joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405438
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004056f6
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405477
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x7a1f88], eax
jmp 0x405601
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405491
test eax, eax
je 0x4055af
test bl, 2
je 0x4055af
mov esi, 0x79f500
push edi
push esi
call fcn.00405b78
cmp dword [ebp + 8], 0
je 0x4054b0
push 0x409360
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x4054b6
push edi
call fcn.0040564f
cmp byte [edi], 0
jne 0x4054c4
cmp byte [0x79f500], 0x5c
jne 0x4054cf
push 0x409014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x4055a5
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405633
cmp byte [eax], 0
je 0x405515
cmp byte [ebp - 0x1c], 0
je 0x405515
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x40552b
mov al, byte [esi + 1]
test al, al
je 0x405584
cmp al, 0x2e
jne 0x40552b
cmp byte [esi + 2], 0
je 0x405584
push esi
push ebx
call fcn.00405b78
test byte [ebp - 0x14c], 0x10
je 0x405550
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405584
push dword [ebp + 0xc]
push edi
call fcn.00405438
jmp 0x405584
push dword [ebp - 4]
push edi
call fcn.004053f0
test eax, eax
jne 0x40557c
cmp dword [ebp - 4], eax
je 0x405574
push edi
push 0xfffffffffffffff1
call fcn.00404e63
push 0
push edi
call fcn.00405a2c
jmp 0x405584
inc dword [0x7a1f88]
jmp 0x405584
push edi
push 0xfffffffffffffff2
call fcn.00404e63
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4054f3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x4055af
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405601
cmp dword [ebp - 0xc], esi
jne 0x4055c3
inc dword [0x7a1f88]
jmp 0x405601
push edi
call fcn.00405e7c
test eax, eax
je 0x405601
push edi
call fcn.00405608
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004053f0
test eax, eax
jne 0x4055f9
cmp dword [ebp - 4], esi
je 0x4055bb
push edi
push 0xfffffffffffffff1
call fcn.00404e63
push esi
push edi
call fcn.00405a2c
jmp 0x405601
push edi
push 0xffffffffffffffe5
call fcn.00404e63
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x403cf0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ecx
push edx
push esi
mov ecx, dword [0x43a28c]
xor esi, esi
test ecx, ecx
je 0x403e11
cmp dword [ecx + 8], 0
je 0x403e16
mov eax, 0x98
call fcn.00429e70
mov word [eax + 0x24], 1
or byte [eax + 0xd], 1
mov edx, dword [ecx + 0x38]
mov dx, word [edx]
mov word [eax + 0x20], dx
mov edx, dword [ecx + 0x38]
mov edx, dword [edx + 0x1c]
mov edx, dword [edx + 0x38]
mov dx, word [edx]
mov word [eax + 0x22], dx
mov edx, dword [ecx + 0x38]
mov edx, dword [edx + 0x14]
mov dword [eax + 0x1c], edx
mov edx, dword [ecx + 0x38]
mov dl, byte [edx + 0xc]
and dl, 0xf
mov dh, byte [eax + 0x12]
and dh, 0xf0
mov bl, dh
or bl, dl
mov byte [eax + 0x12], bl
mov edx, dword [ecx + 0x38]
mov bh, bl
mov dl, byte [edx + 0xc]
and bh, 0xf
and dl, 0xf0
mov dh, bh
or dh, dl
mov byte [eax + 0x12], dh
mov edx, dword [ecx + 0x38]
mov bl, byte [eax + 0x13]
mov dl, byte [edx + 0xd]
and bl, 0xfe
shl dl, 5
shr dl, 7
mov bh, bl
and dl, 1
or bh, dl
mov dl, bh
and dl, 0xfd
mov byte [eax + 0x13], dl
mov edx, dword [ecx + 0x38]
mov dx, word [edx + 0x18]
mov dword [eax + 0x18], 0
inc esi
