joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1089f1c
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push 0x10897f9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret

Function at 0x1089f35
Capabilities:
Create thread

Disassembly:
push ecx
push 0x10dbfec
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor eax, eax
lea ecx, [esp]
push ecx
push eax
push eax
push 0x10891d6
push eax
push eax
mov word [0x10dbe8c], ax
mov word [0x10dbe88], 1
mov word [0x10dbf34], ax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
ret

Function at 0x108a7ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
lea eax, [ebp - 0xc]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0x2000000
push esi
push esi
push esi
push 0x1010970
push 0x80000002
mov dword [ebp - 4], esi
mov word [ebp - 0x218], si
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 4], esi
je 0x108a854
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 8], 0x208
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x218], si
pop esi
jne 0x108a883
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x218]
push 0x1010960
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.msvcrt.dll__wcsdup]
pop ecx
leave
ret 4
Function at 0x108cb6e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.0106f850
push ebx
push esi
push edi
push 0x5c
push dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
pop ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 1
push edi
push 0x1005e58
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x108cc8a
mov eax, 0x1000
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2018]
push eax
push edi
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x4018]
push eax
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp - 0x14], eax
jne 0x108cc54
push dword [ebp - 4]
call esi
mov edi, eax
lea eax, [ebp - 0x2018]
push eax
call esi
cmp eax, edi
pop ecx
pop ecx
jbe 0x108cc54
push dword [ebp - 4]
call esi
mov edi, eax
lea eax, [ebp - 0x2018]
push eax
call esi
sub eax, edi
lea edi, [ebp + eax*2 - 0x2018]
lea eax, [ebp - 0x4018]
push eax
call esi
add esp, 0xc
cmp dword [ebp + 0x14], eax
jbe 0x108cc54
push dword [ebp - 4]
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x108cc54
lea eax, [ebp - 0x4018]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_wcscpy]
inc dword [ebp - 8]
pop ecx
pop ecx
xor edi, edi
inc ebx
cmp dword [ebp - 0x14], edi
je 0x108cbbb
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
jle 0x108cc95
mov eax, dword [ebp - 4]
jmp 0x108cc80
dec eax
dec eax
cmp word [eax], 0x5c
je 0x108cb96
cmp eax, dword [ebp + 0xc]
jne 0x108cc74
jmp 0x108cb99
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
inc eax
jmp 0x108cc9e
xor eax, eax
cmp dword [ebp - 8], 1
setne al
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x108cca5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6010
call fcn.0106f850
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor esi, esi
inc esi
push esi
xor edi, edi
push edi
push dword [ebp + 0xc]
mov ebx, ecx
push dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x108cce8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
jmp 0x108cdc2
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x6010]
push eax
push edi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2010]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x1000
push dword [ebp - 8]
mov dword [ebp + 0xc], 0x2000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x108cda8
push 4
lea eax, [ebp - 0x2010]
push 0x1011280
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x108cda8
mov eax, dword [ebp + 0xc]
mov word [ebp + eax*2 - 0x6010], di
cmp eax, edi
je 0x108cd69
dec eax
cmp word [ebp + eax*2 - 0x6010], 0x25
mov dword [ebp + 0xc], eax
jne 0x108cd4b
cmp eax, edi
lea edi, [ebp + eax*2 - 0x600c]
jne 0x108cd6f
lea edi, [ebp - 0x6010]
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
push ebx
mov esi, eax
call dword [sym.imp.msvcrt.dll_wcslen]
cmp esi, eax
pop ecx
pop ecx
jl 0x108cd8e
sub esi, eax
push ebx
lea eax, [edi + esi*2]
push eax
jmp 0x108cd95
sub eax, esi
lea ebx, [ebx + eax*2]
push ebx
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x108cda8
and dword [ebp - 4], eax
or dword [ebp + 8], 0xffffffff
inc dword [ebp - 0xc]
xor edi, edi
cmp dword [ebp + 8], edi
je 0x108cce8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x108cf40
Capabilities:
Delete registry value
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 9
pop ecx
mov ebx, eax
mov esi, 0x101128c
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push ebx
call esi
pop ecx
lea edi, [ebx + eax*2]
jmp 0x108cf6d
dec edi
dec edi
cmp word [edi], 0x5c
jne 0x108cf6b
lea eax, [ebp - 0x2c]
inc edi
push eax
inc edi
call esi
push eax
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
mov esi, eax
neg esi
sbb esi, esi
push 0x101137c
neg esi
push edi
add esi, 0x80000002
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 0x18
test eax, eax
jne 0x108d00b
push dword [ebp + 8]
push 0x1011360
push esi
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x108d00b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0x2000000
push 4
push eax
push eax
push 0x10112e8
push esi
call ebx
test eax, eax
jne 0x108cff8
push 0x10112c4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x1011360
push esi
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0x2000000
push 4
push eax
push eax
push edi
push esi
call ebx
test eax, eax
je 0x108d032
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
inc eax
jmp 0x108d09e
cmp dword [ebp + 0x10], 0
je 0x108d06b
cmp esi, 0x80000003
jne 0x108d06b
push 0x10112b0
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x108d06b
push 5
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x108d08a
mov esi, 0xfffffeb4
jmp 0x108d093
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegReplaceKeyW]
mov esi, eax
cmp esi, 0xfffffeb4
je 0x108d093
test esi, esi
je 0x108d093
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x108d0a5
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2428
call fcn.0106f850
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x34]
mov eax, dword [eax + 4]
push edi
xor edi, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
test byte [eax + 0x60], 0x80
jne 0x108d24f
push esi
push dword [ecx + 0x3c]
mov esi, 0x80000002
push 0x1011360
push esi
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, edi
jne 0x108d22d
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0x2000000
push 4
push edi
push edi
push 0x10114b8
push esi
call ebx
cmp eax, edi
jne 0x108d22c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push 0x10114a8
push dword [ebp - 4]
mov dword [ebp - 0x14], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], edi
jne 0x108d22c
push 0x1011458
push dword [ebp - 8]
lea eax, [ebp - 0x2428]
push 0x10113e0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0x2000000
push 4
push edi
push edi
lea eax, [ebp - 0x2428]
push eax
push esi
call ebx
cmp eax, edi
jne 0x108d22c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test byte [eax + 0x9e], 0x80
je 0x108d22c
mov eax, dword [ebp - 0x10]
cmp word [eax + 0x8e], di
je 0x108d22c
push 0x104
lea eax, [ebp - 0x220]
xor ebx, ebx
push eax
inc ebx
push 0x1005e1c
mov dword [ebp + 8], ebx
mov word [ebp - 0x220], di
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push 0x1010848
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x10
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push 0x10113bc
push dword [ebp - 4]
call ebx
push 4
lea eax, [ebp + 8]
push eax
push 4
push edi
push 0x1011390
push dword [ebp - 4]
call ebx
pop ebx
cmp dword [ebp - 4], edi
je 0x108d23b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x1011360
push esi
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
pop esi
pop edi
leave
ret 4
Function at 0x108d5eb
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.0106f850
push esi
lea eax, [ebp + 8]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10114f0
push dword [ebp + 8]
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x108d693
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, esi
jne 0x108d66f
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov word [ebp + eax*2 - 0x2010], si
lea eax, [ebp - 0x2010]
push eax
push dword [ebp + 8]
call fcn.0108cca5
cmp eax, esi
mov dword [ebp - 4], eax
je 0x108d676
inc ebx
cmp edi, esi
je 0x108d622
jmp 0x108d688
lea eax, [ebp - 0x2010]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret 0xc

Function at 0x108d69b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x400c
call fcn.0106f850
push ebx
push esi
lea eax, [ebp + 8]
push eax
push 1
xor ebx, ebx
push ebx
push 0x1005e58
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x108d73c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x200c]
push eax
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x400c]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x1000
push dword [ebp + 8]
mov dword [ebp - 4], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, ebx
jne 0x108d715
mov eax, dword [ebp - 4]
shr eax, 1
cmp dword [ebp - 4], 2
mov word [ebp + eax*2 - 0x200c], bx
ja 0x108d71e
inc dword [ebp - 8]
cmp esi, ebx
je 0x108d6ca
jmp 0x108d731
push dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x200c]
call fcn.0108cdc9
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x108d742
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x108d7d8
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcsrchr]
xor esi, esi
push 0x5c
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x108d949
push 0x5c
push dword [ebp + 0x10]
mov word [eax], si
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x108d949
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push ebx
mov word [eax], si
inc eax
inc eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2000000
push 4
push esi
push esi
push dword [ebp + 0xc]
mov ebx, 0x80000002
push ebx
call edi
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0x108d8a6
cmp dword [ebp - 0xc], 1
jne 0x108d85d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x108d948
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x2000000
push 4
push 0x10020dc
push esi
push dword [ebp + 0x10]
push ebx
call edi
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x108d8a6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x2000000
push esi
push 0x10020dc
push esi
push dword [ebp + 0x10]
push ebx
call edi
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0x108d948
mov ebx, dword [ebp - 0x14]
cmp word [ebx], si
je 0x108d918
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push esi
push ebx
push dword [ebp - 4]
mov dword [ebp + 0x10], esi
call edi
cmp eax, esi
jne 0x108d92e
push 1
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll_calloc]
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp + 0x14], eax
je 0x108d92e
lea ecx, [ebp + 0x10]
push ecx
push eax
lea eax, [ebp + 0xc]
push eax
push esi
push ebx
push dword [ebp - 4]
call edi
cmp eax, esi
jne 0x108d90c
cmp dword [ebp - 0x10], esi
jne 0x108d90c
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push esi
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x14]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x108d92e
cmp dword [ebp + 0xc], esi
jne 0x108d92e
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0108d28f
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x108d93e
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], esi
je 0x108d948
push dword [ebp - 8]
call edi
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x108e493
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x1011748
push 0x80000002
mov dword [ebp - 8], 0x800
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x108e4c5
mov ax, 1
leave
ret
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
push 0x1011730
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push dword [ebp - 4]
je 0x108e4f1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x108e4bf
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x808]
push 0x1011724
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
leave
ret
Function at 0x108f2a0
Capabilities:
Encode data using xor

Disassembly:
cmp word [esp + 0xc], 0
je 0x108f2ed
mov ecx, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
movzx edi, word [esp + 0x18]
movsx eax, word [ecx + 0x10]
movsx ebx, word [ecx + 8]
cdq
idiv ebx
inc dword [ecx + 0x10]
movsx eax, dx
mov edx, dword [ecx + 4]
movzx eax, byte [eax + edx]
movzx edx, byte [ecx + 0xa]
xor eax, edx
movzx edx, byte [esi]
xor eax, edx
mov al, byte [eax + 0x10cfe28]
mov byte [esi], al
inc esi
dec edi
mov byte [ecx + 0xa], al
jne 0x108f2b8
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x108f2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp word [ebp + 0x10], 0
je 0x108f33d
movzx eax, word [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp + 0x10], eax
movsx eax, word [ecx + 0x10]
movsx edi, word [ecx + 8]
cdq
idiv edi
inc dword [ecx + 0x10]
mov bl, byte [esi]
mov edi, dword [ecx + 4]
movzx eax, bl
mov al, byte [eax + 0x10cff28]
movsx edx, dx
xor al, byte [edx + edi]
xor al, byte [ecx + 0xa]
mov byte [ecx + 0xa], bl
mov byte [esi], al
inc esi
dec dword [ebp + 0x10]
jne 0x108f30a
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x1091d75
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp word [ebp + 0xc], 0
mov ax, word [ebp - 4]
je 0x1091d97
movzx edx, word [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor ax, word [ecx]
inc ecx
inc ecx
dec edx
jne 0x1091d8f
leave
ret 8
Function at 0x1098f45
Capabilities:
Move file

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
mov ebx, dword [edi + 0x5c]
xor ebp, ebp
cmp ebx, ebp
je 0x1099049
mov eax, dword [ebx + 0x38]
cmp eax, ebp
je 0x1099049
push esi
push 0x1011c58
push eax
call fcn.010a0850
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x10], esi
je 0x1099020
mov eax, dword [edi + 0x5c]
cmp word [eax + 4], bp
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 5
push ebp
je 0x1098f95
add esi, 8
push esi
call edi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push 0x1005b14
call esi
push dword [ebx + 0x3c]
mov dword [esp + 0x1c], eax
call esi
mov ecx, dword [esp + 0x1c]
add ecx, eax
lea eax, [ecx + ecx + 4]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 0xc
cmp esi, ebp
je 0x109901c
push dword [ebx + 0x3c]
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x5c]
cmp word [eax + 4], bp
pop ecx
pop ecx
push 5
push ebp
je 0x1098fea
lea eax, [esi + 8]
push eax
jmp 0x1098feb
push esi
call edi
push 0x1005b14
push esi
call dword [sym.imp.msvcrt.dll_wcscat]
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x5c]
cmp word [eax + 4], bp
pop ecx
pop ecx
push 5
push ebp
je 0x1099011
lea eax, [esi + 8]
push eax
jmp 0x1099012
push esi
call edi
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov esi, dword [esp + 0x10]
push dword [ebx + 0x3c]
push dword [esp + 0x20]
call fcn.0108e25c
cmp esi, ebp
je 0x1099048
push esi
push dword [ebx + 0x3c]
push dword [ebx + 0x38]
push dword [esp + 0x28]
call fcn.0108d789
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop esi
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x1099e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x34]
mov ebx, dword [eax + 0x34]
test ebx, ebx
push edi
mov dword [ebp - 8], eax
jne 0x1099e8b
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x38]
cmp ecx, edx
je 0x1099e84
mov edi, dword [eax + 0x18]
mov ebx, dword [edi + ecx*4]
inc ecx
test ebx, ebx
mov dword [eax + 0x38], ecx
je 0x1099e6f
test ebx, ebx
jne 0x1099e8b
or ebx, 0xffffffff
cmp ebx, 0xffffffff
jne 0x1099e99
mov ax, 0xfe07
jmp 0x1099ff3
push dword [ebx + 8]
lea eax, [ebp - 0x254]
push dword [ebx + 4]
push dword [ebx]
push 0x1011d38
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x18
lea edi, [eax + eax + 2]
push edi
push esi
call fcn.010981ff
test eax, eax
jne 0x1099edb
or ax, 0xffff
jmp 0x1099ff3
mov esi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [esi + 0x98], ecx
mov dword [esi + 0x94], ecx
mov dword [esi + 0x90], ecx
mov word [esi + 0xa0], cx
lea ecx, [ebp - 0x254]
push ecx
mov dword [esi + 0x7c], eax
mov byte [esi], 9
mov dword [esi + 0x9c], 1
push dword [eax + 0x18]
call dword [sym.imp.msvcrt.dll_wcscpy]
mov eax, dword [esi + 0x7c]
pop ecx
mov word [eax + 0x1c], di
pop ecx
lea eax, [ebp - 0x18]
push eax
mov word [esi + 0x78], 1
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edi, dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esi + 0x60]
push eax
lea eax, [ebp - 0x18]
push eax
call edi
lea eax, [esi + 0x70]
push eax
lea eax, [ebp - 0x18]
push eax
call edi
lea eax, [esi + 0x68]
push eax
lea eax, [ebp - 0x18]
push eax
call edi
xor edi, edi
push edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push dword [ebx + 0x10]
push dword [ebp + 8]
call fcn.010a7a67
test ax, ax
jne 0x1099fd7
push edi
push 0x2000080
push 3
push edi
push 3
push pe_nt_image_headers32
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1099fcf
lea eax, [ebp - 0x4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1099fc8
mov eax, dword [ebp - 0x4c]
mov dword [esi + 0x40], eax
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x60], eax
mov eax, dword [ebp - 0x44]
mov dword [esi + 0x64], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x70], eax
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x74], eax
mov eax, dword [ebp - 0x40]
mov dword [esi + 0x68], eax
mov eax, dword [ebp - 0x3c]
mov dword [esi + 0x6c], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call fcn.010a7422
mov eax, dword [0x10dd1b0]
mov ecx, dword [ebp - 8]
mov dword [esi + 0x38], eax
mov eax, dword [0x10dd1b4]
mov dword [esi + 0x3c], eax
mov eax, dword [ebx + 0x14]
mov dword [ecx + 0x34], eax
xor ax, ax
pop edi
pop esi
pop ebx
leave
ret 8