joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445772
Capabilities:
Check if file exists
Create thread
Delete file
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push ebx
push esi
push 0x506b84
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
cmp dword [0x506db8], ebx
je 0x44588b
cmp word [0x506bb0], bx
je 0x44588b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, 0x506bb0
push esi
lea eax, [ebp - 0x210]
push eax
call edi
push 0x104
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push esi
call fcn.00424949
test eax, eax
je 0x44583a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44583a
push 0x2e
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov ebx, eax
test ebx, ebx
je 0x445838
xor eax, eax
mov word [ebx], ax
push esi
lea eax, [ebp - 0x620]
push eax
call edi
add ebx, 2
push ebx
lea eax, [ebp - 0x418]
push eax
call edi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x620]
push eax
push str._s__u._s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
xor ebx, ebx
cmp dword [0x506db8], ebx
je 0x44588a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x445853
call fcn.00445624
cmp dword [0x506dc0], ebx
je 0x44588a
mov al, byte [0x506bb0]
push ebx
mov esi, str..X:
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
push ebx
push 3
movsw word es:[edi], word [esi]
push ebx
push 3
movsb byte es:[edi], byte [esi]
mov byte [ebp - 4], al
push 0xc0000000
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x4931f4], eax
pop edi
xor esi, esi
inc esi
cmp dword [0x506b70], ebx
jne 0x4458c0
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x506b70], eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x445552
push ebx
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x506b6c], eax
mov dword [0x506dc4], esi
pop esi
pop ebx
leave
ret

Function at 0x4471ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push 0x5c
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
test esi, esi
jne 0x44720c
mov esi, dword [ebp + 8]
push str.api_ms_win_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, esi
jne 0x447221
xor eax, eax
inc eax
jmp 0x44726a
push 0x104
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x447268
test esi, esi
je 0x447268
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push 0x449eb0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
call fcn.00424949
test eax, eax
jne 0x44721c
xor eax, eax
pop esi
leave
ret 4
Function at 0x44726f
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x6a8
push esi
push edi
mov esi, str.psapi.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x4472c1
push esi
call fcn.0042596f
mov edi, eax
test edi, edi
jne 0x4472c1
cmp dword [0x4f9b60], 0x500
jbe 0x4472ba
push 0x10
push dword [0x492a1c]
push str.Error:_psapi.dll_not_loaded
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x447464
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.EnumProcessModules
push edi
call esi
push str.GetModuleFileNameExW
push edi
mov ebx, eax
call esi
xor esi, esi
mov dword [ebp + 0x68], eax
cmp ebx, esi
je 0x44744f
cmp eax, esi
je 0x44744f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 0x74], eax
cmp eax, esi
je 0x447461
push 0x18c
xor edi, edi
lea eax, [ebp - 0x42c]
push esi
inc edi
push eax
mov dword [ebp + 0x6c], edi
mov dword [ebp - 0x430], esi
call fcn.0043f481
add esp, 0xc
push 0x40
lea eax, [ebp - 0x2a0]
push eax
mov dword [ebp + 0x70], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x40
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x70]
push eax
push 0x190
lea eax, [ebp - 0x430]
push eax
push dword [ebp + 0x74]
call ebx
test eax, eax
je 0x447441
mov esi, dword [ebp + 0x70]
shr esi, 2
cmp esi, edi
jle 0x447441
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp + edi*4 - 0x430]
push dword [ebp + 0x74]
call dword [ebp + 0x68]
test eax, eax
je 0x4473d3
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x220]
push eax
call ebx
lea ecx, [ebp - 0x220]
cmp ecx, eax
je 0x4473d3
lea eax, [ebp - 0x18]
push eax
mov eax, ecx
push eax
call ebx
lea ecx, [ebp - 0x220]
cmp ecx, eax
je 0x4473d3
mov eax, ecx
push eax
call fcn.004471ec
test eax, eax
jne 0x4473da
inc edi
cmp edi, esi
jl 0x44737d
jmp 0x447441
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x447401
test al, 6
je 0x447401
and eax, 0xfffffff9
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x630]
push str.ERROR:_System_DLL_was_not_loaded_from__S:_r_n_r_n_S_r_n_r_nProbably_it_is_Malware_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push dword [0x492a1c]
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
and dword [ebp + 0x6c], 0
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x6c]
jmp 0x447463
push esi
push 0x4723f8
push 0x4723f4
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebx
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x4475fe
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov ebx, 0x4f9cf0
push ebx
lea eax, [ebp - 0x664]
push str.__s.dll
push eax
call esi
and dword [ebp - 0x254], 0
push 0x24c
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.0043f481
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esp, 0x18
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call edi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x447692
push ebx
lea eax, [ebp - 0x664]
push str._s.dll
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call edi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x447692
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
test byte [ebp - 0x254], 0x10
jne 0x4476dc
lea eax, [ebp - 0x228]
push eax
call fcn.004471ec
test eax, eax
je 0x4476bb
lea eax, [ebp - 0x228]
push eax
call fcn.0044746b
test eax, eax
je 0x4476f4
cmp word [ebp - 0x20], 0
je 0x4476dc
lea eax, [ebp - 0x20]
push eax
call fcn.004471ec
test eax, eax
je 0x4476dc
lea eax, [ebp - 0x20]
push eax
call fcn.0044746b
test eax, eax
je 0x447715
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x447692
xor esi, esi
jmp 0x447725
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x44768b
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x44768b