mov word [eax + 0x14], dx
xor edx, edx
mov word [eax + 0x10], si
call fcn.0042abe0
mov eax, dword [ecx + 0x38]
cmp byte [eax + 0xe], 1
jne 0x403e00
mov eax, 0x88
mov edx, 3
call fcn.00429e70
mov byte [eax + 0x10], 0x80
mov ebx, eax
mov byte [eax + 0x11], 0xfe
call fcn.00429f20
mov edx, 0x4f
mov eax, ebx
call fcn.0042a060
movzx edx, si
mov eax, ebx
call fcn.0042a0c0
mov ax, word [ebx + 6]
mov edx, 1
mov word [ebx + 4], ax
mov eax, ebx
call fcn.0042abe0
mov eax, dword [ecx + 0x38]
mov word [eax], si
mov ecx, dword [ecx + 0x40]
test ecx, ecx
jne 0x403d04
pop esi
pop edx
pop ecx
pop ebx
ret
mov edx, dword [ecx + 4]
push edx
push 0xd4
call fcn.0040e6a0
add esp, 8
mov ecx, dword [ecx + 0x40]
test ecx, ecx
jne 0x403d04
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x411a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 8
mov ecx, eax
mov bh, bl
mov eax, dword [0x4384dc]
mov eax, dword [eax + 0x38]
mov dword [esp + 4], eax
mov eax, dword [eax]
mov dword [esp], eax
mov eax, 0x10
call fcn.0040e510
mov ebp, eax
cmp bl, 0x65
jb 0x411a9f
xor bh, bl
movzx eax, bh
imul eax, eax, 0x14
cmp byte [edx + eax], 0
jne 0x411b2c
test byte [0x43807b], 8
je 0x411b3c
mov dword [ebp + 0xc], ecx
movzx eax, bh
imul eax, eax, 0x14
xor esi, esi
mov bl, bh
mov eax, dword [edx + eax + 4]
inc bl
call fcn.0040e530
mov dword [ebp + 4], eax
cmp bl, 0x65
jae 0x411ad9
movzx eax, bl
imul eax, eax, 0x14
add eax, edx
cmp byte [eax], 0
jne 0x411b48
lea eax, [esi + 1]
call fcn.0040e510
mov bl, bh
mov dword [ebp + 8], eax
inc bl
mov byte [eax], 0
cmp bl, 0x65
jae 0x411b02
movzx eax, bl
imul eax, eax, 0x14
add eax, edx
mov bh, byte [eax]
test bh, bh
jne 0x411b7d
mov eax, dword [esp + 4]
mov dword [ebp], 0
cmp dword [eax + 8], 0
jne 0x411c50
mov dword [eax + 8], ebp
mov eax, dword [esp + 4]
mov dword [eax + 0xc], ebp
mov eax, dword [esp]
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
inc bh
cmp bh, 0x65
jb 0x411a8f
jmp 0x411a9f
mov dword [ebp + 0xc], 0
jmp 0x411aaf
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x411b5e
mov edi, ecx
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc ecx
add esi, ecx
movzx eax, bl
imul eax, eax, 0x14
cmp byte [edx + eax], 5
jne 0x411b6d
add esi, 2
inc bl
cmp bl, 0x65
jb 0x411acc
jmp 0x411ad9
cmp bh, 5
jne 0x411bac
mov esi, 0x411652
mov edi, dword [ebp + 8]
push edi
sub ecx, ecx
dec ecx
mov al, 0
repne scasb al, byte es:[edi]
dec edi
mov al, byte [esi]
mov byte [edi], al
cmp al, 0
je 0x411bab
mov al, byte [esi + 1]
add esi, 2
mov byte [edi + 1], al
add edi, 2
cmp al, 0
jne 0x411b93
pop edi
movzx eax, bl
imul eax, eax, 0x14
add eax, edx
mov esi, dword [eax + 4]
test esi, esi
je 0x411be0
mov edi, dword [ebp + 8]
push edi
sub ecx, ecx
dec ecx
mov al, 0
repne scasb al, byte es:[edi]
dec edi
mov al, byte [esi]
mov byte [edi], al
cmp al, 0
je 0x411bdf
mov al, byte [esi + 1]
add esi, 2
mov byte [edi + 1], al
add edi, 2
cmp al, 0
jne 0x411bc7
pop edi
movzx eax, bl
imul eax, eax, 0x14
cmp byte [edx + eax], 5
jne 0x411c16
mov esi, 0x411650
mov edi, dword [ebp + 8]
push edi
sub ecx, ecx
dec ecx
mov al, 0
repne scasb al, byte es:[edi]
dec edi
mov al, byte [esi]
mov byte [edi], al
cmp al, 0
je 0x411c15
mov al, byte [esi + 1]
add esi, 2
mov byte [edi + 1], al
add edi, 2
cmp al, 0
jne 0x411bfd
pop edi
mov esi, 0x411656
mov edi, dword [ebp + 8]
inc bl
push edi
sub ecx, ecx
dec ecx
mov al, 0
repne scasb al, byte es:[edi]
dec edi
mov al, byte [esi]
mov byte [edi], al
cmp al, 0
je 0x411c41
mov al, byte [esi + 1]
add esi, 2
mov byte [edi + 1], al
add edi, 2
cmp al, 0
jne 0x411c29
pop edi
cmp bl, 0x65
jb 0x411af0
jmp 0x411b02
mov eax, dword [eax + 0xc]
mov dword [eax], ebp
mov eax, dword [esp + 4]
mov dword [eax + 0xc], ebp
mov eax, dword [esp]
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
Function at 0x4013ef
Capabilities:
Terminate process

Disassembly:
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x4012c6
mov dword [0x404144], esi
jmp 0x401271
push 0x58
push 0x4012f8
call fcn.00401124
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x404038
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x402342
xor esi, esi
inc esi
mov eax, dword [0x404034]
cmp eax, esi
je 0x402360
mov eax, dword [0x404034]
test eax, eax
jne 0x4011e2
mov dword [0x404034], esi
push 0x4012f0
push 0x4012e8
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
jne 0x4023f6
mov eax, dword [0x404034]
cmp eax, esi
jne 0x401295
push 0x4012e4
push 0x4012dc
call fcn.00533000
pop ecx
pop ecx
mov dword [0x404034], 2
test ebx, ebx
jne 0x4012a1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x404044], 0
jne 0x40236d
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
jbe 0x401320
cmp al, 0x22
je 0x4011d2
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
jne 0x40239a
inc esi
jmp 0x4012b5
test al, al
je 0x40132a
cmp dword [ebp - 0x1c], 0
jne 0x4012be
mov al, byte [esi]
test al, al
je 0x4018ee
cmp al, 0x20
ja 0x4018ee
inc esi
mov dword [ebp - 0x20], esi
jmp 0x40132a
call fcn.004013f9
jmp 0x4011ed
test byte [ebp - 0x3c], 1
jne 0x402391
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call 0x401922
mov dword [0x404058], eax
cmp dword [0x404054], 0
jne 0x4023d2
push eax
call dword [sym.imp.MSVCR80.dll_exit]
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.00401342
push eax
call fcn.00401a08
pop ebp
ret 0x10
cmp eax, esi
jne 0x402350
xor esi, esi
inc esi
mov ebx, esi
jmp 0x40123c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401227
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x401271
push 0x404044
call fcn.00402be3
pop ecx
test eax, eax
je 0x4012ae
push 0
push 2
push 0
call dword [0x404044]
jmp 0x4012ae
movzx eax, word [ebp - 0x38]
jmp 0x4018fb
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4012d9
cmp dword [0x404144], 0
jne 0x4023e1
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x404058]
jmp 0x402402
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00401674
ret
Function at 0x100018d5
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0
mov eax, 0x1003371e
call fcn.10032d06
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1004cb38]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1004ddac]
cmp eax, dword [ecx + 4]
jle 0x10001937
mov esi, 0x1004ddac
push esi
call fcn.1000f29d
cmp dword [0x1004ddac], 0xffffffff
pop ecx
jne 0x10001937
and dword [ebp - 4], 0
mov eax, 0x1000
push 0x40
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1004dda8], eax
or dword [ebp - 4], 0xffffffff
push esi
call fcn.1000f253
pop ecx
mov edx, dword [0x1004dda8]
lea esi, [edx + 0x1000]
jmp 0x10001954
lea ecx, [edx + 0x1c]
call fcn.100018d0
