joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4458b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4458e3
push esi
call fcn.00453c50
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4458dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x445969
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x445952
mov eax, dword [esi + 8]
test eax, eax
je 0x445907
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44594e
cmp eax, 2
je 0x445952
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4458fa
cmp eax, 3
je 0x44592d
cmp eax, 1
jne 0x4458fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4458fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4458fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00445990
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x445978
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00445990
add esp, 4
pop esi
ret

Function at 0x446200
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x446221
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x446221
mov eax, dword [eax + 0x44]
test eax, eax
je 0x446221
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x463c70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x677440]
xor edx, edx
cmp eax, edx
jne 0x463c96
xor eax, eax
mov byte [eax + 0x677340], al
inc eax
cmp eax, 0x100
jl 0x463c7e
mov dword [0x677440], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x677340
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x463d27
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x463cfa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x463cc8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x463da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x463df3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x463dda
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x497c1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0046b0b0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x630e5c
call fcn.0048952d
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x46a823
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048952d
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x46a81c
push 0
mov ecx, eax
call fcn.004618b0
mov dword [esi + 0xc], eax
jmp 0x46a825
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x46a825
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x48bb93
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48bbcb
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00489c47
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00489c1f
jmp 0x48bbd7
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48d286
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48d2c8
call fcn.00492d3f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48d2c8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48d2bf
xor eax, eax
jmp 0x48d2d0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048d2d6
pop edi
pop esi
pop ebx
ret 4
Function at 0x49326f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49329d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4932bb
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004931d5
jmp 0x4932bb
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4932bb
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004931d5
test edi, edi
mov eax, edi
jne 0x4932a5
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1000426f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x1000428a
call fcn.100042fa
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x100042b6
push 6
call fcn.100122d1
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100042e0
push 6
call fcn.100122d1
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x100042f4
mov esp, ebp
pop ebp
ret 8
Function at 0x10004cd8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.100133b0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10004d1d
push ebx
call fcn.100122c5
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10004d4b
push 6
call fcn.100122d1
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x10004d67
push eax
mov ebx, eax
call fcn.1000246d
inc eax
push eax
call fcn.100122bf
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10004d6c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10004d7d
push ebx
call fcn.100122c5
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1000cff1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.100133b0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000d036
push ebx
call fcn.100122c5
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x100
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1000d061
push 6
call fcn.100122d1
add esp, 4
push 0x1002d5c9
push dword [ebp - 4]
mov ecx, 2
call fcn.100024d8
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x1000d081
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000d092
push ebx
call fcn.100122c5
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1000df62
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [0x1002e05c], 0x4d29ac2
push 0
mov ebx, 0x108
call fcn.100143c0
add esp, 4
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x1000dfb0
mov eax, 0x1002d437
push eax
push 2
mov ebx, 0x138
call fcn.100133f0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000dfd6
push ebx
call fcn.100122c5
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1000dfe9
mov eax, 0x1002d437
push eax
push 1
mov ebx, 0x154
call fcn.100132d0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1000e00f
push ebx
call fcn.100122c5
add esp, 4
push str..tmp
push dword [ebp - 0x10]
call fcn.10001100
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1000e03d
push ebx
call fcn.100122c5
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x1000e13c
push 0x80000004
push 0
push str.Super_EC
push 1
mov ebx, 0x158
call fcn.10014460
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000e094
push 6
call fcn.100122d1
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000e0a7
push ebx
call fcn.100122c5
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push 0
push 0
push 6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1000e0e3
push 6
call fcn.100122d1
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 3
mov eax, 0x1002d52d
test eax, eax
je 0x1000e0fa
add eax, 8
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1000e11a
push 6
call fcn.100122d1
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1000e13c
push 6
call fcn.100122d1
add esp, 4
call fcn.1000e14f
mov eax, 0
jmp 0x1000e14b
mov esp, ebp
pop ebp
ret
Function at 0x1000e173
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [0x1002e060], 0x4d29ac2
push 0
mov ebx, 0x108
call fcn.100143c0
add esp, 4
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 4
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x1000e1c1
mov eax, 0x1002d437
push eax
push 2
mov ebx, 0x138
call fcn.100133f0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000e1e7
push ebx
call fcn.100122c5
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1000e1fa
mov eax, 0x1002d437
push eax
push 1
mov ebx, 0x154
call fcn.100132d0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x1000e220
push ebx
call fcn.100122c5
add esp, 4
push str..tmp
push dword [ebp - 0x10]
call fcn.10001100
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1000e24e
push ebx
call fcn.100122c5
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x1000e34d
push 0x80000004
push 0
push str.Super_EC
push 1
mov ebx, 0x158
call fcn.10014460
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000e2a5
push 6
call fcn.100122d1
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000e2b8
push ebx
call fcn.100122c5
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0
push 0
push 0
push 6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1000e2f4
push 6
call fcn.100122d1
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 3
mov eax, 0x1002d52d
test eax, eax
je 0x1000e30b
add eax, 8
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1000e32b
push 6
call fcn.100122d1
add esp, 4
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1000e34d
push 6
call fcn.100122d1
add esp, 4
call fcn.1000e360
mov eax, 0
jmp 0x1000e35c
mov esp, ebp
pop ebp
ret
Function at 0x10013590
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10013622
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x10013614
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x1001360c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x100135d5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x6ccf2f8f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx dx, cl
cmp ch, 0x84
add esi, eax
shrd dx, cx, 1
inc dl
mov edx, dword [esi + 0x78]
clc
bt cx, dx
test edx, edx
pushal
pushal
call fcn.6ccf5254
add byte [eax], al
push eax
jns 0x6ccf02c6
imul esp, dword [ebx + 0x74], 0x7a69535f
add ah, dl
pop ss
mov eax, dword [ebp - 8]
bt esi, 7
push esi
shl eax, 1
pushfd
mov word [esp + 4], 0x673a
pushal
lea esp, [esp + 0x28]
je 0x6ccfb2b3
pushfd
jmp 0x6ccf26f9
rcl ax, cl
push ebp
btc eax, 0x15
rol ah, 1
pushfd
lea ebp, [esp + 4]
push ebp
sub esp, 0x10
lahf
push esi
movzx eax, cl
mov ax, si
test dl, 0x18
shl eax, 1
push edi
pushal
das
xor ax, 0x7d20
rcl al, cl
mov dword [esp + 0x1c], ebx
lea eax, [eax + 0x56d5a815]
bsr eax, esi
lea eax, [ebx*4 + 0x57f4509e]
mov dword [esp + 0x18], edx
btr ax, bp
shrd ax, bp, 9
mov eax, dword [ebp + 8]
test bx, bp
jmp 0x6ccf3e3c
cmc
test eax, eax
push dword [esp]
push dword [esp + 4]
lea esp, [esp + 0x20]
je fcn.6ccfaff9
clc
bts dx, 4
xchg dx, si
mov esi, dword [eax + 0x3c]
dec dx
jmp 0x6ccf025c
Function at 0x10001b9b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
cmp dword [ebp + 0x10], 0
jne 0x10001bb5
mov dword [ebp + 0xc], 0x61a8
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
push 0
push 0x11010
push 0x1000f2c4
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
xor eax, eax
call dword [sym.imp.USER32.dll_MessageBoxTimeoutA]
nop
nop
cmp dword [ebp - 4], esp
je 0x10001bfa
push 0x7a
push 0x4010abf
push 6
call fcn.10004558
add esp, 0xc
mov dword [ebp - 4], esp
push 0
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 4], esp
je 0x10001c2d
push 0xad
push 0x4010abf
push 6
call fcn.10004558
add esp, 0xc
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10001d7d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x10001dcf
mov dword [ebp - 0xc], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10001dc7
push 0x4f
push 0x4010aae
push 6
call fcn.10004558
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x10001dd5
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001de9
mov eax, 0
jmp 0x10001e25
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10001e1a
push 0x101
push 0x4010aae
push 6
call fcn.10004558
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10001e25
mov esp, ebp
pop ebp
ret 8

Function at 0x100021ad
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
push 5
push 0x1000f2c4
push 0x1000f2c4
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push str.open
mov eax, dword [ebp + 8]
and eax, 0xff
push eax
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002201
push 0
push 0x4010082
push 6
call fcn.10004558
add esp, 0xc
mov esp, ebp
pop ebp
ret 8

Function at 0x10005110
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10005179
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.100047b0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x100051e0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x10005260
push edi
call dword [0x1000fe48]
add esp, 4
test eax, eax
jbe 0x10005260
test esi, esi
je 0x1000521e
cmp esi, 0xffffffff
je 0x1000521e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x100052a2
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x1000524c
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x10005260
jmp 0x1000525b
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x10005260
mov ebp, 1
test esi, esi
je 0x100052a2
cmp esi, 0xffffffff
je 0x100052a2
test ebp, ebp
jne 0x100052d9
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x100052af
call edi
test eax, eax
je 0x100052a2
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x100052d9
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x1000528a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x100052a2
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x100052d9
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x100052bc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call dword [0x1000fe48]
inc eax
push eax
call fcn.100047b0
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x10005d10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10005da2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x10005d94
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x10005d8c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x10005d55
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x10006d40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x10006d4c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x10006ddf
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x10006da9
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.10006df0
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x10006d7e
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x10006e10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x10006f0d
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x10006e62
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x10006e8e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.10006df0
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x10006ecf
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x10006e51
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret