joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468584
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46859b
add esp, 0xfffffff0
call fcn.00404548
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f908
mov eax, dword [0x481244]
cmp word [eax + 2], 0
jne 0x4685c3
mov eax, dword [0x481244]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046a034
mov eax, dword [0x4812f8]
cmp word [eax + 2], 0
jne 0x4685dd
mov eax, dword [0x4812f8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0046a240
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4176ec]
call fcn.004041f4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4176ec]
call fcn.004041f4
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x4176ec]
call fcn.004041f4
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x423ff4]
call fcn.0042b8a8
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x468794
mov eax, dword [0x481158]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042bc7c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46a910
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x481158]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040de9c
test eax, eax
je 0x4686e4
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409e1c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ded0
test eax, eax
je 0x4686f8
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004052c0
mov byte [ebx + 0xd4], 0
push ebx
push 0x469b94
call fcn.00420a84
mov dword [ebx + 0xc8], eax
mov eax, dword [0x48102c]
cmp byte [eax], 0
jne 0x468749
mov eax, ebx
call fcn.004688d8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0046aaec
mov eax, ebx
call fcn.0046b64c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x468789
call fcn.004045a0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468b58
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4855a8]
cmp dword [eax + 0x30], 0
je 0x468c02
cmp dword [ebx + 0x94], 0
jne 0x468bfc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x468ae8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x468bfc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x468bc2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x468bfc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419a98
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x468bd1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46991c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x469951
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405140
jmp 0x46995e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004050a4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46acd0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46ad3e
mov eax, esi
call fcn.00454f5c
test al, al
je 0x46ad3e
mov eax, dword [ebx + 0x84]
call fcn.00454bbc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46ad3e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46ad32
push 0
mov eax, dword [ebx + 0x84]
call fcn.00454bbc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0044cfdc
jmp 0x46ad3e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0046ab0c
pop esi
pop ebx
ret
Function at 0x48ef3f
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x48ef7a
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x48ef61
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x48ef72
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x48ef7c
inc edi
add eax, 0x28
cmp edi, esi
jb 0x48ef57
xor eax, eax
pop edi
pop esi
ret

Function at 0x48fbf1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
cmp dword [ebp + 0xc], 8
jne 0x48fd85
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
invalid
invalid
push esp
stc

Function at 0x48fd9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx + 0x4680845]
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax + 0x6a]
add bh, bh
xchg ebp, eax
enter 0xfffffffffffffffa, 0xffffffffffffffff
call fcn.0048eeff
inc esi
int1
invalid
call dword [ecx]
jb 0x48fdb9
fadd qword [eax - 0x22f5b]
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0048eedd
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
invalid
invalid
cdq
cld
Function at 0x4d5080
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x555f80
call fcn.004d5d30
push 1
call fcn.004d542b
pop ecx
test al, al
jne 0x4d4f32
push 7
call fcn.004d5acb
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004d53f6
mov byte [ebp - 0x24], al
mov eax, dword [0x55c534]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4d4f2b
test eax, eax
jne 0x4d4f9c
mov dword [0x55c534], ecx
push 0x50d54c
push 0x50d528
call fcn.004eb28e
pop ecx
pop ecx
test eax, eax
je 0x4d4f7f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4d5075
push 0x50d524
push 0x50d4c0
call fcn.004eb232
pop ecx
pop ecx
mov dword [0x55c534], 2
jmp 0x4d4fa1
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004d5598
pop ecx
call fcn.004d5abf
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4d4fd1
push esi
call fcn.004d550e
pop ecx
test al, al
je 0x4d4fd1
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004d5d1b
call esi
call fcn.004d5ac5
mov esi, eax
cmp dword [esi], edi
je 0x4d4fef
push esi
call fcn.004d550e
pop ecx
test al, al
je 0x4d4fef
push dword [esi]
call fcn.004e8533
pop ecx
call fcn.004d5be7
movzx eax, ax
push eax
call fcn.004eb1ec
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.004d5c1a
test al, al
jne 0x4d501a
push esi
call fcn.004e856b
test bl, bl
jne 0x4d5023
call fcn.004e850e
push edi
push 1
call fcn.004d55b5
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4d5075
call fcn.004d5d76
ret
call fcn.004d59fc
jmp 0x4d4f13

Function at 0x4ef2cc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ef149

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0xb6f4349
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x60ce29c8
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10008090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bbf7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101165dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [eax], vtable.IWebLoginHandler.0
mov dword [eax + 4], 3
mov dword [eax + 8], ecx
mov edx, 7
xor esi, esi
mov dword [eax + 0x20], edx
mov dword [eax + 0x1c], ecx
mov word [eax + 0xc], si
mov dword [ebp - 4], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov byte [ebp - 4], 1
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov byte [ebp - 4], 2
mov dword [eax + 0x5c], edx
mov dword [eax + 0x58], ecx
mov word [eax + 0x48], si
mov byte [ebp - 4], 3
mov dword [eax + 0x78], edx
mov dword [eax + 0x74], ecx
mov word [eax + 0x64], cx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012b80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d5eb
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x101165dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov dword [ebp - 4], esi
mov ecx, dword [edi + 4]
mov edx, dword [edi]
or ecx, 0x2001f
push ecx
push eax
push edx
lea ecx, [ebp - 0x21c]
call fcn.100122a0
mov ebx, eax
cmp ebx, esi
je 0x10012c14
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
cmp eax, esi
je 0x10012c0d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x21c], esi
mov eax, ebx
jmp 0x10012cfa
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [ebp - 0x21c]
push esi
push esi
push esi
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x210]
push edx
push esi
push eax
mov dword [ebp - 0x220], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10012c9c
jmp 0x10012c50
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.10012b80
mov ebx, eax
cmp ebx, esi
jne 0x10012bef
lea edx, [ebp - 0x22c]
push edx
mov edx, dword [ebp - 0x21c]
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x210]
push ecx
push esi
push edx
mov dword [ebp - 0x220], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10012c50
mov eax, dword [ebp - 0x21c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x10012cb5
push eax
call ebx
mov dword [ebp - 0x21c], esi
mov ecx, dword [edi + 8]
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x218], esi
push eax
cmp ecx, esi
je 0x10012cd3
mov edx, dword [edi]
push edx
call fcn.100120e0
jmp 0x10012cdc
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
cmp eax, esi
je 0x10012cf8
push eax
call ebx
mov dword [ebp - 0x21c], esi
mov eax, edi
mov dword [ebp - 0x218], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10027de5
mov esp, ebp
pop ebp
ret 4
Function at 0x100151e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003dd16
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x101165dc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x418], edx
mov byte [ebp - 4], 1
push 2
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x420], esi
test esi, esi
jne 0x1001525d
call fcn.10012020
mov edi, eax
jmp 0x10015342
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10015276
call fcn.10012020
jmp 0x10015339
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x10015294
call fcn.10012020
jmp 0x10015339
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x100152b5
mov edi, 0x8007000e
jmp 0x1001533b
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x418]
call fcn.100138b0
mov dword [ebp - 4], 1
jmp 0x100152ed
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x100152fe
mov edi, 0x8007000e
jmp 0x1001533b
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10015317
call fcn.10012020
jmp 0x10015339
xor ecx, ecx
mov edx, dword [ebp - 0x418]
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x42c]
call fcn.10014eb0
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea edx, [ebp - 0x414]
cmp dword [ebp - 0x418], edx
je 0x1001535f
lea ecx, [ebp - 0x418]
call fcn.10012a30
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10027de5
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10018b5d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10018b77
test al, 0x10
jne 0x10018b77
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10018b7b
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x101165dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x10018bd1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test edi, edi
je 0x10018bc8
push 5
push 0
push edi
call esi
push 5
push edi
push ebx
call esi
pop esi
jmp 0x10018be3
push str.wininit.ini
push edi
push ebx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10027de5
leave
ret

Function at 0x10018cd9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x10018d04
mov eax, dword [ecx + 4]
test eax, eax
je 0x10018d04
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.1002b7a2
sub eax, dword [ebp + 0xc]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
jmp 0x10018d06
xor eax, eax
pop ebp
ret 8
Function at 0x10018d41
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1890
call fcn.10028a90
mov eax, dword [0x101165dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1890], ebx
mov dword [ebp - 0x1888], esi
test ebx, ebx
je 0x10018fac
and dword [ebp - 0x188c], 0
test esi, esi
jne 0x10018db2
push 0x800
lea eax, [ebp - 0x1884]
push esi
push eax
call fcn.10027e50
lea eax, [ebp - 0x1884]
push eax
call fcn.1001904b
lea eax, [ebp - 0x1884]
add esp, 0x10
mov dword [ebp - 0x1888], eax
mov esi, eax
push esi
call fcn.1002b4f8
cmp word [esi + eax*2 - 2], 0x5c
pop ecx
jne 0x10018dcb
mov dword [ebp - 0x188c], 1
push ebx
call fcn.10018b5d
pop ecx
test eax, eax
je 0x10018fac
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test edi, edi
jne 0x10018ded
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10018df3
push 0xb
push edi
push ebx
call esi
test eax, eax
jne 0x10018fac
mov ebx, 0x7fe
push ebx
push eax
mov word [ebp - 0x1084], ax
lea eax, [ebp - 0x1082]
push eax
call fcn.10027e50
xor eax, eax
push ebx
mov word [ebp - 0x884], ax
xor ebx, ebx
lea eax, [ebp - 0x882]
push ebx
push eax
call fcn.10027e50
add esp, 0x18
cmp edi, ebx
je 0x10018e9c
push edi
call fcn.10018b5d
pop ecx
test eax, eax
je 0x10018e91
push edi
lea eax, [ebp - 0x884]
push str._s.bak
push eax
call fcn.10001f90
add esp, 0xc
push 0x5c
push edi
call fcn.10029801
pop ecx
pop ecx
cmp dword [ebp - 0x188c], ebx
je 0x10018e6a
add eax, 2
push eax
push dword [ebp - 0x1888]
lea eax, [ebp - 0x1084]
push str._s_s.bak
push eax
call fcn.10001f90
add esp, 0x10
push 0xb
lea eax, [ebp - 0x884]
push eax
push edi
call esi
push 0xb
push edi
push dword [ebp - 0x1890]
jmp 0x10018ef1
mov edi, dword [ebp - 0x1890]
push edi
lea eax, [ebp - 0x884]
push str._s.bak
push eax
call fcn.10001f90
add esp, 0xc
push 0x5c
push edi
call fcn.10029801
pop ecx
pop ecx
cmp dword [ebp - 0x188c], ebx
je 0x10018ecc
add eax, 2
push eax
push dword [ebp - 0x1888]
lea eax, [ebp - 0x1084]
push str._s_s.bak
push eax
call fcn.10001f90
add esp, 0x10
push 0xb
lea eax, [ebp - 0x884]
push eax
push edi
call esi
cmp word [ebp - 0x1084], bx
je 0x10018fac
cmp word [ebp - 0x884], bx
je 0x10018fac
lea eax, [ebp - 0x884]
push eax
call fcn.10018b5d
pop ecx
test eax, eax
je 0x10018fac
push 0
call fcn.10028c7f
mov edi, eax
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call fcn.10027e50
push edi
lea eax, [ebp - 0x84]
push 0x1003ff64
push eax
call fcn.10001f90
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1084]
push eax
call fcn.1002ba90
add esp, 0x24
push 0xb
lea eax, [ebp - 0x1084]
push eax
lea eax, [ebp - 0x884]
push eax
call esi
test eax, eax
lea eax, [ebp - 0x1084]
jne 0x10018fa2
push str..bak
push eax
call fcn.1002ba90
mov eax, ebx
pop ecx
inc ebx
pop ecx
cmp eax, 0xa
jl 0x10018f6b
lea eax, [ebp - 0x884]
push 0
push eax
call fcn.10018b7b
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10027de5
leave
ret
Function at 0x1001904b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x101165dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x804]
push eax
mov esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
ja 0x10019087
test eax, eax
je 0x10019087
lea eax, [ebp - 0x804]
push eax
jmp 0x1001908c
push str.c:_temp
push edi
call fcn.1002bac1
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10027de5
leave
ret

Function at 0x10019619
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov edi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10019645
mov dword [ecx], eax
jmp 0x10019655
cmp eax, 0xffffffff
je 0x10019655
test eax, eax
je 0x10019655
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebp
ret

Function at 0x1001987d
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x100]
mov byte [ebp + 0xb], cl
mov cl, byte [eax + 0x101]
mov byte [ebp - 1], cl
je 0x100198dc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
dec dword [ebp + 0x10]
inc byte [ebp + 0xb]
movzx esi, byte [ebp + 0xb]
mov dl, byte [esi + eax]
add byte [ebp - 1], dl
movzx ecx, byte [ebp - 1]
mov bl, byte [ecx + eax]
mov byte [ecx + eax], dl
movzx ecx, bl
movzx edx, dl
add ecx, edx
and ecx, 0xff
mov byte [esi + eax], bl
mov cl, byte [ecx + eax]
xor byte [edi], cl
inc edi
cmp dword [ebp + 0x10], 0
jne 0x100198a2
pop edi
pop esi
pop ebx
mov cl, byte [ebp + 0xb]
mov byte [eax + 0x100], cl
mov cl, byte [ebp - 1]
mov byte [eax + 0x101], cl
leave
ret

Function at 0x10027de5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101165dc]
jne 0x10027def
repz ret
jmp fcn.1002d5ec
Function at 0x100368d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101165dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1002d01a
and dword [ebp - 0x14], 0
cmp dword [0x10118774], 0
mov dword [ebp - 0x18], eax
jne 0x10036988
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10036a30
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10036a30
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10118774], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10118778], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1011877c], eax
call edi
push eax
call esi
mov dword [0x10118784], eax
test eax, eax
je 0x10036988
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10118780], eax
mov eax, dword [0x10118780]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100369e1
cmp dword [0x10118784], ecx
je 0x100369e1
push eax
call esi
push dword [0x10118784]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100369e1
test ebx, ebx
je 0x100369e1
call edi
test eax, eax
je 0x100369d8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100369d8
test byte [ebp - 8], 1
jne 0x100369e1
or dword [ebp + 0x10], 0x200000
jmp 0x10036a14
mov eax, dword [0x10118778]
cmp eax, dword [ebp - 0x18]
je 0x10036a14
push eax
call esi
test eax, eax
je 0x10036a14
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10036a14
mov eax, dword [0x1011877c]
cmp eax, dword [ebp - 0x18]
je 0x10036a14
push eax
call esi
test eax, eax
je 0x10036a14
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10118774]
call esi
test eax, eax
je 0x10036a30
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10036a32
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10027de5
leave
ret