test eax, eax
je 0x10001960
add edx, 0x20
cmp edx, esi
jne 0x10001945
xor eax, eax
call fcn.10032ccf
ret
mov eax, edx
jmp 0x1000195a

Function at 0x10001964
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 0xc], ebx
cmp byte [edi], 0xe9
jne 0x10001985
lea ecx, [edi + 5]
add ecx, dword [edi + 1]
call fcn.10001964
jmp 0x100019f8
push esi
call fcn.100018d5
mov dword [ebp - 4], eax
xor esi, esi
lea ecx, [esi + edi]
call fcn.10001690
add esi, eax
cmp esi, 5
jl 0x10001990
test esi, esi
jle 0x100019ba
mov ecx, dword [ebp - 4]
mov edx, edi
sub edx, ecx
mov ebx, esi
mov al, byte [edx + ecx]
mov byte [ecx], al
inc ecx
sub ebx, 1
jne 0x100019ac
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea eax, [edi - 5]
add ecx, esi
sub esi, ecx
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 1], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
mov byte [ecx], 0xe9
call esi
lea eax, [ebp - 8]
mov byte [edi], 0xe9
push eax
push dword [ebp - 8]
sub ebx, edi
push 5
sub ebx, 5
push edi
mov dword [edi + 1], ebx
call esi
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x100019fc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push 0x40
mov edx, esi
pop edi
mov eax, edx
and eax, 7
mov al, byte [eax + ecx]
mov byte [edx + ebx], al
inc edx
sub edi, 1
jne 0x10001a0c
mov edi, 0x100
mov edx, esi
and edx, 0x3f
movzx eax, byte [edx + ebx]
movzx eax, byte [eax + 0x10044b40]
movzx ecx, byte [eax + 0x10044b40]
movzx eax, byte [esi + 0x10044c40]
movzx eax, byte [eax + 0x10044c40]
xor ecx, eax
inc esi
mov al, byte [ecx + 0x10044c40]
mov byte [edx + ebx], al
sub edi, 1
jne 0x10001a22
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1000347a
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x1004bbb5], 0
je 0x1000349c
xor ecx, ecx
mov al, 0xd5
sub al, cl
xor byte [ecx + 0x1004bb64], al
inc ecx
cmp ecx, 0xf
jb 0x10003485
mov byte [0x1004bbb5], 0
mov eax, 0x1004bb64
ret

Function at 0x100034a2
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x1004baf0], 0
je 0x100034c4
xor ecx, ecx
mov al, 0x71
sub al, cl
xor byte [ecx + 0x1004b9fc], al
inc ecx
cmp ecx, 0xd
jb 0x100034ad
mov byte [0x1004baf0], 0
mov eax, 0x1004b9fc
ret
Function at 0x100034ca
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp 0x100034e3
jmp 0x100034f5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor edi, edi
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x10003536
call fcn.100034ca
cmp dword [ebp - 4], 0x103
jne 0x10003546
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000354b
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c8c
call fcn.10033160
mov eax, dword [0x1004b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x2c8c], ecx
jmp 0x1000357d
jmp 0x1000358f
lea eax, [ebp - 0x2c88]
mov dword [ebp - 0x2c88], 0x2880
push eax
lea eax, [ebp - 0x2c84]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x100035b8
xor al, al
jmp 0x10003661
cmp byte [ebp - 0x2af0], 0
lea ecx, [ebp - 0x2c84]
jne 0x100035ff
cmp byte [ecx + 0x195], 0
jne 0x100035ff
cmp byte [ecx + 0x196], 0
jne 0x100035ff
cmp byte [ecx + 0x197], 0
jne 0x100035ff
cmp byte [ecx + 0x198], 0
jne 0x100035ff
cmp byte [ecx + 0x199], 0
jne 0x100035ff
mov ecx, dword [ecx]
cmp byte [ecx + 0x194], 0
je 0x100035c7
movzx eax, byte [ecx + 0x199]
mov esi, 0x3e8
push eax
movzx eax, byte [ecx + 0x198]
push eax
movzx eax, byte [ecx + 0x197]
push eax
movzx eax, byte [ecx + 0x196]
push eax
movzx eax, byte [ecx + 0x195]
push eax
movzx eax, byte [ecx + 0x194]
push eax
push str._02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.10001abd
push esi
lea eax, [ebp - 0x404]
push eax
push esi
push dword [ebp - 0x2c8c]
push 0
call fcn.1001efd9
add esp, 0x38
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000f0cf
leave
ret
Function at 0x1000373a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x203b0
call fcn.10033160
mov eax, dword [0x1004b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp 0x10003766
jmp 0x10003778
mov eax, dword [0x1004dc50]
test eax, eax
je 0x1000396e
mov ecx, dword [ebp + 0x10]
lea edi, [ebp + 0x14]
xor ebx, ebx
mov cl, byte [ecx]
test cl, cl
je 0x10003895
movsx eax, cl
sub eax, 0x51
je 0x10003866
dec eax
sub eax, 1
je 0x1000381e
sub eax, 0xf
je 0x10003800
sub eax, 1
je 0x100037f1
sub eax, 1
je 0x100037dd
sub eax, 4
je 0x100037c7
call fcn.100034ca
jmp 0x1000387f
mov ax, word [edi]
add edi, 4
mov word [ebp + ebx - 0x203a4], ax
add ebx, 2
jmp 0x1000387f
mov eax, dword [edi]
add edi, 4
mov dword [ebp + ebx - 0x203a4], eax
add ebx, 4
jmp 0x1000387f
mov al, byte [edi]
add edi, 4
mov byte [ebp + ebx - 0x203a4], al
inc ebx
jmp 0x1000387f
mov esi, dword [edi]
lea eax, [ebp - 0x203a4]
add edi, 8
add eax, ebx
push esi
push dword [edi - 4]
push eax
call fcn.10013820
add esp, 0xc
add ebx, esi
jmp 0x1000387f
mov esi, dword [edi]
add edi, 4
test esi, esi
jne 0x10003836
push 2
xor ecx, ecx
pop eax
mov word [ebp + ebx - 0x203a4], cx
jmp 0x10003862
push esi
call fcn.1001ed62
lea eax, [eax*2 + 2]
push eax
mov dword [ebp - 0x203ac], eax
lea eax, [ebp - 0x203a4]
add eax, ebx
push esi
push eax
call fcn.10013820
mov eax, dword [ebp - 0x203ac]
add esp, 0x10
add ebx, eax
jmp 0x1000387f
mov eax, dword [edi]
add edi, 8
mov dword [ebp + ebx - 0x203a4], eax
mov eax, dword [edi - 4]
mov dword [ebp + ebx - 0x203a0], eax
add ebx, 8
mov eax, dword [ebp + 0x10]
inc eax
mov dword [ebp + 0x10], eax
mov cl, byte [eax]
test cl, cl
jne 0x10003797
mov eax, dword [0x1004dc50]
test eax, eax
je 0x1000396e
cmp byte [0x1004bb76], 0
je 0x100038bf
xor ecx, ecx
mov al, 0xd2
sub al, cl
xor byte [ecx + 0x1004baf4], al
inc ecx
cmp ecx, 0x18
jb 0x100038a8
mov byte [0x1004bb76], 0
push 0x1004baf4
push dword [0x1004dc54]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10003917
mov esi, dword [0x1004dd8c]
lea edx, [ebp - 0x203ac]
push esi
push dword [0x1004dd88]
lea ecx, [ebp - 0x203b0]
mov dword [ebp - 0x203ac], 0x25
call fcn.10008a3f
pop ecx
pop ecx
cmp dword [eax], esi
jne 0x1000396e
lea eax, [ebp - 0x203a5]
mov byte [ebp - 0x203a5], 0x25
push eax
call fcn.10005097
jmp 0x1000396e
mov esi, dword [eax]
mov ecx, esi
push 0
push 0xc
mov eax, dword [esi]
call dword [eax]
mov edx, dword [esi]
mov ecx, esi
push 0
push ebx
mov edi, eax
call dword [edx]
push ebx
lea ecx, [ebp - 0x203a4]
mov dword [edi + 8], eax
push ecx
push eax
call fcn.10013820
mov al, byte [ebp + 8]
add esp, 0xc
mov ecx, dword [0x1004dc50]
xor edx, edx
mov byte [edi], al
mov al, byte [ebp + 0xc]
mov byte [edi + 2], al
xor eax, eax
push edi
mov byte [edi + 1], 0
mov word [edi + 6], ax
mov byte [edi + 3], 0xff
mov word [edi + 4], bx
call dword [0x1004dc5c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000f0cf
leave
ret
Function at 0x1000397d
Capabilities:
Encode data using xor

Disassembly:
push 0x4c0
mov eax, 0x10033f80
call fcn.10032d3a
mov esi, ecx
or ecx, 0xffffffff
call fcn.1000ad04
push ecx
push ecx
push 0x20
push esi
lea ecx, [ebp - 0x4cc]
mov ebx, eax
call fcn.10005327
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x4cc]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x4c0], 6
jne 0x10003a74
mov ecx, dword [0x1004cb38]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x414], eax
push ecx
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x4cc]
call fcn.10006349
mov ecx, dword [ebp - 0x414]
lea edi, [ebp - 0x410]
mov eax, dword [0x1004e1b8]
mov esi, dword [ebp - 0x4c4]
cmp eax, dword [ecx + 4]
jle 0x10003a3c
push 0x1004e1b8
call fcn.1000f29d
cmp dword [0x1004e1b8], 0xffffffff
pop ecx
jne 0x10003a3c
mov byte [ebp - 4], 1
call fcn.10009c94
mov dword [0x1004e1cc], eax
mov byte [ebp - 4], 0
push 0x1004e1b8
call fcn.1000f253
pop ecx
test esi, esi
je 0x10003a59
mov ecx, dword [0x1004e1cc]
mov al, byte [edi]
xor al, bl
shr ebx, 8
movzx eax, al
inc edi
xor ebx, dword [ecx + eax*4]
sub esi, 1
jne 0x10003a46
mov eax, dword [ebp - 0x4cc]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x4c0], 6
je 0x100039d8
not ebx
jmp 0x10003a76
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x45c]
call fcn.100052aa
lea ecx, [ebp - 0x45c]
call fcn.1000667d
mov eax, ebx
call fcn.10032ce4
ret

Function at 0x10004a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
jmp 0x10004a21
jmp 0x10004a33
xor ebx, ebx
mov dword [ebp - 8], ebx
cmp byte [0x1004bc7d], bl
je 0x10004a58
mov edx, ebx
mov al, 0x28
sub al, dl
xor byte [edx + str.fSwPAQ_hNyqoqznpwyBfvsu], al
inc edx
cmp edx, 0x18
jb 0x10004a42
mov byte [0x1004bc7d], bl
cmp byte [0x1004baf1], bl
je 0x10004a78
mov ecx, ebx
mov al, 0x3f
sub al, cl
xor byte [ecx + str.QJYPW], al
inc ecx
cmp ecx, 9
jb 0x10004a62
mov byte [0x1004baf1], bl
push str.fSwPAQ_hNyqoqznpwyBfvsu
push str.QJYPW
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10004ad3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push ebx
push 0x40
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x10004ad3
push ebx
push 4
lea eax, [ebp - 8]
push eax
push 9
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10004ad3
xor eax, eax
jmp 0x10004ad6
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100055a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100055c7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10006472
jmp 0x1000567c
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x100055e9
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x100055eb
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10005670
jg 0x10005600
test esi, esi
je 0x10005670
test ecx, ecx
jl 0x10005649
jg 0x1000560a
test eax, eax
je 0x10005649
cmp edi, ecx
jg 0x1000561e
jl 0x10005614
cmp esi, eax
jae 0x1000561e
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.10013820
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1000564c
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10005670
jg 0x10005656
test esi, esi
je 0x10005670
cmp dword [ebx + 0x4c], 0
je 0x10005670
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.1001e7fc
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc