joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8809cc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x880a4d
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x880a32
mov eax, dword [esi]
add eax, 8
call fcn.008809cc
mov ebx, dword [esi]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov dword [esi], eax
cmp byte [ebx + 0x14], 0
jne 0x880a25
cmp dword [ebx + 0x1d], 0
je 0x880a25
mov eax, dword [ebx + 0x1d]
push eax
call sub.kernel32.dll_CloseHandle
lea edx, [ebp - 4]
mov eax, ebx
call fcn.008808a8
mov eax, dword [ebp - 4]
call fcn.008738c8
push eax
call sub.kernel32.dll_DeleteFileA
mov edx, dword [0x8804ac]
mov eax, ebx
call fcn.008742a0
cmp dword [esi], 0
jne 0x8809e5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x880a54
lea eax, [ebp - 4]
call fcn.00873414
ret
Function at 0x880d08
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x880e59
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
lea edi, [esi + ebx]
mov eax, edi
mov edx, 4
call fcn.008804d4
mov dword [ebp - 0x10], eax
mov eax, edi
add eax, dword [ebp + 8]
test eax, eax
jbe 0x880e3e
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
call fcn.008808a8
mov eax, dword [ebp - 0x2c]
call fcn.008738c8
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x880e30
push 0
push 0
mov eax, edi
mov edx, 4
call fcn.008804d4
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_SetFilePointer
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_SetEndOfFile
push 0
push 0
push 0
push 4
push 0
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x880e27
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x880e1e
mov eax, edi
mov edx, 4
call fcn.008804d4
mov edx, eax
add edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00874ff0
push ebp
mov eax, dword [ebp - 0x18]
call fcn.00880aec
pop ecx
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x28]
call fcn.008738c8
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x880e60
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00873438
ret
Function at 0x881670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x881733
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x14]
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 0x15], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov dword [ebx + 0x19], eax
xor eax, eax
mov dword [ebx + 0x21], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], 0x8000
jbe 0x881709
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
lea edx, [ebp - 8]
mov eax, ebx
call fcn.008808a8
mov eax, dword [ebp - 8]
call fcn.008738c8
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
mov dword [ebx + 0x1d], esi
cmp esi, 0xffffffff
je 0x881702
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
jmp 0x88171d
xor eax, eax
mov dword [ebx + 0x1d], eax
jmp 0x88171d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
lea eax, [ebx + 0x10]
call fcn.00873504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x88173a
lea eax, [ebp - 8]
call fcn.00873414
ret

Function at 0x8818bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
xor ecx, ecx
push ebp
push 0x88197d
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea edi, [edx + 1]
sub edi, 2
test edi, edi
jl 0x881967
inc edi
mov ebx, eax
mov eax, dword [ebx]
mov eax, dword [eax]
mov eax, dword [eax + 4]
xor edx, edx
call fcn.00873c60
jne 0x881903
mov eax, dword [ebx + 4]
mov eax, dword [eax]
dec dword [eax + 0x25]
jmp 0x88190b
mov eax, dword [ebx + 4]
mov eax, dword [eax]
dec dword [eax + 0x21]
mov eax, dword [ebx]
mov eax, dword [eax]
mov esi, eax
mov eax, dword [eax + 0xc]
mov edx, dword [ebx]
mov dword [edx], eax
cmp byte [esi + 0x14], 0
jne 0x881945
cmp dword [esi + 0x1d], 0
je 0x881945
mov eax, dword [esi + 0x1d]
push eax
call sub.kernel32.dll_CloseHandle
lea edx, [ebp - 8]
mov eax, esi
call fcn.008808a8
mov eax, dword [ebp - 8]
call fcn.008738c8
push eax
call sub.kernel32.dll_DeleteFileA
mov edx, dword [0x8804ac]
mov eax, esi
call fcn.008742a0
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov edx, dword [eax + 0x25]
add edx, dword [eax + 0x21]
test edx, edx
ja 0x881967
add ebx, 4
dec edi
jne 0x8818e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x881984
lea eax, [ebp - 8]
call fcn.00873414
ret
Function at 0x881b1c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.008726e4
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [0x890824]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop ebx
ret

Function at 0x881b6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x881c1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00880408
lea eax, [ebp - 0x24]
call fcn.00881b1c
test al, al
je 0x881c01
mov ecx, dword [ebp - 0x18]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.00873504
mov ebx, dword [ebp - 0x1c]
dec ebx
test ebx, ebx
jl 0x881c01
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.008738c8
push eax
push esi
mov eax, dword [0x890824]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 8]
call fcn.008738c8
mov edx, eax
lea eax, [ebp - 0x28]
call fcn.0087360c
mov edx, dword [ebp - 0x28]
mov eax, edi
call fcn.008803b4
inc esi
dec ebx
jne 0x881bb9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x881c26
lea eax, [ebp - 0x28]
call fcn.00873414
lea eax, [ebp - 8]
call fcn.00873414
ret

Function at 0x881e90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x881ef2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, ebx
call fcn.008738c8
push eax
mov eax, dword [0x890824]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x881ee8
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
call fcn.00881dec
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x881efc
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x882770
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x88277f
or edx, 0x200
test eax, 0x20000000
je 0x8827b3
test eax, 0x40000000
je 0x88279e
test eax, 0x80000000
je 0x882799
or edx, 0x40
jmp 0x8827da
or edx, 0x20
jmp 0x8827da
test eax, 0x80000000
je 0x8827ad
or edx, 0x80
jmp 0x8827da
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x8827cb
test eax, 0x80000000
je 0x8827c6
or edx, 4
jmp 0x8827da
or edx, 2
jmp 0x8827da
test eax, 0x80000000
je 0x8827d7
or edx, 8
jmp 0x8827da
or edx, 1
mov eax, edx
ret
Function at 0x8838b4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x8838bc
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x883a1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor edx, edx
push ebp
push 0x8839f9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
call fcn.00876d08
mov eax, dword [eax + 0x7c]
test eax, eax
jne 0x883904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x883a03
mov eax, ebx
call fcn.00876d9c
mov esi, eax
add ebx, dword [esi + 0x1c]
mov eax, ebx
shr eax, 0xc
mov dword [ebp - 8], eax
push 0
push 0x1000
push 0
push 4
mov edi, ebx
and edi, 0xfff
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x14]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
call fcn.008742c8
add eax, 0xfff
adc edx, 0
call fcn.008742ec
mov dword [ebp - 4], eax
sub ebx, edi
mov eax, dword [ebp - 4]
shl eax, 0xc
push eax
mov esi, ebx
push esi
call sub.kernel32.dll_IsBadWritePtr
cmp eax, 1
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x8839ef
lea eax, [ebp - 0x34]
call fcn.00876890
cmp byte [ebp - 0x22], 0
je 0x883998
lea eax, [ebp - 0x14]
push eax
push 0x40
mov eax, dword [ebp - 4]
shl eax, 0xc
push eax
push esi
call sub.kernel32.dll_VirtualProtect
jmp 0x8839d8
push 0x883a30
call sub.kernel32.dll_GetModuleHandleA
mov edx, 1
call fcn.00883748
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
test eax, eax
jne 0x8839c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x883a03
push 0x20060000
push 0xffffffff
push dword [ebp - 4]
push dword [ebp - 8]
push 0x1000d
call dword [ebp - 0xc]
mov eax, dword [ebp - 4]
shl eax, 0xc
push eax
push ebx
call sub.kernel32.dll_IsBadWritePtr
cmp eax, 1
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x883a03
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x883a26
lea eax, [ebp - 0x34]
mov edx, dword [0x8767a0]
call fcn.00873e18
ret
Function at 0x883c60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, edx
mov ebp, eax
mov byte [esp + 4], 0
mov eax, ebp
call fcn.00876d08
test eax, eax
je 0x883cfa
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, ebp
add edx, dword [eax + 4]
mov dword [esp + 0xc], edx
test esi, esi
je 0x883cfa
jmp 0x883cf4
mov eax, dword [esi + 0x10]
cmp eax, dword [esp + 0xc]
ja 0x883cfa
test eax, eax
je 0x883cf1
mov ebx, eax
add ebx, ebp
jmp 0x883ceb
cmp edi, eax
jne 0x883ce8
lea eax, [esp + 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x883ce8
push 4
push ebx
call sub.kernel32.dll_IsBadWritePtr
test eax, eax
jne 0x883cd6
mov eax, dword [esp]
mov dword [ebx], eax
mov byte [esp + 4], 1
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x883ca9
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x883c96
mov al, byte [esp + 4]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x884684
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
test edi, edi
jle 0x8847a6
lea eax, [edi + 2]
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, esi
call fcn.008739f8
mov ecx, dword [esi]
mov eax, edi
mov esi, 3
cdq
idiv esi
mov esi, eax
test esi, esi
jle 0x88471d
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
xor edx, edx
mov dl, byte [ebx + 1]
shl edx, 8
add eax, edx
xor edx, edx
mov dl, byte [ebx + 2]
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x88e134]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x88e134]
mov byte [ecx + 1], dl
mov edx, eax
shr edx, 6
and edx, 0x3f
mov dl, byte [edx + 0x88e134]
mov byte [ecx + 2], dl
and eax, 0x3f
mov al, byte [eax + 0x88e134]
mov byte [ecx + 3], al
add ecx, 4
add ebx, 3
dec esi
jne 0x8846be
mov eax, edi
mov esi, 3
cdq
idiv esi
dec edx
je 0x88472f
dec edx
je 0x88475f
jmp 0x8847ad
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x88e134]
mov byte [ecx], dl
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x88e134]
mov byte [ecx + 1], al
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
jmp 0x8847ad
xor eax, eax
mov al, byte [ebx]
shl eax, 0x10
xor edx, edx
mov dl, byte [ebx + 1]
shl edx, 8
add eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
mov dl, byte [edx + 0x88e134]
mov byte [ecx], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
mov dl, byte [edx + 0x88e134]
mov byte [ecx + 1], dl
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x88e134]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
jmp 0x8847ad
mov eax, esi
call fcn.00873414
pop edi
pop esi
pop ebx
ret
Function at 0x884eb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
jmp 0x884f6c
mov ebx, dword [edi + 0xc]
add ebx, dword [ebp + 8]
push 4
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x884f69
push ebx
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
mov ebx, dword [edi + 0x10]
add ebx, dword [ebp + 8]
mov esi, ebx
cmp dword [edi + 4], 0xffffffff
jne 0x884f4c
mov ebx, dword [edi]
add ebx, dword [ebp + 8]
jmp 0x884f4c
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x884f46
test byte [ebx + 3], 0x80
je 0x884f22
mov eax, dword [ebx]
and eax, 0xffff
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esi], eax
jmp 0x884f36
mov eax, dword [ebp + 8]
add eax, dword [ebx]
add eax, 2
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push esi
call sub.kernel32.dll_VirtualProtect
add ebx, 4
add esi, 4
push 4
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x884f69
push 2
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x884f69
cmp dword [ebx], 0
jne 0x884ef5
add edi, 0x14
push 0x14
push edi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x884f88
cmp dword [edi + 0x10], 0
je 0x884f88
cmp dword [edi + 0xc], 0
jne 0x884ec1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x885228
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x8853e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00873414
lea eax, [ebp - 8]
mov edx, 0x885400
call fcn.008734ac
mov bl, 0x43
lea eax, [ebp - 8]
call fcn.00873920
mov byte [eax], bl
mov eax, dword [ebp - 8]
call fcn.008738c8
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 3
jne 0x8853b3
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
mov ecx, 0x88540c
mov edx, dword [ebp - 8]
call fcn.00873714
mov eax, dword [ebp - 0x14c]
call fcn.008738c8
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
test esi, esi
je 0x8853b3
mov eax, dword [ebp - 0x148]
and eax, 0x10
cmp eax, 0x10
jne 0x88539e
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00873678
cmp dword [ebp - 0x150], 0
je 0x88532e
push dword [ebp - 8]
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00873678
push dword [ebp - 0x154]
push 0x885418
lea eax, [ebp - 4]
mov edx, 3
call fcn.00873788
jmp 0x88535f
push dword [ebp - 8]
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00873678
push dword [ebp - 0x158]
push 0x885418
lea eax, [ebp - 4]
mov edx, 3
call fcn.00873788
mov edx, dword [ebp - 4]
mov eax, 0x885424
call fcn.008739b0
test eax, eax
jne 0x88539e
mov edx, dword [ebp - 4]
mov eax, 0x885430
call fcn.008739b0
test eax, eax
jne 0x88539e
mov eax, dword [ebp - 4]
call fcn.008738c8
call fcn.00877c50
test al, al
je 0x88539e
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00873468
jmp 0x8853bd
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x8852d0
inc ebx
cmp bl, 0x5b
jne 0x88527a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8853ef
lea eax, [ebp - 0x158]
mov edx, 4
call fcn.00873438
lea eax, [ebp - 8]
mov edx, 2
call fcn.00873438
ret
Function at 0x88bd38
Capabilities:
Terminate thread

Disassembly:
push ecx
cmp dword [0x88e1bc], 0
jbe 0x88bd4d
mov eax, dword [0x88e1bc]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x88e198]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [0x88e1fc], 0
je 0x88bd82
mov eax, dword [0x88e194]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x88e18c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x88e190]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [0x88e1fc], 0
jne 0x88bdbf
cmp byte [0x88e204], 0
jne 0x88bdbf
cmp dword [0x88e188], 0
je 0x88bdbf
mov byte [0x88e180], 1
push esp
mov eax, dword [0x88e188]
push eax
call sub.kernel32.dll_GetExitCodeThread
mov eax, dword [esp]
push eax
mov eax, dword [0x88e188]
push eax
call sub.kernel32.dll_TerminateThread
pop edx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000bd40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10269840]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1000bdfc
cmp byte [esi + 0x3d], 0
je 0x1000bdfc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000bdea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1000bdb1
sub eax, 1
je 0x1000bdb5
sub eax, 2
jne 0x1000bdea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10104603
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000bdd3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000bdea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10104603
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10104603
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10104603
mov esp, ebp
pop ebp
ret
Function at 0x10021710
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10269840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc4]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xcc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10124aa0]
sub esi, 1
jne 0x10021743
mov eax, dword [0x10269d68]
not ebx
cmp dword [eax + 0x1bd0], ebx
jne 0x10021772
mov dword [eax + 0x1bd4], ebx
cmp dword [eax + 0x1c0c], ebx
jne 0x10021781
mov byte [eax + 0x1c10], 1
mov eax, dword [0x10269d68]
cmp dword [eax + 0x1bb8], ebx
jne 0x1002179c
push 0
push edi
push 4
push ebx
call fcn.1001fa50
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10104603
mov esp, ebp
pop ebp
ret 4

Function at 0x10021840
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10269840]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
vmovss xmm0, dword [edx]
mov edi, 0x10
vsubss xmm0, xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xc4]
vcvttss2si eax, xmm0
vmovss xmm0, dword [edx + 4]
vsubss xmm0, xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
vcvttss2si eax, xmm0
vmovss xmm0, dword [edx + 8]
vsubss xmm0, xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
vcvttss2si eax, xmm0
vmovss xmm0, dword [edx + 0xc]
vsubss xmm0, xmm0, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
vcvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xcc]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10124aa0]
sub edi, 1
jne 0x100218b4
mov eax, dword [0x10269d68]
not edx
pop edi
pop esi
cmp dword [eax + 0x1bd0], edx
jne 0x100218e5
mov dword [eax + 0x1bd4], edx
cmp dword [eax + 0x1c0c], edx
jne 0x100218f4
mov byte [eax + 0x1c10], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.10104603
mov esp, ebp
pop ebp
ret 4
Function at 0x10029160
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10269840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10269d68]
lea edx, [ebp - 8]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 0x1b98]
mov eax, dword [esi + 0xc4]
add esi, 0xc4
push edi
mov dword [ebp - 8], ecx
mov edi, 4
mov ebx, dword [esi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10124aa0]
sub edi, 1
jne 0x100291a1
mov eax, dword [0x10269d68]
not ebx
cmp dword [eax + 0x1bb8], ebx
jne 0x100291d9
push edi
push dword [ebp + 8]
push 4
push ebx
call fcn.1001fa50
add esp, 0x10
mov ecx, dword [esi + 4]
mov edi, dword [esi]
cmp edi, ecx
jne 0x10029204
inc edi
test ecx, ecx
je 0x100291f2
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x100291f7
mov eax, 8
cmp eax, edi
mov ecx, esi
cmovg edi, eax
push edi
call fcn.1002e800
mov ecx, dword [esi]
mov eax, dword [esi + 8]
pop edi
mov dword [eax + ecx*4], ebx
inc dword [esi]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10104603
mov esp, ebp
pop ebp
ret

Function at 0x1002b320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10269d68]
push esi
mov esi, dword [ebp + 8]
vxorps xmm0, xmm0, xmm0
vmovss dword [eax + 0x2f20], xmm0
test esi, esi
je 0x1002b37b
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push edi
push eax
call fcn.1002b380
push 0x10125178
push esi
mov edi, eax
call fcn.100222a0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1002b37a
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebp
ret