joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0x1c], eax
mov cl, 0x6c
mov al, 0x65
mov dl, 0x72
mov byte [esp], 0x75
mov byte [esp + 1], 0x73
mov byte [esp + 2], al
mov byte [esp + 3], dl
mov byte [esp + 4], 0x33
mov byte [esp + 5], 0x32
mov byte [esp + 6], 0x2e
mov byte [esp + 7], 0x64
mov byte [esp + 8], cl
mov byte [esp + 9], cl
mov byte [esp + 0xa], 0
mov ebx, ebx
mov cl, 0x74
mov byte [esp + 0xc], 0x47
mov byte [esp + 0xd], al
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], 0x44
mov byte [esp + 0x10], 0x70
mov byte [esp + 0x11], 0x69
mov byte [esp + 0x12], 0x46
mov byte [esp + 0x13], 0x6f
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], 0x53
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], 0x73
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x1b], 0
mov cl, cl
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, edi
test eax, eax
je 0x10053105
call eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100f5016
add esp, 0x20
ret
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov ebp, ebp
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
mov bh, bh
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dl, dl
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100f5016
add esp, 0x20
ret
Function at 0x10053220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0x30], eax
xor eax, eax
push ebx
mov byte [esp + 0x24], al
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov word [esp + 0x31], ax
mov byte [esp + 0x33], al
mov ecx, ecx
mov dl, 0x65
mov cl, 0x6e
mov bl, 0x74
mov byte [esp + 0x14], 0x47
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], 0x75
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], 0x49
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], al
mov eax, eax
mov byte [esp + 4], 0x41
mov byte [esp + 5], 0x75
mov byte [esp + 6], bl
mov byte [esp + 7], 0x68
mov byte [esp + 8], dl
mov byte [esp + 9], cl
mov byte [esp + 0xa], bl
mov byte [esp + 0xb], 0x69
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xd], 0x41
mov byte [esp + 0xe], 0x4d
mov byte [esp + 0xf], 0x44
mov byte [esp + 0x10], al
nop
mov eax, 0
cpuid
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x14]
lea eax, [esp + 0x24]
pop ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10053306
test dl, dl
je 0x10053302
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10053306
add eax, 2
add ecx, 2
test dl, dl
jne 0x100532e6
xor eax, eax
jmp 0x1005330b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10053323
mov eax, 1
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100f5016
add esp, 0x34
ret
lea ecx, [esp]
lea eax, [esp + 0x20]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10053350
test dl, dl
je 0x1005334c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10053350
add eax, 2
add ecx, 2
test dl, dl
jne 0x10053330
xor eax, eax
jmp 0x10053355
sbb eax, eax
sbb eax, 0xffffffff
mov ecx, dword [esp + 0x30]
neg eax
sbb eax, eax
and eax, 0xfffffffe
xor ecx, esp
add eax, 2
call fcn.100f5016
add esp, 0x34
ret

Function at 0x100533f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0x800], eax
push 0x7ff
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.100f5b10
add esp, 0xc
mov esi, esi
push 0x800
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov bh, bh
mov ecx, dword [esp + 0x800]
mov al, byte [esp]
xor ecx, esp
call fcn.100f5016
add esp, 0x804
ret

Function at 0x10053630
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x40
mov ah, ah
mov dword [esp], 0x40
mov edi, edi
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
neg eax
sbb eax, eax
and eax, dword [esp + 4]
add esp, 0x40
ret
Function at 0x10054b80
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
push eax
pop eax
push 0x38
lea eax, [esp + 0x18]
push 0
push eax
call fcn.100f5b10
add esp, 0xc
push eax
pop eax
nop
mov ebx, dword [esp + 0x54]
push ebx
xor edi, edi
call fcn.1004cb80
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyA]
add esp, 4
mov dword [esp + 0x10], eax
jmp 0x10054bc0
lea esi, [edi*8]
sub esi, edi
add esi, esi
add esi, esi
mov eax, 1
mov dword [esp + esi + 0x14], eax
mov ah, ah
cmp dword [esp + 0x10], 0
je 0x10054be5
mov dword [esp + esi + 0x1c], eax
push ecx
pop ecx
mov word [esp + esi + 0x18], bx
mov dl, dl
push 0
push ebx
call ebp
mov word [esp + esi + 0x1a], ax
push ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + esi + 0x20], eax
mov dl, dl
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov dword [esp + esi + 0x24], eax
mov ebp, ebp
cmp edi, 1
jne 0x10054c1c
or dword [esp + 0x38], 2
push eax
pop eax
add edi, 1
cmp edi, 2
jl 0x10054bc0
mov eax, dword [esp + 0x58]
test eax, eax
mov edi, dword [esp + 0x50]
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, 1
push 0x1c
jne 0x10054cb2
lea edx, [esp + 0x20]
call fcn.100542a0
add esp, 0xc
push ecx
pop ecx
cmp dword [edi + 0x2608], 0
je 0x10054c82
mov esi, dword [edi + 0x2638]
test esi, esi
jle 0x10054c72
call fcn.100f7bac
cdq
idiv esi
mov esi, esi
mov dl, dl
mov ecx, esi
sar ecx, 1
sub edx, ecx
add edx, esi
jmp 0x10054c77
mov edx, 1
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edx
pop edx
jmp 0x10054c91
mov edx, dword [edi + 0x2638]
push edx
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov cl, cl
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
lea edx, [esp + 0x3c]
mov ecx, 1
call fcn.100542a0
add esp, 0xc
mov dl, dl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
cmp eax, 1
jne 0x10054ccd
lea edx, [esp + 0x20]
call fcn.100542a0
add esp, 0xc
mov ebx, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
lea edx, [esp + 0x3c]
call fcn.100542a0
add esp, 0xc
mov ebp, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x10055900
Capabilities:
Log keystrokes

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x10], eax
mov ebx, ebx
mov esi, dword [esp + 0x14]
cmp esi, 0xa0
je 0x10055924
cmp esi, 0xa1
jne 0x1005592d
mov esi, 0x10
push ecx
pop ecx
jmp 0x1005595d
cmp esi, 0xa4
je 0x1005593d
cmp esi, 0xa5
jne 0x10055946
mov esi, 0x12
mov ebp, ebp
jmp 0x1005595d
cmp esi, 0xa2
je 0x10055956
cmp esi, 0xa3
jne 0x1005595d
mov esi, 0x11
mov dl, dl
mov eax, dword [edi + 0x40]
xor ebp, ebp
cmp eax, ebp
jne 0x1005597b
push 2
push esi
push edi
call fcn.10054b80
add esp, 0xc
push eax
pop eax
pop edi
pop esi
lea eax, [ebp + 1]
pop ebp
ret
cmp eax, 1
jne 0x10055ac3
push ebx
push ebp
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov bl, bl
shl eax, 0x10
or eax, 1
mov ebx, eax
mov eax, eax
xchg ebx, eax
xchg ebx, eax
push esi
call fcn.1004cb80
add esp, 4
test eax, eax
je 0x100559b0
or ebx, 0x1000000
mov bh, bh
mov dl, dl
cmp dword [edi + 0x18], ebp
je 0x100559df
cmp dword [edi + 0x32d0], ebp
jne 0x100559df
push 0x717be38b
push edi
call fcn.1004f1c0
add esp, 8
test eax, eax
jne 0x100559df
or ebx, 0x4000000
nop
mov ebp, 0x4000000
mov ebx, ebx
cmp esi, 0x12
jne 0x100559ed
mov dword [edi + 0x64], 0
mov ah, ah
cmp dword [edi + 0x64], 0
jne 0x10055a5e
cmp esi, 0x79
je 0x10055a5e
or ebx, 0xc0000000
mov ah, ah
cmp dword [edi + 0x32b0], 0
je 0x10055a0d
mov ebx, ebp
push eax
pop eax
cmp dword [edi + 0x32ac], 0
je 0x10055a41
mov ecx, dword [edi + 0x32b4]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push ebx
push esi
push 0x101
push edx
call fcn.10052bc0
add esp, 0x1c
mov edi, edi
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov eax, dword [esp + 0x14]
push ebx
push esi
push 0x101
push eax
call fcn.10052a80
mov ah, ah
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov ch, ch
or ebx, 0xe0000000
mov cl, cl
cmp dword [edi + 0x32b0], 0
je 0x10055a75
mov ebx, ebp
mov ebx, ebx
cmp dword [edi + 0x32ac], 0
je 0x10055aa6
mov ecx, dword [edi + 0x32b4]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push ebx
push esi
push 0x105
push edx
call fcn.10052a90
mov ch, ch
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov eax, dword [esp + 0x14]
push ebx
push esi
push 0x105
push eax
call fcn.10052a80
mov ah, ah
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
cmp eax, 2
jne 0x10055a38
cmp esi, 0x12
jne 0x10055ad6
mov dword [edi + 0x64], ebp
xchg ebx, eax
xchg ebx, eax
push 2
push esi
push edi
call fcn.100ae330
add esp, 0xc
nop
pop edi
pop esi
mov eax, 1
pop ebp
ret

Function at 0x10055af0
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1004db90
push edx
pop edx
test eax, eax
jle 0x10055b08
mov dword [esp + 8], eax
jmp fcn.10055190
xor eax, eax
ret

Function at 0x10055b10
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1004db90
mov ebx, ebx
test eax, eax
jle 0x10055b28
mov dword [esp + 8], eax
jmp fcn.10055680
xor eax, eax
ret

Function at 0x10055b30
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1004db90
mov bh, bh
test eax, eax
jle 0x10055b48
mov dword [esp + 8], eax
jmp fcn.10055900
xor eax, eax
ret
Function at 0x10056860
Capabilities:
Get keyboard layout

Disassembly:
push 0xffffffffffffffff
push 0x101528fb
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
push esi
push edi
mov eax, dword [0x101a53c4]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x230]
push 0
push eax
call fcn.10052a60
nop
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebp, eax
mov dl, dl
lea ecx, [esp + 0x10]
call fcn.100d14f0
mov dword [esp + 0x224], 0
xchg ebx, eax
xchg ebx, eax
lea ecx, [esp + 0x10]
call fcn.10008ea0
mov esi, eax
mov dl, dl
test esi, esi
mov edi, dword [esp + 0x234]
je 0x10056927
mov ecx, edi
lea eax, [esi + 0xf]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10056908
test dl, dl
je 0x10056904
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10056908
add eax, 2
add ecx, 2
test dl, dl
jne 0x100568e8
xor eax, eax
jmp 0x1005690d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1005691f
mov esi, dword [esi + 0x90]
mov ch, ch
test esi, esi
jne 0x100568e3
jmp 0x10056927
test esi, esi
jne 0x100569b6
lea ecx, [esp + 0x10]
call fcn.10114250
mov esi, eax
mov cl, cl
test esi, esi
je 0x10056975
mov ecx, edi
lea eax, [esi + 0xf]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10056960
test dl, dl
je 0x1005695c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10056960
add eax, 2
add ecx, 2
test dl, dl
jne 0x10056940
xor eax, eax
jmp 0x10056965
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100569b2
mov esi, dword [esi + 0x90]
xchg ebx, eax
xchg ebx, eax
test esi, esi
jne 0x10056938
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.100d0510
xor eax, eax
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.100f5016
add esp, 0x218
ret
test esi, esi
je 0x10056975
push 0xff
lea eax, [esp + 0x11d]
push 0
push eax
mov byte [esp + 0x124], 0
call fcn.100f5b10
add esp, 0xc
nop
push 0xff
lea ecx, [esp + 0x1d]
push 0
push ecx
mov byte [esp + 0x24], 0
call fcn.100f5b10
add esp, 0xc
mov esi, esi
lea edx, [esp + 0x18]
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x10056a00
push ebx
pop ebx
lea edx, [esp + 0x18]
push edx
call fcn.1014b2a9
add esp, 4
mov bl, bl
push 0x10
lea eax, [esp + 0x11c]
push eax
push ebp
call fcn.1014b34b
add esp, 0xc
mov dl, dl
mov al, al
lea ecx, [esp + 0x18]
lea eax, [esp + 0x118]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10056a60
test dl, dl
je 0x10056a5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10056a60
add eax, 2
add ecx, 2
test dl, dl
jne 0x10056a40
xor eax, eax
jmp 0x10056a65
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10056975
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.100d0510
mov eax, 1
jmp 0x1005698b
Function at 0x10056a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x68
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0x64], eax
call fcn.100505f0
test eax, eax
jne 0x10056ab6
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100f5016
add esp, 0x68
ret
push ebx
xor ebx, ebx
cmp dword [0x102a9fec], ebx
je 0x10056b5d
call fcn.100505f0
test eax, eax
je 0x10056b5d
push 0x3f
lea eax, [esp + 0x2d]
push ebx
push eax
mov byte [esp + 0x34], bl
call fcn.100f5b10
add esp, 0xc
mov bh, bh
push ecx
pop ecx
mov dword [esp + 0x28], 2
push ebx
pop ebx
mov dword [esp + 0x2c], 0x17
mov dh, dh
mov dword [esp + 4], ebx
mov edx, edx
mov dh, dh
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x30], ecx
mov bh, bh
lea eax, [esp + 4]
cdq
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov bl, bl
push ebx
lea edx, [esp + 0xc]
push edx
push ebx
push ebx
lea eax, [esp + 0x38]
push 0x18
push eax
call fcn.1001f940
add esp, 0x18
push eax
pop eax
cmp eax, ebx
je 0x10056c07
cmp dword [esp + 4], ebx
jne 0x10056c07
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100f5016
add esp, 0x68
ret
cmp dword [fcn.102b6788], ebx
jne 0x10056c19
mov cl, 0x65
mov byte [esp + 0xc], 0x6b
mov byte [esp + 0xd], cl
mov byte [esp + 0xe], 0x72
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], 0x6c
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x13], 0x32
mov byte [esp + 0x14], bl
push ecx
pop ecx
mov al, 0x73
mov dl, 0x6f
mov byte [esp + 0x18], 0x49
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x57
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1c], 0x77
mov byte [esp + 0x1d], 0x36
mov byte [esp + 0x1e], 0x34
mov byte [esp + 0x1f], 0x50
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], bl
mov ebp, ebp
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [fcn.102b6788], eax
push ebx
pop ebx
cmp dword [fcn.102b6788], ebx
jne 0x10056c19
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100f5016
add esp, 0x68
ret
push esi
mov edi, edi
mov dword [esp + 8], ebx
mov al, al
mov eax, dword [esp + 0x74]
push ebx
push ebx
push eax
push ebx
push 0x400
call fcn.10052640
add esp, 0x14
mov esi, eax
push ecx
pop ecx
cmp esi, ebx
jne 0x10056c52
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100f5016
add esp, 0x68
ret
lea ecx, [esp + 8]
push ecx
push esi
call dword [fcn.102b6788]
mov ch, ch
push esi
call fcn.10036e00
add esp, 4
mov edx, edx
mov ecx, dword [esp + 0x6c]
xor eax, eax
cmp dword [esp + 8], ebx
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.100f5016
add esp, 0x68
ret
Function at 0x10057190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0x1c], eax
mov cl, 0x6c
mov al, 0x65
mov dl, 0x64
push esi
mov byte [esp + 0x10], 0x6b
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 0x72
mov byte [esp + 0x13], 0x6e
mov byte [esp + 0x14], al
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x33
mov byte [esp + 0x17], 0x32
mov byte [esp + 0x18], 0x2e