Function at 0x447735
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 0x810
cmp dword [0x4fa134], eax
je 0x44774b
inc eax
leave
ret
push esi
push edi
mov edi, 0x206
push edi
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push 0
push eax
call fcn.0043f481
add esp, 0xc
push 0x4f9808
mov esi, 0x4f9cf0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x447823
lea eax, [ebp - 0x410]
push eax
call fcn.004475fe
test eax, eax
je 0x447823
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x810]
push str.Suspicious_System_DLL___S__found_in_UsbTreeViews_folder____abort_for_safety
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
push edi
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.0043f481
add esp, 0x18
push 0x104
lea eax, [ebp - 0x208]
push eax
push str._TEMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, esi
jne 0x447806
push str._n_nHint:_Starting_applications_from_TEMP_folder_is_risky.
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10
push 0x44d534
lea eax, [ebp - 0x810]
push eax
push dword [0x4fa140]
call fcn.00446ab6
xor eax, eax
jmp 0x447826
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x4032da
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x4174c4
call fcn.00411c04
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.00401e1e
push 0
push 0x1f4
mov ecx, edi
call fcn.00405ef8
push 0x45
lea ecx, [ebp - 0x18]
pop edx
call fcn.00405d5f
mov edx, dword [eax]
mov ecx, dword [esi + 0x6c]
and dword [ebp - 4], 0
call fcn.00405d79
push dword [ebp - 0x18]
call fcn.004038e4
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x404631
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret

Function at 0x40464c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4200b8], 0
push esi
mov esi, edx
jne 0x404684
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.00404694
mov eax, dword [eax]
mov edx, esi
mov ecx, eax
call fcn.00404631
mov bl, al
push dword [ebp - 0xc]
call fcn.004038e4
pop ecx
mov al, bl
pop ebx
jmp 0x404691
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop esi
leave
ret

Function at 0x4046e3
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4200b8], 0
jne 0x404714
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.00404694
mov ecx, dword [eax]
call fcn.0040463f
mov bl, al
push dword [ebp - 0xc]
call fcn.004038e4
pop ecx
mov al, bl
pop ebx
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
leave
ret

Function at 0x404731
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4200b8], 0
jne 0x404762
mov edx, ecx
push ebx
lea ecx, [ebp - 0xc]
call fcn.00404694
mov ecx, dword [eax]
call fcn.00404722
mov bl, al
push dword [ebp - 0xc]
call fcn.004038e4
pop ecx
mov al, bl
pop ebx
leave
ret
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
leave
ret

Function at 0x40498f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4200b8], 0
push esi
mov esi, ecx
jne 0x4049c3
push ebx
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.00404694
mov ecx, dword [eax]
call fcn.00404971
mov bl, al
push dword [ebp - 0xc]
call fcn.004038e4
pop ecx
mov al, bl
pop ebx
jmp 0x4049dc
xor edx, edx
mov ecx, esi
call fcn.0040464c
test al, al
je 0x4049dc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
leave
ret

Function at 0x404e44
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, edx
mov ebx, ecx
cmp dword [esi + 8], 0x105
jg 0x404e64
push 0x106
mov ecx, esi
call fcn.004024de
push dword [esi]
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, esi
mov edi, eax
call fcn.00405064
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x404f64
Capabilities:
Delete file

Disassembly:
mov eax, 0x417804
call fcn.00411c04
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 0x1c]
call fcn.0040501a
xor ebx, ebx
push esi
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.00404eb7
test al, al
je 0x404ff8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x404fe3
mov ecx, dword [esi]
call fcn.004055fe
test al, al
jne 0x404fc2
mov ecx, dword [esi]
call fcn.00404722
test al, al
jne 0x404fe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404ff8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404f40
push dword [ebp - 0x18]
call fcn.004038e4
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.0040501a
jmp 0x404f82
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.00404f40
push dword [ebp - 0x18]
call fcn.004038e4
pop ecx
mov al, bl
jmp 0x40500b
lea ecx, [ebp - 0x1c]
call fcn.00404f40
push dword [ebp - 0x18]
call fcn.004038e4
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40548c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x417870
call fcn.00411c04
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 1
mov eax, dword [edi]
push 0
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
push 0
mov dword [esi + 0x18], eax
push dword [edi + 0x1c]
call fcn.00412400
mov ecx, dword [edi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x2c]
adc edx, ebx
push eax
mov dword [esi + 0x24], edx
call fcn.004039e4
and dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
lea edx, [ebp - 0x18]
inc eax
lea ecx, [ebp - 0x24]
push eax
call fcn.0040553f
push eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00401e1e
push dword [ebp - 0x24]
call fcn.004038e4
push dword [ebp - 0x18]
call fcn.004038e4
mov eax, dword [edi + 0x24]
pop ecx
pop ecx
mov dword [esi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4057d2
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4057f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4057f8
xor al, al
jmp 0x405818
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00412400
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x408f80
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x417dc7
call fcn.00411c04
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x41964c
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x419644
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00404124
push dword [esi + 8]
mov ecx, ebx
call fcn.00404124
push dword [esi + 0xc]
mov ecx, edi
call fcn.00404124
push dword [esi + 0xc]
mov ecx, edi
call fcn.00404124
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x408f8c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x417dc7
call fcn.00411c04
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x41964c
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x419644
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00404124
push dword [esi + 8]
mov ecx, ebx
call fcn.00404124
push dword [esi + 0xc]
mov ecx, edi
call fcn.00404124
push dword [esi + 0xc]
mov ecx, edi
call fcn.00404124
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x411510
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 8]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.004127bf
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.004114e0
pop esi
ret 4
Function at 0x4171a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, ecx
mov esi, edx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
test edi, edi
je 0x4171cf
test esi, 7
je 0x4171cf
movzx edx, byte [esi]
inc esi
movzx ebx, al
xor edx, ebx
shr eax, 8
xor eax, dword [ebp + edx*4]
dec edi
jne 0x4171b4
cmp edi, 0x10
jb 0x417258
mov dword [esp + 0x14], edi
sub edi, 8
and edi, 0xfffffff8
sub dword [esp + 0x14], edi
add edi, esi
xor eax, dword [esi]
mov ebx, dword [esi + 4]
movzx ecx, bl
mov edx, dword [ebp + ecx*4 + 0xc00]
movzx ecx, bh
xor edx, dword [ebp + ecx*4 + 0x800]
shr ebx, 0x10
movzx ecx, bl
xor edx, dword [ebp + ecx*4 + 0x400]
xor edx, dword [esi + 8]
movzx ecx, al
movzx ebx, bh
xor edx, dword [ebp + ebx*4]
mov ebx, dword [esi + 0xc]
xor edx, dword [ebp + ecx*4 + 0x1c00]
movzx ecx, ah
add esi, 8
shr eax, 0x10
xor edx, dword [ebp + ecx*4 + 0x1800]
movzx ecx, al
xor edx, dword [ebp + ecx*4 + 0x1400]
movzx ecx, ah
mov eax, dword [ebp + ecx*4 + 0x1000]
movzx ecx, bl
xor eax, edx
cmp esi, edi
jne 0x4171f0
xor eax, dword [esi]
mov edi, dword [esp + 0x14]
test edi, edi
je 0x41726f
movzx edx, byte [esi]
inc esi
movzx ebx, al
xor edx, ebx
shr eax, 8
xor eax, dword [ebp + edx*4]
dec edi
jne 0x41725c
pop ebp
pop edi
pop esi
pop ebx
ret 8
Function at 0x100a5640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x32d8724]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x27], 3
mov byte [ebp - 0x26], 0x8a
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x24], 3
mov byte [ebp - 0x23], 0xff
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x21], 5
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0xc
mov byte [ebp - 0x1d], 0x29
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0x1c
mov byte [ebp - 0x1a], 0x42
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x17], 0x53
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0x50
mov byte [ebp - 0x14], 0x56
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0x50
mov byte [ebp - 0x11], 0x77
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0xf2
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x45
mov byte [ebp - 0xa], 0xff
mov byte [ebp - 9], 0xff
mov byte [ebp - 8], 0xff
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 2]
cmp ecx, 0x20
jne 0x100a570b
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
cmp eax, 0x52
jne 0x100a570b
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x41
jne 0x100a570b
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
cmp ecx, 0x53
jne 0x100a570b
mov al, 1
jmp 0x100a57ea
mov dword [ebp - 0x2c], 0
jmp 0x100a571d
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x28]
cmp ecx, 0xff
je 0x100a5777
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x2c]
imul ecx, ecx, 3
movzx edx, byte [ebp + ecx - 0x28]
cmp eax, edx
jne 0x100a5775
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x2c]
imul edx, edx, 3
movzx eax, byte [ebp + edx - 0x27]
cmp ecx, eax
jne 0x100a5775
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 2]
mov eax, dword [ebp - 0x2c]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x26]
cmp edx, ecx
jne 0x100a5775
mov al, 1
jmp 0x100a57ea
jmp 0x100a5714
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
test eax, eax
jne 0x100a5794
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 1]
cmp edx, 0xfc
jne 0x100a5794
mov al, 1
jmp 0x100a57ea
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 3]
test ecx, ecx
jne 0x100a57cd
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 4]
cmp eax, 0x30
jne 0x100a57cd
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 5]
test edx, edx
jne 0x100a57cd
call fcn.100e2b50
xor edx, edx
mov ecx, 0x64
div ecx
cmp eax, 4
jne 0x100a57cd
mov al, 1
jmp 0x100a57ea
push 6
push 0x32a264c
mov edx, dword [ebp + 8]
push edx
call fcn.1014d841
add esp, 0xc
test eax, eax
jne 0x100a57e8
mov al, 1
jmp 0x100a57ea
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d28a
mov esp, ebp
pop ebp
ret
Function at 0x100bbf90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x328eb08
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x32d8724]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x84], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x84]
call fcn.100bbe70
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x100bc0ab
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.100c2c30
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x54], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x54]
cmp dword [eax + 0x14], 0x10
jb 0x100bc025
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx]
mov dword [ebp - 0x8c], edx
jmp 0x100bc02e
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x8c], eax
push 0x32a3874
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.101512ea
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10042f50
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x100bc0ab
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.101515e1
add esp, 0x10
mov edx, dword [ebp - 0x4c]
push edx
call fcn.10150f53
add esp, 4
mov byte [ebp - 0x4d], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.100868f0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4d]
jmp 0x100bc0d3
mov byte [ebp - 0x4e], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.100868f0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x4e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d28a
mov esp, ebp
pop ebp
ret 0xc