joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e56e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x212d50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.007a5070
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
call fcn.006dc7e0
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.006dc7e0
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.006ff0a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.006ff0a0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.006ff0a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x70cd60
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea ecx, [ebp - 8]
call fcn.006e5910
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18]
push ecx
lea ecx, [ebp - 0x18]
call fcn.006e57e0
lea ecx, [ebp - 0x18]
call fcn.006e5840
movzx edx, al
test edx, edx
je 0x70cdd8
lea ecx, [ebp - 0x18]
call fcn.006e5870
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xc], 0
je 0x70cdd8
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0x18]
call fcn.006e5890
push eax
call fcn.0071bb10
add esp, 4
cmp eax, 0x53b2070f
jne 0x70cdd6
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.006e58c0
jmp 0x70cde9
jmp 0x70cd97
lea ecx, [ebp - 8]
call fcn.006e5930
movzx ecx, al
test ecx, ecx
jne 0x70cd6e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x73ce33
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x243054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
and edx, 0xfffffffe
push edi
mov edi, dword [ebx + 8]
movups xmm6, xmmword [esi]
cmp edx, edi
jae 0x73cf35
lea ecx, [edx + 1]
xorps xmm5, xmm5
xorps xmm7, xmm7
shl ecx, 4
pslldq xmm7, 8
add ecx, esi
psrldq xmm5, 8
movups xmm4, xmmword [ecx - 0x20]
lea ecx, [ecx + 0x20]
movaps xmm3, xmm4
movaps xmm0, xmm4
pclmulqdq xmm0, xmm6, 1
pclmulqdq xmm3, xmm6, 0x10
pxor xmm3, xmm0
movaps xmm1, xmm4
pclmulqdq xmm1, xmm6, 0
movaps xmm0, xmm3
mov eax, edx
pslldq xmm0, 8
add edx, 2
pxor xmm1, xmm0
psrldq xmm3, 8
movaps xmm2, xmm1
pshufd xmm0, xmm1, 0x4e
pclmulqdq xmm2, xmmword [0x21a930], 0
pxor xmm2, xmm0
shr eax, 1
movaps xmm1, xmm2
pshufd xmm0, xmm2, 0x4e
pclmulqdq xmm1, xmmword [0x21a930], 0
pxor xmm1, xmm0
add eax, eax
pclmulqdq xmm4, xmm6, 0x11
pxor xmm4, xmm3
pxor xmm4, xmm1
movups xmmword [ecx - 0x30], xmm4
movups xmm3, xmmword [esi + eax*8]
movaps xmm0, xmm3
pclmulqdq xmm0, xmm3, 0
pxor xmm0, xmm7
movaps xmm1, xmm0
pshufd xmm0, xmm0, 0x4e
pclmulqdq xmm1, xmmword [0x21a930], 0
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x4e
movaps xmm2, xmm1
pclmulqdq xmm2, xmmword [0x21a930], 0
pxor xmm2, xmm0
pclmulqdq xmm3, xmm3, 0x11
pxor xmm3, xmm5
pxor xmm2, xmm3
movups xmmword [ecx - 0x20], xmm2
cmp edx, edi
jb 0x73ce60
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00739c86
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4

Function at 0x73d340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp + 8], 0
push esi
nop word [eax + eax]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + eax]
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + eax]
inc eax
mov ecx, dword [ebp + 8]
xor esi, edx
or ecx, esi
mov dword [ebp + 8], ecx
cmp eax, 0x10
jl 0x73d360
mov eax, dword [ebp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x740990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
lea ecx, [edx + 0x3f8]
lea esi, [eax + 0x3f8]
cmp eax, ecx
ja 0x7409cd
cmp esi, edx
jb 0x7409cd
sub edx, eax
mov esi, pe_nt_image_headers32
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0x7409b5
pop esi
pop ebp
ret
lea esi, [edx + 0x30]
sub edx, eax
lea ecx, [eax + 0x10]
mov eax, 0x10
nop word [eax + eax]
lea ecx, [ecx + 0x40]
lea esi, [esi + 0x40]
movups xmm0, xmmword [ecx - 0x50]
movups xmm1, xmmword [esi - 0x70]
pxor xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [edx + ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [esi - 0x50]
pxor xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm0, xmmword [ecx - 0x20]
movups xmm1, xmmword [esi - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
sub eax, 1
jne 0x7409e0
pop esi
pop ebp
ret
Function at 0x743610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x243054]
xor eax, ebp
mov dword [ebp - 4], eax
xor edx, edx
xor eax, eax
mov cl, dl
mov dword [ebp - 0xc], edx
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 9]
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0xa]
push ebx
mov byte [ebp - 0xe], cl
mov bl, dl
mov cl, byte [ebp - 0xb]
push esi
mov esi, dword [ebp + 8]
mov word [ebp - 8], dx
mov ch, byte [ebp - 7]
mov byte [ebp - 0xd], cl
nop dword [eax]
mov cl, byte [esi + eax]
mov bh, byte [eax + 0x21a9a0]
xor bh, cl
or bh, bl
mov bl, byte [eax + 0x21a9c0]
xor bl, cl
mov byte [ebp - 0x11], bh
or bl, byte [ebp - 0xd]
mov byte [ebp - 0x17], bl
mov byte [ebp - 0xd], bl
mov bl, byte [eax + 0x21a9e0]
xor bl, cl
or bl, byte [ebp - 0xe]
mov byte [ebp - 0x16], bl
mov byte [ebp - 0xe], bl
mov bl, byte [eax + 0x21aa00]
xor bl, cl
or bl, byte [ebp - 0xf]
mov byte [ebp - 0x15], bl
mov byte [ebp - 0xf], bl
mov bl, byte [eax + 0x21aa20]
xor bl, cl
or bl, byte [ebp - 0x10]
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x10], bl
mov bl, byte [eax + 0x21aa40]
xor bl, cl
or bl, ch
mov byte [ebp - 0x13], bl
mov ch, bl
mov bl, byte [eax + 0x21aa60]
inc eax
xor bl, cl
or bl, dl
mov byte [ebp - 0x12], bl
mov dl, bl
mov bl, bh
cmp eax, 0x1f
jb 0x743650
mov bl, byte [eax + esi]
movzx esi, byte [eax + 0x21aa60]
and bl, 0x7f
movzx ecx, bl
xor esi, ecx
movzx ecx, dl
movzx edx, byte [eax + 0x21aa40]
or esi, ecx
movzx ecx, bl
dec esi
xor edx, ecx
movzx ecx, byte [ebp - 0x13]
or edx, ecx
movzx ecx, bl
dec edx
or esi, edx
movzx edx, byte [eax + 0x21aa20]
xor edx, ecx
movzx ecx, byte [ebp - 0x14]
or edx, ecx
movzx ecx, bl
dec edx
or esi, edx
movzx edx, byte [eax + 0x21aa00]
xor edx, ecx
movzx ecx, byte [ebp - 0x15]
or edx, ecx
movzx ecx, bl
dec edx
or esi, edx
movzx edx, byte [eax + 0x21a9e0]
xor edx, ecx
movzx ecx, byte [ebp - 0x16]
or edx, ecx
movzx ecx, bl
dec edx
or esi, edx
movzx edx, byte [eax + 0x21a9c0]
movzx eax, byte [eax + 0x21a9a0]
xor edx, ecx
movzx ecx, byte [ebp - 0x17]
or edx, ecx
movzx ecx, bl
xor eax, ecx
dec edx
movzx ecx, bh
or esi, edx
or eax, ecx
mov ecx, dword [ebp - 4]
dec eax
xor ecx, ebp
or eax, esi
shr eax, 8
pop esi
and eax, 1
pop ebx
call fcn.00739c86
mov esp, ebp
pop ebp
ret

Function at 0x743f70
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [edx], 0x61707865
mov dword [edx + 4], 0x3320646e
mov dword [edx + 8], 0x79622d32
mov dword [edx + 0xc], 0x6b206574
mov eax, dword [ecx]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 0x1c]
mov dword [edx + 0x2c], eax
pop ebp
ret
Function at 0x746840
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 8]
mov dword [edx + 0x3c], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0x30], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x1c]
mov dword [edx + 0x38], eax
mov dword [edx], 0x61707865
mov dword [edx + 4], 0x3320646e
mov dword [edx + 8], 0x79622d32
mov dword [edx + 0xc], 0x6b206574
pop ebp
ret

Function at 0x7527f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
imul eax, dword [ebp + 0xc], 0x3c0
add eax, 0x21acc0
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00752660
Function at 0x760f72
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x219298]
test eax, eax
je 0x760fb1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x760fb1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x760fb1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x760fb1
cmp dword [ecx + 0x74], 0xe
jbe 0x760fb1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x7a30c0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2188c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x50
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
push 0x22cffb
lea ecx, [ebp - 0x58]
call fcn.006dc870
mov byte [ebp - 4], 1
xor eax, eax
mov byte [ebp - 0x11], al
xor ecx, ecx
mov byte [ebp - 0x12], cl
xor edx, edx
mov byte [ebp - 0x13], dl
movzx eax, byte [ebp - 0x11]
push eax
movzx ecx, byte [ebp - 0x12]
push ecx
movzx edx, byte [ebp - 0x13]
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.006e5990
add esp, 0x10
mov ecx, eax
call fcn.006e80b0
mov dword [ebp - 0x24], eax
lea ecx, [ebx + 0xc]
call fcn.006ff5b0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.007578e6
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x7a31d4
push 2
push 0
mov eax, dword [ebp - 0x18]
push eax
call fcn.0075b826
add esp, 0xc
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.007573bb
add esp, 4
mov dword [ebp - 0x1c], eax
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
call fcn.0075b826
add esp, 0xc
push 0
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x58]
call fcn.006ff560
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push 1
lea ecx, [ebp - 0x58]
call fcn.006ff5b0
mov ecx, 1
imul edx, ecx, 0
add eax, edx
push eax
call fcn.0075fb3b
add esp, 0x10
mov eax, dword [ebp - 0x18]
push eax
call fcn.0075b2d8
add esp, 4
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [ebx + 8]
call fcn.006dc800
mov edx, dword [ebp - 0x20]
or edx, 1
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.006dc7e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 0xc]
call fcn.006dc7e0
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x7a6c30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x9c], 0
mov esp, ebp
pop ebp
ret
Function at 0x8387c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x88], 0
je 0x838810
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x88], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x8388a3
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x8c]
add ecx, 0x28
xor edx, edx
push edx
push ecx
call fcn.008493d0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp - 4], 0
jne 0x838871
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
sub ecx, 1
xor esi, esi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x98]
cdq
push edx
push eax
push esi
push ecx
call fcn.00739d50
push edx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
call fcn.0084a7f0
add esp, 0x10
mov eax, 7
jmp 0x8388c6
mov edx, 0x28
shl edx, 0
add edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov ecx, 0x20
mov edx, dword [ebp - 4]
mov word [edx + 0x1c], cx
mov eax, 1
mov ecx, dword [ebp - 4]
mov word [ecx + 0x1e], ax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x78], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x8462f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0
push 0
push 0x14
call fcn.008498b0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x84631c
mov eax, 7
jmp 0x8463cc
movzx ecx, byte [0x245684]
test ecx, ecx
je 0x846338
push 0xc8
call fcn.00845510
add esp, 4
test eax, eax
je 0x84634d
xor edx, edx
mov eax, dword [ebp - 4]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
jmp 0x84639d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x20b7d0
push 0
push 0
call fcn.0076122a
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x84639d
xor eax, eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x8463c2
call dword [0x2191d8]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
push edx
call dword [ebp + 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x88f830
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x88f93c
test eax, eax
je 0x88f93c
push esi
push edi
mov ecx, 0x10
mov esi, 0x26fff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x88f923
lea edi, [eax + 4]
jmp 0x88f887
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x88f89c
mov dword [ebp - 4], 2
jmp 0x88f8bd
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x88f8b3
mov dword [ebp - 4], 1
jmp 0x88f8bd
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x88f933
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x88f8f6
mov byte [ecx], 0x3d
jmp 0x88f902
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x88f90d
mov byte [ecx], 0x3d
jmp 0x88f913
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x88f884
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001170
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea ecx, [esp + 4]
mov eax, dword [esp + 0x5c]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
mov word [esp + 0x6c], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x100011d0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x30c
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
mov byte [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x215]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x110]
lea edx, [esp + 0x214]
push ecx
push 0x100010d0
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x100010c0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x21c]
push ecx
call fcn.10001130
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0xc
push 0
push 0x100010a0
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
push 0x10001090
call esi
pop edi
pop esi
pop ebp
add esp, 0x30c
ret
Function at 0x100012e0
Capabilities:
Check if file exists
Get common file path
Move file
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x514
dec eax
push ebx
push edi
jne 0x100014da
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x315]
mov byte [esp + 0x314], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x318]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x314]
push 0x1000111c
push ecx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x100014da
mov ecx, 0x40
lea edi, [esp + 0x211]
mov byte [esp + 0x210], bl
mov byte [esp + 0x418], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x419]
mov byte [esp + 8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
push ebp
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push esi
stosw word es:[edi], ax
push ebx
lea edx, [esp + 0x21c]
push 0x37
push edx
push ebx
stosb byte es:[edi], al
call ebp
mov edi, 0x1000110c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push 0x37
push eax
push ebx
rep movsb byte es:[edi], byte [esi]
call ebp
mov edi, 0x100010fc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x218]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x424]
push 0x104
push ecx
push ebx
push 0x100010f4
push 0x100010ec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x420]
push edx
push eax
call sub.MSVCRT.dll_rename
add esp, 8
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1000145d
lea edx, [esp + 0x10]
push edx
call fcn.10001170
add esp, 4
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x118]
push 0x37
push eax
push ebx
call ebp
mov edi, 0x100010e0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
pop esi
pop ebp
test eax, eax
je 0x100014da
lea ecx, [esp + 0x10c]
push ecx
call fcn.10001170
add esp, 4
pop edi
mov eax, 1
pop ebx
add esp, 0x514
ret 0xc
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41ff02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x41ff11
pop dword [ebp - 0xc]
mov eax, 0x260087e0
sub eax, 0x25be88cf
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xef7f89e6
sub dword [ebp - 0x1c], 0xa12d449b
mov dword [ebp - 0x18], 0xfa387d6f
add dword [ebp - 0x18], 0x37faced6
mov dword [ebp - 0x14], 0x2c67af8c
add dword [ebp - 0x14], 0x1fe494a2
mov dword [ebp - 0x10], 0x6a4f08e0
add dword [ebp - 0x10], 0x95b0f720
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xda14950c
add eax, 0x262d9b68
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x44ff6a7e
sub dword [ebp - 0x1c], 0xd08d0128
mov dword [ebp - 0x18], 0x30ba8d8c
sub dword [ebp - 0x18], 0xef4e2c17
mov dword [ebp - 0x14], 0x1a371088
sub dword [ebp - 0x14], 0xb6c7a41c
mov dword [ebp - 0x10], 0xcc5b3ae4
add dword [ebp - 0x10], 0x33a4c51c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xab3df7af
sub eax, 0xaafbc68b
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x4160b
push 0
call eax
mov ecx, 0x56ab
mov edx, eax
mov ebx, 0x39e77d4a
sub ebx, 0x39a4394a
add ebx, dword [ebp - 0xc]
mov esi, 0x342d7c59
sub esi, 0x7c7029d8
sub dword [ebp - 8], 0x906ddf0b
mov edi, dword [ebx]
add dword [ebp - 4], esi
xor edi, esi
sub dword [ebp - 4], 0x18cc667a
mov dword [edx], edi
add dword [ebp - 8], esi
add edx, 0xba65da9
add edx, 0xf459a25b
add ebx, 0x4f0115b5
sub ebx, 0x4f0115b1
loop 0x42002d
add eax, 0xb5cc14a2
add eax, 0x4a3538dd
mov ebx, eax
add eax, 0xde5747d0
add eax, 0x21a8b835
mov ecx, 0xd94584fb
add ecx, 0x26fa7b05
add ecx, dword [ebp - 0xc]
call ebx
leave
ret