mov byte [esp + 0x19], dl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1c], 0
mov ecx, ecx
mov byte [esp + 4], 0x4f
mov byte [esp + 5], 0x70
mov byte [esp + 6], al
mov byte [esp + 7], 0x6e
mov byte [esp + 8], 0x54
mov byte [esp + 9], 0x68
mov byte [esp + 0xa], 0x72
mov byte [esp + 0xb], al
mov byte [esp + 0xc], 0x61
mov byte [esp + 0xd], dl
mov byte [esp + 0xe], 0
mov ah, ah
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
push ecx
pop ecx
test esi, esi
jne 0x10057247
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100f5016
add esp, 0x20
ret
push ebp
push edi
call fcn.1002aaf0
mov edi, eax
mov ah, ah
mov ebp, dword [esp + 0x34]
push ebp
push 0
push 0x1f03ff
call esi
mov esi, eax
mov edi, edi
push edi
call fcn.1002abb0
add esp, 4
mov ah, ah
test esi, esi
jne 0x10057287
pop edi
pop ebp
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100f5016
add esp, 0x20
ret
push 0
push 0
push 0xbb8
push ebp
call fcn.10052ab0
mov dl, dl
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
nop
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov bl, bl
mov ecx, dword [esp + 0x28]
pop edi
pop ebp
pop esi
xor ecx, esp
mov eax, 1
call fcn.100f5016
add esp, 0x20
ret

Function at 0x1005bcf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10152ae8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x101a53c4]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x10], esi
mov eax, eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
push ecx
pop ecx
cmp eax, 0xffffffff
je 0x1005bd34
test al, 0x10
je 0x1005bd34
mov esi, 1
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.1001d680
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret
Function at 0x10062cd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x10152f02
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0x154], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101a53c4]
xor eax, esp
push eax
lea eax, [esp + 0x16c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x17c]
mov esi, dword [esp + 0x180]
xor edi, edi
push 0xff
lea ecx, [esp + 0x6d]
push edi
mov dword [esp + 0x58], edi
push ecx
mov dword [esp + 0x60], eax
mov byte [esp + 0x74], 0
call fcn.100f5b10
add esp, 0xc
mov edi, edi
mov dl, dl
push ecx
pop ecx
xor ebx, ebx
xor ebp, ebp
mov al, al
mov bl, bl
mov bl, bl
mov dword [esp + 0x14], edi
mov ecx, ecx
xchg ebx, eax
xchg ebx, eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x19c]
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x19c]
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x19c]
push ecx
mov ecx, dword [esp + 0x19c]
push edx
push eax
push ecx
push esi
call fcn.10042660
add esp, 0x28
test eax, eax
jne 0x10062dba
mov esi, dword [esp + 0x54]
lea edx, [esp + 0x27]
push edx
lea eax, [esp + 0x6c]
push eax
mov ecx, esi
call fcn.100094b0
mov dword [esp + 0x174], edi
jmp 0x10062ed2
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
xor edx, edx
cmp eax, edi
jle 0x10062e18
xor ecx, ecx
test esi, esi
jle 0x10062e11
mov edi, edi
mov eax, edx
imul eax, dword [esp + 0x18]
add eax, dword [esp + 0x14]
lea eax, [eax + ecx*4]
push ecx
pop ecx
nop
mov eax, dword [eax]
mov edi, edi
mov esi, eax
shr esi, 0x10
and esi, 0xff
add edi, esi
mov eax, eax
movzx esi, ah
add ebp, esi
push ebx
pop ebx
movzx eax, al
add ebx, eax
mov al, al
mov esi, dword [esp + 0x2c]
add ecx, 1
cmp ecx, esi
jl 0x10062dd0
mov eax, dword [esp + 0x30]
add edx, 1
cmp edx, eax
jl 0x10062dc8
imul esi, eax
mov eax, edi
xor edx, edx
div esi
mov esi, eax
nop
mov ecx, dword [esp + 0x2c]
imul ecx, dword [esp + 0x30]
mov eax, ebp
xor edx, edx
div ecx
mov edi, eax
mov bh, bh
mov ecx, dword [esp + 0x2c]
imul ecx, dword [esp + 0x30]
mov eax, ebx
xor edx, edx
div ecx
mov ebx, eax
mov eax, eax
mov edx, dword [esp + 0x14]
push edx
call fcn.100f4b3b
xor ebp, ebp
add esp, 4
mov dword [esp + 0x14], ebp
mov bl, bl
mov dl, 0x30
mov cl, 0x32
mov al, 0x78
mov byte [esp + 0x58], 0x25
mov byte [esp + 0x59], dl
mov byte [esp + 0x5a], cl
mov byte [esp + 0x5b], al
mov byte [esp + 0x5c], 0x25
mov byte [esp + 0x5d], dl
mov byte [esp + 0x5e], cl
mov byte [esp + 0x5f], al
mov byte [esp + 0x60], 0x25
mov byte [esp + 0x61], dl
mov byte [esp + 0x62], cl
mov byte [esp + 0x63], al
mov byte [esp + 0x64], 0
mov cl, cl
push ebx
push edi
push esi
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x78]
push ecx
call fcn.100f68f0
add esp, 0x14
mov bh, bh
mov esi, dword [esp + 0x54]
lea edx, [esp + 0x27]
push edx
lea eax, [esp + 0x6c]
push eax
mov ecx, esi
call fcn.100094b0
mov dword [esp + 0x174], ebp
mov dword [esp + 0x50], 1
mov eax, esi
mov ecx, dword [esp + 0x16c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x154]
xor ecx, esp
call fcn.100f5016
add esp, 0x164
ret
Function at 0x100634b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10152fe9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov eax, dword [0x101a53c4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov cl, 0x32
mov al, 0x34
mov dword [esp + 0x10], esi
mov byte [esp + 0x14], 0x37
mov byte [esp + 0x15], 0x2e
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], al
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0
mov al, al
lea eax, [esp + 0xb]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.100094b0
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], 1
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100f5016
add esp, 0x24
ret

Function at 0x100636d0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x10153092
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push esi
mov eax, dword [0x101a53c4]
xor eax, esp
push eax
lea eax, [esp + 0x81c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x82c]
xor ebx, ebx
push 0x7ff
lea eax, [esp + 0x1d]
push ebx
mov dword [esp + 0x18], ebx
push eax
mov dword [esp + 0x20], esi
mov byte [esp + 0x24], bl
call fcn.100f5b10
add esp, 0xc
mov ebp, ebp
mov eax, dword [esp + 0x834]
cmp eax, ebx
jne 0x10063755
lea ecx, [esp + 0x18]
push ecx
push 0x800
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push eax
pop eax
jmp 0x100637fd
cmp eax, 1
jne 0x10063771
push 0x800
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov cl, cl
jmp 0x100637fd
cmp eax, 2
jne 0x1006378a
push 0x800
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
mov dl, dl
jmp 0x100637fd
cmp eax, 3
jne 0x100637a3
lea ecx, [esp + 0x18]
push ecx
push 0x800
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push edx
pop edx
jmp 0x100637fd
cmp eax, 4
jne 0x100637fd
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x101a6f90]
mov byte [esp + eax + 0x18], cl
add eax, 1
cmp cl, bl
jne 0x100637b0
xchg ebx, eax
xchg ebx, eax
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x100637d0
sub eax, edx
add eax, 0xffffffff
mov ebx, ebx
cmp eax, ebx
jl 0x100637fd
mov cl, 0x5c
cmp byte [esp + eax + 0x18], cl
je 0x100637f7
sub eax, 1
mov ebx, ebx
cmp eax, ebx
jge 0x100637e6
jmp 0x100637fd
mov byte [esp + eax + 0x18], bl
mov cl, cl
lea edx, [esp + 0xf]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.100094b0
mov dword [esp + 0x824], ebx
mov dword [esp + 0x10], 1
mov eax, esi
mov ecx, dword [esp + 0x81c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.100f5016
add esp, 0x81c
ret