0x403c1a
mov eax, ecx
mov dword [ebp - 0x4021c], ecx
push ebx
lea ecx, [ebp - 0x40218]
push ecx
push eax
lea eax, [ebp - 0x4000c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x403c71
push ebx
lea eax, [ebp - 0x40218]
push eax
push dword [ebp - 0x4021c]
lea eax, [ebp - 0x4000c]
push eax
push dword [ebp - 0x40224]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403c71
mov ecx, dword [ebp - 0x40220]
sub ecx, dword [ebp - 0x4021c]
mov dword [ebp - 0x40220], ecx
jne 0x403c03
jmp 0x403c77
mov byte [ebp - 0x40214], bl
push dword [ebp - 0x40224]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x40214], bl
je 0x403cb3
cmp byte [esi + 8], bl
je 0x403c9f
lea eax, [ebp - 0x40210]
push eax
lea ecx, [esi + 0xc]
call fcn.00402a16
mov eax, dword [esi + 0x18]
test eax, eax
je 0x403cb3
push dword [ebp - 0x40210]
push dword [esi + 0x1c]
call eax
pop ecx
pop ecx
cmp edi, 0xffffffff
je 0x403cc3
push ebx
push ebx
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov bl, byte [ebp - 0x40214]
lea ecx, [ebp - 0x40210]
call fcn.00403236
mov al, bl
jmp 0x403cda
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406238
mov esp, ebp
pop ebp
ret 4
Function at 0x403d46
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov ecx, dword [ecx]
push ebx
push esi
push edi
sub ecx, 0x10
mov dword [ebp - 8], edx
call fcn.00403321
push 0x44
xor ebx, ebx
push ebx
lea esi, [eax + 0x10]
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], esi
push eax
call fcn.004066f0
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
or dword [ebp - 0x30], 0x81
xor eax, eax
inc eax
mov word [ebp - 0x2c], ax
cmp dword [esi - 4], eax
jle 0x403da7
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.0040351f
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push 0x400
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403dd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x403e08
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 8]
test eax, eax
je 0x403df5
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne bl
jmp 0x403df8
xor ebx, ebx
inc ebx
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
lea ecx, [ebp - 4]
call fcn.00403236
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001f80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x101c2520]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.10122830
add esp, 0xc
mov byte [ebp - 0x20c], 0
push 0x103
push 0
lea ecx, [ebp - 0x20b]
push ecx
call fcn.10122830
add esp, 0xc
mov ecx, 0x101cdb20
call fcn.10002640
test eax, eax
jne 0x10002086
push 0x104
push 0x104
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.10001860
add esp, 0x10
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x41c], ecx
mov edx, dword [ebp - 0x41c]
add edx, 1
mov dword [ebp - 0x42c], edx
mov eax, dword [ebp - 0x41c]
mov cl, byte [eax]
mov byte [ebp - 0x411], cl
add dword [ebp - 0x41c], 1
cmp byte [ebp - 0x411], 0
jne 0x1000201a
mov edx, dword [ebp - 0x41c]
sub edx, dword [ebp - 0x42c]
mov dword [ebp - 0x420], edx
je 0x1000205f
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x101cdb20
call fcn.10002450
jmp 0x10002064
jmp 0x10002198
push 0x101b4754
mov ecx, 0x101cdb20
call fcn.10002490
push 0
mov ecx, 0x101cdb20
call fcn.10002620
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x101cdb08
call fcn.10002640
test eax, eax
jne 0x100020f9
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x418], ecx
mov edx, dword [ebp - 0x418]
add edx, 1
mov dword [ebp - 0x428], edx
mov eax, dword [ebp - 0x418]
mov cl, byte [eax]
mov byte [ebp - 0x412], cl
add dword [ebp - 0x418], 1
cmp byte [ebp - 0x412], 0
jne 0x100020af
mov edx, dword [ebp - 0x418]
sub edx, dword [ebp - 0x428]
mov dword [ebp - 0x424], edx
je 0x100020f4
lea eax, [ebp - 0x20c]
push eax
mov ecx, 0x101cdb08
call fcn.10002450
jmp 0x100020f9
jmp 0x10002198
mov byte [ebp - 0x40c], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x40b]
push ecx
call fcn.10122830
add esp, 0xc
mov ecx, 0x101cdb08
call fcn.10002620
push eax
mov ecx, 0x101cdb20
call fcn.10002620
push eax
push 0x101b4758
lea edx, [ebp - 0x40c]
push edx
call fcn.101203fb
add esp, 0x10
lea eax, [ebp - 0x40c]
push eax
mov ecx, 0x101cdb38
call fcn.10002450
push 0x101b4760
mov ecx, 0x101cdb38
call fcn.10002490
push 0x101cdb04
lea ecx, [ebp - 0x410]
call fcn.10002660
push 0x101b4768
mov ecx, 0x101cdb38
call fcn.10002620
push eax
call fcn.10121148
add esp, 8
mov dword [0x101cdaf4], eax
lea ecx, [ebp - 0x410]
call fcn.10002690
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012032b
mov esp, ebp
pop ebp
ret

Function at 0x10004410
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul edx, edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
imul ecx, ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul ecx, ecx, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x10325476
pop ebp
ret