joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008ba1
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x2c], 0xffffffff
and dword [ebp - 0x28], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call sym.net.dll__ipv6_available_0
push edi
mov ebx, eax
call fcn.100065bc
pop ecx
mov dword [ebp - 0x24], eax
test ebx, ebx
je 0x10008be0
push edi
call fcn.100065e8
pop ecx
jmp 0x10008be3
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x24], 0
jge 0x10008c01
test eax, eax
jns 0x10008c01
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
xor eax, eax
jmp 0x10008c63
cmp dword [ebp + 0x10], 2
mov dword [ebp - 0x28], 0x10
je 0x10008c1a
cmp dword [ebp + 0x10], 0xffffffff
jne 0x10008c24
cmp dword [ebp - 0x24], 0xffffffff
jne 0x10008c2a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0x1c
cmp dword [ebp - 0x24], 0xffffffff
je 0x10008bed
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x10008c55
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.1000affe
add esp, 0xc
jmp 0x10008bfd
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call sym.net.dll__NET_BindV6_8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c212
leave
ret 0xc
Function at 0x1000939b
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [0x10012588]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov eax, dword [esi]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 8], eax
test eax, eax
jne 0x100093d1
push str.null_fd_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x100094e6
xor eax, eax
cmp byte [ebp + 0x10], al
push ebx
mov ebx, dword [sym.imp.ws2_32.dll_socket]
sete al
push 0
inc eax
push eax
push 2
mov dword [ebp - 4], eax
call ebx
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
jne 0x10009405
push str.create
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x100094e5
push edi
mov edi, dword [sym.imp.kernel32.dll_SetHandleInformation]
push 0
push 1
push eax
call edi
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
call sym.net.dll__ipv6_available_0
test eax, eax
mov eax, dword [esi]
je 0x100094d2
push dword [0x1001257c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x17c]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x1000947c
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call sym.net.dll__NET_BindV6_8
push str.null_fd1_object
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
jmp 0x100094e4
push 0
push dword [ebp - 4]
push 0x17
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100094b6
mov eax, dword [esi]
push ebx
push dword [0x10012218]
push dword [ebp + 8]
push esi
call dword [eax + 0x1b4]
push dword [ebp + 0x10]
call sym.net.dll__NET_BindV6_8
push str.create
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x100094e4
push 0
push 1
push ebx
call edi
mov eax, dword [esi]
push ebx
push dword [0x10012218]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1b4]
jmp 0x100094e4
push 0
push dword [0x1001257c]
push dword [ebp + 0xc]
push esi
call dword [eax + 0x1a0]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x1000a553
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor eax, eax
push edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
call fcn.100091ff
push edi
mov ebx, eax
call fcn.1000922b
push 4
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x24]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0x14
test ebx, ebx
jns 0x1000a5cd
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jns 0x1000a5cd
push str.Socket_closed
push str.java_net_SocketException
push esi
call sub.java.dll__JNU_ThrowByName_12
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000c212
leave
ret 0x10
cmp dword [ebp + 0x10], 0xf
jne 0x1000a670
push 0x1c
pop eax
push eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1000a5fa
push edi
call fcn.1000922b
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ws2_32.dll_getsockname]
test eax, eax
jns 0x1000a622
push str.Error_getting_socket_name
push str.java_net_SocketException
push esi
call fcn.1000affe
add esp, 0xc
jmp 0x1000a5b9
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call sym.net.dll__NET_BindV6_8
mov edi, eax
test edi, edi
je 0x1000a5b9
push dword [ebp - 0x38]
mov eax, dword [esi]
push esi
call dword [eax + 0x7c]
mov ecx, dword [esi]
push str.Ljava_net_InetAddress_
push str.addr
push eax
push esi
call dword [ecx + 0x178]
test eax, eax
je 0x1000a5b9
mov ecx, dword [esi]
push edi
push eax
push dword [ebp - 0x38]
push esi
call dword [ecx + 0x1a0]
xor eax, eax
jmp 0x1000a5bc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call sym.net.dll__NET_MapSocketOption_12
test eax, eax
je 0x1000a68e
push str.Invalid_option
jmp 0x1000a5ae
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x28], 4
cmp edi, 0x80
je 0x1000a6a4
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push ebx
call sym.net.dll__NET_BindV6_8
test eax, eax
jns 0x1000a6ce
push str.getsockopt
push esi
call fcn.1000afaa
pop ecx
pop ecx
jmp 0x1000a5b9
cmp edi, 8
jg 0x1000a6e9
je 0x1000a709
dec edi
je 0x1000a709
dec edi
dec edi
je 0x1000a71a
dec edi
je 0x1000a709
push str.Option_not_supported_by_TwoStacksPlainSocketImpl
jmp 0x1000a5ae
cmp edi, 0x80
je 0x1000a722
cmp edi, 0x1000
jle 0x1000a6df
cmp edi, 0x1002
jle 0x1000a71a
cmp edi, 0x1003
jne 0x1000a6df
xor eax, eax
cmp dword [ebp - 0x24], eax
setne al
lea eax, [eax + eax - 1]
jmp 0x1000a5bc
mov eax, dword [ebp - 0x24]
jmp 0x1000a5bc
cmp word [ebp - 0x24], 0
je 0x1000a5b9
movzx eax, word [ebp - 0x22]
jmp 0x1000a5bc
Function at 0x1000ba14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000ba23
pop dword [ebp - 0x40]
mov eax, 0xcafb90ff
sub eax, 0xbafad6dc
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xd0dda65f
sub dword [ebp - 0x50], 0x828b6114
mov dword [ebp - 0x4c], 0x3c988bae
add dword [ebp - 0x4c], 0xf59ac097
mov dword [ebp - 0x48], 0xc600e50
sub dword [ebp - 0x48], 0xc013ca22
mov dword [ebp - 0x44], 0xd65d338a
sub dword [ebp - 0x44], 0xd65d338a
lea eax, [ebp - 0x50]
push eax
mov eax, 0xd42b1c5b
sub eax, 0xc42a4c1f
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x13e6824f
add dword [ebp - 0x50], 0x608be707
mov dword [ebp - 0x4c], 0x3729e28a
add dword [ebp - 0x4c], 0xa427eeb
mov dword [ebp - 0x48], 0x9eca3ef9
add dword [ebp - 0x48], 0xc4a52d73
mov dword [ebp - 0x44], 0x6eda40b0
add dword [ebp - 0x44], 0x9125bf50
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x437cec29
sub eax, 0x337c1bc1
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x378a3
push 0
call eax
mov ecx, 0x5f008552
sub ecx, 0x5f003cb3
mov edi, eax
mov ebx, 0x10015200
add ebx, dword [ebp - 0x40]
mov edx, 0x5bfd23fe
mov dword [ebp - 0x34], 0xe869ce19
mov esi, dword [ebx]
xor dword [ebp - 0x34], 0xe67a9fa1
add esi, edx
add dword [ebp - 8], 0x297213f8
mov dword [edi], esi
xor dword [ebp - 0x1c], 0xf81a8288
add edi, 0x4d805290
add edi, 0xb27fad74
add ebx, 4
loop 0x1000bb39
add eax, 0xe0ff63f9
add eax, 0x1f01b156
xor ebx, ebx
add ebx, eax
add eax, 0x92be8141
add eax, 0x6d417ec4
mov ecx, 0xf1ad3d67
add ecx, 0x1e52c299
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x1000bd72
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa8
mov eax, dword [0x100120b4]
xor eax, ebp
mov dword [ebp + 0x74], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x1c], 5
ja 0x1000be06
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push reloc.ws2_32.dll_bind
mov dword [esi], 0x400
mov dword [esi + 4], 0x1387
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000be13
push edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push str.MaxUserPort
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 0x24]
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1000be13
mov eax, dword [ebp - 0x28]
mov dword [esi + 4], eax
jmp 0x1000be13
mov dword [esi], 0xc000
mov dword [esi + 4], 0xffff
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
xor eax, eax
call fcn.1000c212
add ebp, 0x78
leave
ret

Function at 0x1000c212
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100120b4]
jne 0x1000c21c
repz ret
jmp fcn.1000c5cb
Function at 0x100bd63c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101023f0]
jne 0x100bd646
repz ret
jmp fcn.100bd8ed

Function at 0x100bde90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x101023d0], 0
mov byte [0x101023d4], 0
mov esi, dword [0x101023c8]
add esi, 0x1248
mov dword [0x101023c4], esi
mov dword [0x101023cc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jmp 0x100bdfb0
mov eax, 0x100
mov dword [0x101023d8], 0
mov dword [0x101023c4], 0x1dfc
mov ecx, dword [0x101023d0]
mov edx, dword [0x101023cc]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x1c], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x101023d8], edi
mov edx, dword [0x101023c4]
mov eax, edi
mov dword [ebp - 0x20], edx
cdq
mov edi, dword [ebp - 0x1c]
idiv edi
mov dword [0x101023d0], edx
mov edx, dword [ebp - 0x20]
add edx, 0x152a
mov dword [0x101023c4], edx
mov edx, dword [0x101023cc]
mov cl, byte [esi + edx]
mov byte [0x101023d4], cl
mov dword [0x101023c4], 0x118d
mov edx, dword [0x101023d0]
mov cl, byte [esi + edx]
mov edx, dword [0x101023cc]
mov byte [esi + edx], cl
mov cl, byte [0x101023d4]
mov edx, dword [0x101023d0]
mov byte [esi + edx], cl
mov dword [0x101023c4], 0x24c0
mov edx, dword [0x101023cc]
add edx, 1
mov dword [0x101023cc], edx
cmp edx, 0x100
jl 0x100bdedd
jmp 0x100bdffd
mov eax, dword [0x101023cc]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101023c4], 0xa1e
mov eax, dword [0x101023cc]
add eax, 1
mov dword [0x101023cc], eax
cmp eax, 0x100
jl 0x100bdfb0
mov eax, dword [0x101023c8]
add eax, 0x101c
mov dword [0x101023c4], eax
mov dword [0x101023cc], 0
jmp 0x100bdedd
mov dword [0x101023c4], 0x23eb
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100be010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
mov eax, dword [ebp + 8]
mov dword [0x101023c8], 0x1410
mov dword [ebp - 0x30], eax
call fcn.100bf0c0
xor ecx, ecx
mov dword [0x101023c4], 0x163b
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
jmp 0x100be0d2
lea eax, [0x100c083f]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x101023c4], 0x3bc
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
call fcn.100bf030
mov dword [0x101023c8], 0x17c9
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.100bdbf0
mov ecx, eax
mov dword [0x101023e0], eax
mov eax, esp
mov edx, dword [ebp - 0x48]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x101023c8], 0x1739
mov edx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
jmp 0x100be126
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
imul esi, eax, 0xfc
mov edi, edx
add edi, esi
add edi, 0x9c
mov esi, eax
add esi, 1
imul eax, eax, 0xfc
add edx, eax
add edx, 0x50
mov eax, dword [edi]
movzx edx, word [edx]
xor edx, eax
add edx, ecx
cmp esi, 0x414
mov eax, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x3c], esi
je 0x100be04a
jmp 0x100be0d2
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
mov esi, ecx
add esi, 1
mov edi, dword [ebp - 0x4c]
add edi, eax
imul ebx, ecx, 0xfc
mov dword [ebp - 0x58], eax
mov eax, edx
add eax, ebx
add eax, 0x4c
imul ebx, ecx, 0xfc
mov dword [ebp - 0x5c], eax
mov eax, edx
add eax, ebx
add eax, 0x9c
imul ecx, ecx, 0xfc
add edx, ecx
add edx, 0x50
mov eax, dword [eax]
mov ecx, dword [ebp - 0x5c]
mov ebx, dword [ecx]
movzx edx, word [edx]
xor edx, eax
mov dword [esp], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x64], esi
call fcn.100be220
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x58]
add eax, ecx
mov edx, dword [ebp - 0x64]
cmp edx, 0x414
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], eax
jne 0x100be126
mov eax, dword [ebp - 0x4c]
add eax, 0xc4aa
mov dword [0x101023c8], 0x22ea
mov ecx, dword [ebp - 0x4c]
mov dword [esp], ecx
mov dword [esp + 4], ecx
mov edx, dword [ebp - 0x48]
mov dword [esp + 8], edx
mov dword [ebp - 0x68], eax
call fcn.100be600
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x68]
mov dword [eax], ecx
mov dword [eax + 4], 0x170200
xor eax, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x55a5
mov edx, dword [ebp - 0x30]
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x2020
mov dword [0x101023c4], 0x1434
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100be430
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [0x101023c4], 0x9d2
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [0x101023c4], 0x2420
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x100be491
mov eax, dword [ebp - 0x14]
mov dword [0x101023c4], 0x568
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x100be4f5
jmp 0x100be56f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
je 0x100be470
jmp 0x100be4bd
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x100be51f
jmp 0x100be56f
mov dword [0x101023c8], 0xffffe35a
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
setl cl
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x21], cl
mov al, byte [ebp - 0x21]
test al, 1
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
jne 0x100be491
jmp 0x100be470
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x100be56f
mov dword [0x101023c4], 0x23ba
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x100be4a9
jmp 0x100be56f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x100be56f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x100be56f
mov eax, dword [0x101023c8]
add eax, 0x1815
mov dword [0x101023c8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0xe], 0x6c
jne 0x100be56f
mov dword [0x101023c4], 0x263b
mov eax, 1
mov dword [ebp - 0x28], eax
jmp 0x100be57e
xor eax, eax
mov dword [0x101023c8], 0x18b8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add esp, 0x28
pop ebp
ret

Function at 0x100be590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.100be590]
mov dword [0x101023c4], 0x2ba
mov dword [0x101023c8], 0xffffe8fe
mov dword [ebp - 4], eax
jmp 0x100be5cf
mov dword [0x101023c4], 0xfffff2fa
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
jne 0x100be5b5
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x100be5b5
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
Function at 0x100bec50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x101023c4]
mov dword [0x101023cc], 0
mov dword [0x101023d0], 0
mov dword [0x101023dc], 0
add edi, 0xffffe517
mov dword [0x101023c8], edi
mov edi, dword [0x101023c4]
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ebx
je 0x100bee07
xor eax, eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffff5ed
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, 0x100
mov dword [0x101023c8], ecx
mov dword [0x101023c4], 0x14b6
mov ecx, dword [0x101023cc]
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
mov ecx, dword [ebp - 0x34]
idiv ecx
mov dword [0x101023cc], edx
mov esi, dword [0x101023d0]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x101023d0], edx
mov dword [0x101023c4], 0x44
mov edx, dword [0x101023cc]
mov bl, byte [edi + edx]
mov byte [0x101023d4], bl
mov dword [0x101023c4], 0xe50
mov edx, dword [0x101023d0]
mov bl, byte [edi + edx]
mov edx, dword [0x101023cc]
mov byte [edi + edx], bl
mov bl, byte [0x101023d4]
mov edx, dword [0x101023d0]
mov byte [edi + edx], bl
mov edx, dword [0x101023c4]
add edx, 0xb7f
mov dword [0x101023c8], edx
mov edx, dword [0x101023cc]
movzx edx, byte [edi + edx]
mov esi, dword [0x101023d0]
movzx esi, byte [edi + esi]
add esi, edx
mov dword [0x101023c8], 0x10dd
and esi, 0xff
mov dword [0x101023dc], esi
mov edx, dword [0x101023c4]
add edx, 0xffffe052
mov dword [0x101023c4], edx
mov bl, byte [edi + esi]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
movzx ecx, byte [edx + esi]
mov dword [esp], ecx
movzx ecx, bl
mov dword [esp + 4], ecx
call fcn.10001000
mov ecx, 0xc10
mov edx, 0x1fd
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x30]
mov byte [esi + edi], al
mov dword [0x101023c4], 0xc10
add edi, 1
mov eax, dword [ebp - 0x10]
cmp edi, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], ecx
jne 0x100beccb
mov eax, dword [ebp - 0x24]
add eax, 0xffffdbf0
mov dword [0x101023c8], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401340
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
lea eax, [ebp - 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
mov dword [ebp - 0x34], esp
mov dword [ebp - 0x44], 0x41e9c0
mov dword [ebp - 0x40], 0x41efec
mov dword [ebp - 0x38], 0x401512
call fcn.0041a840
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [ebp - 0x58], 0xffffffff
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
sub esp, 4
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004029c0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x58], 3
or edx, eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x60], edx
mov dword [esp], eax
call fcn.00402430
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov edx, dword [ebp - 0x60]
mov dword [esp + 0xc], str.downloader_tmp_
mov dword [esp + 4], str._s_s_d
mov dword [esp + 8], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp], eax
mov dword [ebp - 0x58], 2
call fcn.00402bf0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x401407
mov dword [esp], eax
call fcn.0041dc40
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], 3
mov dword [esp], eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
sub esp, 4
test eax, eax
jne 0x4014d0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
test eax, eax
je 0x4014f0
cmp byte [eax], 0
je 0x4014f0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov eax, dword [edx + 4]
mov dword [ebp - 0x58], 3
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00402d50
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_MoveFileA
mov eax, dword [ebp - 0x14]
sub esp, 8
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_MoveFileExA
mov eax, dword [ebp - 0x24]
sub esp, 0xc
test eax, eax
je 0x4014af
mov dword [esp], eax
call fcn.0041dc40
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4014be
mov dword [esp], eax
call fcn.0041dc40
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.0041a7e0
leave
ret
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileA
mov edx, dword [ebp + 8]
sub esp, 4
mov eax, dword [edx + 4]
test eax, eax
jne 0x401433
lea esi, [esi]
lea eax, [ebp - 0x28]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x58], 3
call fcn.00402040
sub esp, 4
jmp 0x401466