joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ad496
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x1015548d]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.100accf9
mov eax, dword [0x1016f5e4]
add eax, 0xffffe70f
mov dword [0x1016f5e4], eax
call fcn.100ad018
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.100ac9a5
cmp eax, 0
mov dword [ebp - 0x3c], eax
je 0x100ad5b4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [0x1016f5e4]
add ecx, 0x1acf
mov dword [0x1016f5e4], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.100ad296
mov eax, dword [ebp - 0x40]
mov word [eax], 0x5a4d
mov dword [eax + 0x3c], 0xc0
add eax, 0xc0
mov dword [ebp - 0x44], eax
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov dword [ecx], 0x4550
mov edx, dword [ebp - 0x40]
add edx, 0xffc00000
mov esi, dword [ebp - 0x30]
mov dword [esi + 0x3c], edx
mov dword [0x1016f5e4], 0x112
mov edx, dword [ebp - 0x40]
mov dword [esi + 0x40], edx
add edx, 0x167c
mov edi, dword [ebp - 0x40]
cmp edi, 0
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], eax
je 0x100ad5aa
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
add esp, 0x54
pop esi
pop edi
pop ebp
ret
xor eax, eax
add esp, 0x54
pop esi
pop edi
pop ebp
ret
Function at 0x100ad757
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov ecx, dword [0x1016f5e4]
add ecx, 0x4b29
mov dword [0x1016f5e4], ecx
mov dword [ebp - 0x10], eax
call fcn.100ace05
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x1016f5e8], 0x47e5
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x1016f5e4], 0x660
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x100ad81f
jmp 0x100ad858
xor eax, eax
mov ecx, dword [ebp - 0x28]
add ecx, 2
mov edx, dword [ebp - 0x2c]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x3c], edx
jb 0x100ad87c
jmp 0x100ad81f
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x4a], cl
je 0x100ad82a
jmp 0x100ad8ad
mov eax, dword [ebp - 0x24]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [ebp - 0x4a]
test al, 1
jne 0x100ad833
jmp 0x100ad7c1
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [0x1016f5e4], 0xc39
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x24], edi
jmp 0x100ad81f
mov eax, dword [ebp - 0x20]
add eax, 0x24
mov dword [ebp - 0x50], eax
mov eax, 0x660
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x50]
add edx, dword [edx + esi]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
xor esi, esi
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + eax*4]
add edx, 0x24f8
mov dword [0x1016f5e4], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x40], esi
jmp 0x100ad7f1
mov eax, dword [ebp - 0x48]
add eax, 1
mov cl, byte [ebp - 0x49]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x40], eax
jne 0x100ad7f1
jmp 0x100ad82a
Function at 0x100ad8de
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1016f5ec], 0
mov dword [0x1016f5f0], 0
mov dword [0x1016f5fc], 0
mov dword [0x1016f5e8], 0x14e0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x100ada26
jmp 0x100ad95a
mov eax, dword [0x1016f5f0]
mov ecx, dword [0x1016f5ec]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x1016f5e4], 0xb69
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1016f5ec], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1016f5f0], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1016f5f4], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x1016f5e4], 0x226c
mov cl, byte [0x1016f5f4]
mov edx, dword [0x1016f5f0]
mov byte [edi + edx], cl
mov edx, dword [0x1016f5ec]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1016f5f0]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1016f5fc], ebx
mov dword [0x1016f5e4], 0x11c5
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x2c], edx
jne 0x100ad943
mov dword [0x1016f5e8], 0xe7d
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6faca19d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6faca1fd
jmp 0x6faca24c
jmp 0x6faca29b
jmp 0x6faca2ea
jmp 0x6faca339
jmp 0x6faca388
jmp 0x6faca3d7
jmp 0x6faca426
jmp 0x6faca475
jmp 0x6faca4c4
jmp 0x6faca513
jmp 0x6faca562
jmp 0x6faca5b1
jmp 0x6faca600
jmp 0x6faca64f
jmp 0x6faca69e
jmp 0x6faca6ed
jmp 0x6faca73c
jmp 0x6faca78b
jmp 0x6faca7da
jmp 0x6faca829
jmp 0x6faca878
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6faca8cd
jmp 0x6faca91c
jmp 0x6faca96b
jmp 0x6faca9ba
jmp 0x6facaa09
jmp 0x6facaa58
jmp 0x6facaaa7
jmp 0x6facaaf6
jmp 0x6facab45
jmp 0x6facab94
jmp 0x6facabe3
jmp 0x6facac32
jmp 0x6facac81
jmp 0x6facacd0
jmp 0x6facad1f
jmp 0x6facad6e
jmp 0x6facadbd
jmp 0x6facae0c
jmp 0x6facae5b
jmp 0x6facaeaa
jmp 0x6facaef9
jmp 0x6facaf48
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6facafb1
jmp 0x6facb000
jmp 0x6facb04f
jmp 0x6facb09e
jmp 0x6facb0ed
jmp 0x6facb13c
jmp 0x6facb18b
jmp 0x6facb1da
jmp 0x6facb229
jmp 0x6facb278
jmp 0x6facb2c7
jmp 0x6facb316
jmp 0x6facb365
jmp 0x6facb3b4
jmp 0x6facb403
jmp 0x6facb452
jmp 0x6facb4a1
jmp 0x6facb4f0
jmp 0x6facb53f
jmp 0x6facb58e
jmp 0x6facb5dd
jmp 0x6facb62c
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6facb684
jmp 0x6facb6d3
jmp 0x6facb722
jmp 0x6facb771
jmp 0x6facb7c0
jmp 0x6facb80f
jmp 0x6facb85e
jmp 0x6facb8ad
jmp 0x6facb8fc
jmp 0x6facb94b
jmp 0x6facb99a
jmp 0x6facb9e9
jmp 0x6facba38
jmp 0x6facba87
jmp 0x6facbad6
jmp 0x6facbb25
jmp 0x6facbb74
jmp 0x6facbbc3
jmp 0x6facbc12
jmp 0x6facbc61
jmp 0x6facbcb0
jmp 0x6facbcff
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6facbd67
jmp 0x6facbdb6
jmp 0x6facbe05
jmp 0x6facbe54
jmp 0x6facbea3
jmp 0x6facbef2
jmp 0x6facbf41
jmp 0x6facbf90
jmp 0x6facbfdf
jmp 0x6facc02e
jmp 0x6facc07d
jmp 0x6facc0cc
jmp 0x6facc11b
jmp 0x6facc16a
jmp 0x6facc1b9
jmp 0x6facc208
jmp 0x6facc257
jmp 0x6facc2a6
jmp 0x6facc2f5
jmp 0x6facc344
jmp 0x6facc393
jmp 0x6facc3e2
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1c]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x2c], eax
jmp 0x6facc44b
jmp 0x6facc49a
jmp 0x6facc4e9
jmp 0x6facc538
jmp 0x6facc587
jmp 0x6facc5d6
jmp 0x6facc625
jmp 0x6facc674
jmp 0x6facc6c3
jmp 0x6facc712
jmp 0x6facc761
jmp 0x6facc7b0
jmp 0x6facc7ff
jmp 0x6facc84e
jmp 0x6facc89d
jmp 0x6facc8ec
jmp 0x6facc93b
jmp 0x6facc98a
jmp 0x6facc9d9
Function at 0x6faddf1c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x70375018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x70375018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6faddf8b
jmp 0x6faddfda
jmp 0x6fade029
jmp 0x6fade078
jmp 0x6fade0c7
jmp 0x6fade116
jmp 0x6fade165
jmp 0x6fade1b4
jmp 0x6fade203
jmp 0x6fade252
jmp 0x6fade2a1
jmp 0x6fade2f0
jmp 0x6fade33f
jmp 0x6fade38e
jmp 0x6fade3dd
jmp 0x6fade42c
jmp 0x6fade47b
jmp 0x6fade4ca
jmp 0x6fade519
jmp 0x6fade568
jmp 0x6fade5b7
jmp 0x6fade606
mov dword [ebp - 0x14], 0
jmp 0x6fade65c
jmp 0x6fade6ab
jmp 0x6fade6fa
jmp 0x6fade749
jmp 0x6fade798
jmp 0x6fade7e7
jmp 0x6fade836
jmp 0x6fade885
jmp 0x6fade8d4
jmp 0x6fade923
jmp 0x6fade972
jmp 0x6fade9c1
jmp 0x6fadea10
jmp 0x6fadea5f
jmp 0x6fadeaae
jmp 0x6fadeafd
jmp 0x6fadeb4c
jmp 0x6fadeb9b
jmp 0x6fadebea
jmp 0x6fadec39
jmp 0x6fadec88
jmp 0x6fadecd7
mov dword [ebp - 0x18], 0
jmp 0x6faded2d
jmp 0x6faded7c
jmp 0x6fadedcb
jmp 0x6fadee1a
jmp 0x6fadee69
jmp 0x6fadeeb8
jmp 0x6fadef07
jmp 0x6fadef56
jmp 0x6fadefa5
jmp 0x6fadeff4
jmp 0x6fadf043
jmp 0x6fadf092
jmp 0x6fadf0e1
jmp 0x6fadf130
jmp 0x6fadf17f
jmp 0x6fadf1ce
jmp 0x6fadf21d
jmp 0x6fadf26c
jmp 0x6fadf2bb
jmp 0x6fadf30a
jmp 0x6fadf359
jmp 0x6fadf3a8
mov dword [ebp - 0x10], 0
jmp 0x6fadf3fe
jmp 0x6fadf44d
jmp 0x6fadf49c
jmp 0x6fadf4eb
jmp 0x6fadf53a
jmp 0x6fadf589
jmp 0x6fadf5d8
jmp 0x6fadf627
jmp 0x6fadf676
jmp 0x6fadf6c5
jmp 0x6fadf714
jmp 0x6fadf763
jmp 0x6fadf7b2
jmp 0x6fadf801
jmp 0x6fadf850
jmp 0x6fadf89f
jmp 0x6fadf8ee
jmp 0x6fadf93d
jmp 0x6fadf98c
jmp 0x6fadf9db
jmp 0x6fadfa2a
jmp 0x6fadfa79
mov dword [ebp - 0x10], 0
jmp 0x6fae1cbf
jmp 0x6fadfad4
jmp 0x6fadfb23
jmp 0x6fadfb72
jmp 0x6fadfbc1
jmp 0x6fadfc10
jmp 0x6fadfc5f
jmp 0x6fadfcae
jmp 0x6fadfcfd
jmp 0x6fadfd4c
jmp 0x6fadfd9b
jmp 0x6fadfdea
jmp 0x6fadfe39
jmp 0x6fadfe88
jmp 0x6fadfed7
jmp 0x6fadff26
jmp 0x6fadff75
jmp 0x6fadffc4
jmp 0x6fae0013
jmp 0x6fae0062
jmp 0x6fae00b1
jmp 0x6fae0100
jmp 0x6fae014f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x70375014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6fae01af
jmp 0x6fae01fe
jmp 0x6fae024d
jmp 0x6fae029c
jmp 0x6fae02eb
jmp 0x6fae033a
jmp 0x6fae0389
jmp 0x6fae03d8
jmp 0x6fae0427
jmp 0x6fae0476
jmp 0x6fae04c5
jmp 0x6fae0514
jmp 0x6fae0563
jmp 0x6fae05b2
jmp 0x6fae0601
jmp 0x6fae0650
jmp fcn.6fae069f
mov eax, dword [0x70375018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6fadfa85
nop
leave
ret
Function at 0x10013171
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x10023230]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x24]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.10012137
push 0x1000ad88
lea ecx, [esp + 0x1c]
call fcn.1001209e
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x100131f5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x1001322b
mov ecx, dword [ebp + 4]
mov edx, 0xc8
push 0x1000ad40
call fcn.10012f00
mov edi, eax
jmp 0x1001322b
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.10013056
mov ebx, eax
test ebx, ebx
jns 0x1001321d
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xce
call fcn.10012ee1
mov edi, ebx
jmp 0x1001322b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x10013235
push esi
call fcn.10012f5c
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001fd10
mov esp, ebp
pop ebp
ret 8
Function at 0x10013d6a
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10023230]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0x210], edi
cmp dword [0x10023688], edi
jne 0x10013d9a
mov eax, 0x80004005
jmp 0x10013ec7
push esi
lea eax, [ebp - 0x20c]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
test eax, eax
je 0x10013db6
cmp eax, esi
jbe 0x10013dd3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10013dcd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10013ebd
push ebx
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x20c]
call fcn.10016268
mov esi, eax
test esi, esi
js 0x10013eb6
mov edi, dword [ebp - 0x210]
push 0
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
mov ebx, 0xb7
test eax, eax
jne 0x10013e2a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, ebx
je 0x10013e2a
test eax, eax
jg 0x10013e19
mov esi, eax
jmp 0x10013e22
movzx esi, ax
or esi, 0x80070000
test esi, esi
js 0x10013ebc
push dword [0x10023680]
call sub.msvcrt.dll_free
pop ecx
mov dword [0x10023680], edi
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
mov dword [ebp - 0x210], edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x10013e86
push 0x1000add4
lea ecx, [ebp - 0x20c]
call fcn.1001209e
test eax, eax
js 0x10013e86
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x20c]
call fcn.10016268
mov esi, eax
test esi, esi
js 0x10013eb6
mov edi, dword [ebp - 0x210]
push 0
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x10013ea0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, ebx
je 0x10013ea0
xor esi, esi
inc esi
push dword [0x10023680]
call sub.msvcrt.dll_free
mov dword [0x10023680], edi
xor edi, edi
pop ecx
jmp 0x10013ebc
mov edi, dword [ebp - 0x210]
pop ebx
push edi
call sub.msvcrt.dll_free
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1001fd10
mov esp, ebp
pop ebp
ret
Function at 0x10019180
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10023230]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
lea esi, [ebx - 4]
neg esi
lea eax, [ebx + 4]
sbb esi, esi
and esi, eax
je 0x100191ac
lea eax, [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
cmp dword [ebx + 0x94], 0
je 0x1001926f
and dword [ebx + 0x94], 0
cmp dword [ebx + 0x9c], 0
je 0x100191d3
push 0
lea ecx, [ebx - 4]
call fcn.10019ccf
mov ecx, dword [ebx + 0x8c]
push edi
test ecx, ecx
je 0x100191f5
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100241f0]
call edi
and dword [ebx + 0x8c], 0
cmp dword [ebx + 0x98], 0
je 0x1001920a
push dword [ebx + 0x90]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
push dword [ebx + 0x90]
call sub.msvcrt.dll_free
push dword [ebx + 0x6c]
call sub.msvcrt.dll_free
push dword [ebx + 0x74]
call sub.msvcrt.dll_free
mov ecx, dword [ebx + 0x84]
add esp, 0xc
test ecx, ecx
je 0x10019249
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100241f0]
call edi
and dword [ebx + 0x84], 0
mov ecx, dword [ebx + 0x88]
test ecx, ecx
je 0x1001926a
mov eax, dword [ecx]
push ecx
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100241f0]
call edi
and dword [ebx + 0x88], 0
and dword [ebx + 0x20], 0
pop edi
test esi, esi
je 0x1001927d
add esi, 4
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1001fd10
mov esp, ebp
pop ebp
ret
Function at 0x1001a92a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1001a9eb
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1000ae98]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1000ae98]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1000ae98]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1000ae98]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1000ae98]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1000ae98]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1000ae98]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1000ae98]
sub edi, 1
jne 0x1001a944
pop edi
test esi, esi
je 0x1001aa07
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1000ae98]
inc edx
sub esi, 1
jne 0x1001a9ef
not ecx
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x1001b694
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
mov ebx, dword [edi + 0x24]
mov ecx, dword [edi + 0x6c]
mov esi, dword [edi + 0x34]
mov edx, dword [edi + 0x64]
sub esi, edx
sub esi, ecx
jne 0x1001b6c5
test edx, edx
jne 0x1001b6cf
test ecx, ecx
jne 0x1001b6cf
mov esi, ebx
jmp 0x1001b74b
cmp esi, 0xffffffff
jne 0x1001b6cf
push 0xfffffffffffffffe
pop esi
jmp 0x1001b74b
mov eax, dword [edi + 0x24]
add eax, 0xfffffefa
add eax, ebx
cmp edx, eax
jb 0x1001b74b
mov ecx, dword [edi + 0x30]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
sub dword [edi + 0x54], ebx
mov edi, ecx
mov dword [ebp - 4], ecx
lea edx, [eax + ecx*2]
lea edx, [edx - 2]
movzx eax, word [edx]
mov ecx, eax
sub ecx, ebx
cmp eax, ebx
sbb eax, eax
not eax
and eax, ecx
mov word [edx], ax
sub edi, 1
jne 0x1001b705
mov edi, dword [ebp - 8]
mov ecx, ebx
mov eax, dword [edi + 0x38]
mov edi, ecx
lea edx, [eax + ecx*2]
lea edx, [edx - 2]
movzx eax, word [edx]
mov ecx, eax
sub ecx, ebx
cmp eax, ebx
sbb eax, eax
not eax
and eax, ecx
mov word [edx], ax
sub edi, 1
jne 0x1001b72c
mov edi, dword [ebp - 8]
add esi, ebx
mov ecx, dword [edi]
mov dword [ebp - 4], ecx
mov edx, dword [ecx + 4]
test edx, edx
je 0x1001b805
mov ecx, dword [edi + 0x64]
add ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x6c]
add ecx, eax
mov dword [ebp - 0x10], eax
mov eax, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
cmp eax, esi
ja 0x1001b77a
mov esi, edx
test esi, esi
jne 0x1001b783
mov eax, dword [ebp - 0x10]
jmp 0x1001b7c1
mov eax, dword [ecx + 0x1c]
sub edx, esi
mov dword [ecx + 4], edx
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
cmp dword [eax + 0x18], 0
jne 0x1001b7a9
push esi
push edx
push dword [ecx + 0x30]
call fcn.1001cb40
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x30], eax
push esi
push edx
push dword [ebp - 0x14]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [eax], esi
add dword [eax + 8], esi
mov eax, dword [edi + 0x6c]
lea ecx, [eax + esi]
mov dword [ebp - 0x14], ecx
mov dword [edi + 0x6c], ecx
cmp ecx, 3
jb 0x1001b7f1
mov edx, dword [edi + 0x64]
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x50]
movzx esi, byte [edx + eax]
mov dword [edi + 0x40], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
mov ecx, dword [ebp - 0x14]
xor esi, eax
and esi, dword [edi + 0x4c]
mov dword [edi + 0x40], esi
cmp ecx, 0x106
jae 0x1001b805
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x1001b6aa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x100201be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x100201b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x100201c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x100201a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10020290
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x100202a6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x100202c1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x50c620
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
jmp 0x50c63a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50c641
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50c630
mov eax, 1
add ebx, ebx
jne 0x50c653
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50c648
jne 0x50c664
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50c648
xor ecx, ecx
sub eax, 3
jb 0x50c678
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50c6ea
mov ebp, eax
add ebx, ebx
jne 0x50c683
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50c690
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50c6b4
inc ecx
add ebx, ebx
jne 0x50c6a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50c695
jne 0x50c6b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50c695
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50c6d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50c6c5
jmp 0x50c636
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50c6d4
add edi, ecx
jmp 0x50c636
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50c733
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50c6f1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50c72d
mov dword [ebx], eax
add ebx, 4
jmp 0x50c70e
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50c767
sub esp, 0xffffff80
jmp section.UPX0