joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5936e8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x593785
push ebx
push esi
call fcn.005936b1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00593645
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x593732
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x593784
push edi
push eax
call fcn.00594305
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x593752
call fcn.00592228
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x593783
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00593645
add esp, 0x20
test eax, eax
jne 0x593771
push edi
call fcn.00592228
jmp 0x593779
push ebx
call fcn.00592228
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x594a82
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x657280
push 0x657278
push str.FlsAlloc
push 0x1f
call fcn.00594941
mov esi, eax
add esp, 0x10
test esi, esi
je 0x594ab6
push dword [ebp + 8]
mov ecx, esi
call dword [0x5a2490]
call esi
jmp 0x594abc
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x594b00
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x657290
push 0x657288
push str.FlsGetValue
push 0x21
call fcn.00594941
mov esi, eax
add esp, 0x10
test esi, esi
je 0x594b37
push dword [ebp + 8]
mov ecx, esi
call dword [0x5a2490]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x594b3f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x657298
push 0x657290
push str.FlsSetValue
push 0x22
call fcn.00594941
mov esi, eax
add esp, 0x10
test esi, esi
je 0x594b79
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x5a2490]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x599b00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x599b2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x599b2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x59d5e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x59d661
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x59d69c
cmp dword [esp + 4], 0
je 0x59d683
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x59d6ba
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x673b34]
nop word cs:[eax + eax]
nop
mov dword [esi + 8], eax
lock cmpxchg dword [0x673b34], esi
jne 0x59d640
mov byte [0x673b30], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x59d693
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x59d6fb
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x59d687
mov edi, dword [esp]
jmp 0x59d693
mov edi, dword [esi]
jmp 0x59d692
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x6215a4
push 0x621604
push eax
call fcn.0059d730
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x6215f4
mov dword [esp + 8], 0x6215bc
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_std_srcioimpls.rs
mov dword [esp + 0x14], 0
call fcn.0059a150
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x6215bc
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_std_srcioimpls.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0059d760
int3

Function at 0x59dbe0
Capabilities:
Resolve dns

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea ecx, [esp + 4]
push dword [esp + 0x44]
call fcn.00414df0
add esp, 4
mov eax, dword [esp + 4]
cmp eax, 0x80000000
jne 0x59dc53
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
lea ecx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push eax
push ecx
push 0
push edi
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x59dc75
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x59dc89
mov ecx, dword [0x620478]
mov edx, dword [0x62047c]
test eax, eax
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
mov dword [esi], 1
je 0x59dc9e
mov ecx, dword [esp + 8]
jmp 0x59dc94
mov ecx, dword [esp]
movzx eax, word [esp + 0x48]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x59dc9e
mov ecx, edi
mov edx, 1
call fcn.00405250
add esp, 0x34
pop esi
pop edi
pop ebx
ret
Function at 0x401340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4053c8]
push edi
xor edi, edi
test eax, eax
jne 0x4014ef
push esi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], edi
push eax
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x401479
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x401479
lea esi, [ebp - 0x210]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4013a6
sub esi, ecx
sar esi, 1
mov dword [ebp - 0x224], esi
test esi, esi
jle 0x40146b
lea eax, [esi + 1]
lea eax, [eax + eax*2]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x218], 0x800
xor edx, edx
mov dword [ebp - 0x21c], 0x80
mov edi, eax
xor ebx, ebx
nop
movzx ecx, word [ebp + ebx*2 - 0x210]
lea esi, [edx + edi]
inc ebx
mov dword [ebp - 0x220], esi
inc edx
mov eax, ecx
cmp cx, word [ebp - 0x218]
jb 0x401434
mov ax, cx
shr ax, 0xc
sub al, 0x20
mov byte [esi], al
mov eax, ecx
shr eax, 6
and cl, 0x3f
and al, 0x3f
add cl, 0x80
add al, 0x80
mov byte [edx + edi], al
mov byte [edx + edi + 1], cl
add edx, 2
jmp 0x40145c
cmp cx, word [ebp - 0x21c]
jb 0x401452
shr ecx, 6
and al, 0x3f
and cl, 0x1f
add al, 0x80
sub cl, 0x40
mov byte [esi], cl
mov byte [edx + edi], al
inc edx
jmp 0x40145c
mov ecx, dword [ebp - 0x220]
and al, 0x7f
mov byte [ecx], al
cmp ebx, dword [ebp - 0x224]
jl 0x4013f0
mov byte [edx + edi], 0
pop ebx
jmp 0x40146d
xor edi, edi
push dword [ebp - 0x214]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0
push str.AppleLockdown
push 0x4031b8
push edi
call fcn.00401040
mov edx, eax
add esp, 0x10
mov dword [0x4053c8], edx
test edx, edx
je 0x4014bf
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4014a0
sub ecx, esi
lea eax, [ecx - 1]
test eax, eax
jle 0x4014bf
cmp byte [edx + eax], 0x5c
jne 0x4014bf
mov byte [edx + eax], 0
dec eax
test eax, eax
jg 0x4014b0
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [0x4053c8]
push str.initialized_config_dir_to__s
push 0xb5
push str.D:_a1_slibimobiledevicecommonuserpref.c
push str.userpref_get_config_dir
call dword [sym.imp.imobiledevice.dll_debug_info_real]
mov eax, dword [0x4053c8]
add esp, 0x18
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004020c3
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430004]
jne 0x40100a
repz ret
jmp fcn.004013d6

Function at 0x4034ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x430004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402679
and dword [ebp - 0x14], 0
cmp dword [0x432ab0], 0
mov dword [ebp - 0x18], eax
jne 0x40355e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403606
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x403606
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x432ab0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x432ab4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x432ab8], eax
call edi
push eax
call esi
mov dword [0x432ac0], eax
test eax, eax
je 0x40355e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x432abc], eax
mov eax, dword [0x432abc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4035b7
cmp dword [0x432ac0], ecx
je 0x4035b7
push eax
call esi
push dword [0x432ac0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4035b7
test ebx, ebx
je 0x4035b7
call edi
test eax, eax
je 0x4035ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4035ae
test byte [ebp - 8], 1
jne 0x4035b7
or dword [ebp + 0x10], 0x200000
jmp 0x4035ea
mov eax, dword [0x432ab4]
cmp eax, dword [ebp - 0x18]
je 0x4035ea
push eax
call esi
test eax, eax
je 0x4035ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4035ea
mov eax, dword [0x432ab8]
cmp eax, dword [ebp - 0x18]
je 0x4035ea
push eax
call esi
test eax, eax
je 0x4035ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x432ab0]
call esi
test eax, eax
je 0x403606
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403608
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x4057b0
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x43a8ec]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
nop
cmp eax, 0x8cf
jne 0x4057d2
push 0
push 0
call edi
mov eax, dword [0x43a8ec]
cmp esi, 0x845013
jne 0x4057e9
mov eax, dword [0x431930]
add eax, 0xa231
mov dword [0x43a8ec], eax
cmp eax, 0x141
jne 0x405804
mov dword [0x432fe8], 0xec58acac
mov dword [0x432fec], 0xffffffff
inc esi
cmp esi, 0xbbe2a98
jl 0x4057c0
call fcn.00405530
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x1001408
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x100144b
push esi
lea ecx, [eax + 8]
call dword [sym.imp.ulib.dll_public:_class_WSTRING____thiscall_PATH::QueryFullPathString_void_const]
mov esi, eax
cmp esi, ebx
je 0x100144a
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x1001442
cmp word [eax], bx
je 0x1001442
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001442
test ah, 0x10
je 0x1001442
mov bl, 1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop esi
mov al, bl
pop ebx
ret 4

Function at 0x40893e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
dec eax
add esi, 0xb0f858c5
call fcn.00408966
xor dword [edi], edx
sub eax, 0xcfcd778e
and eax, eax
add edi, 1
cmp edi, ebx
jne fcn.0040893e
ret
Function at 0x6102199c
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push 0x28
mov eax, 0x6104097a
call fcn.6102b2d6
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0x10]
push 0xe0000000
push edi
push edi
mov dword [ebp - 0x10], 1
mov dword [eax], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x61021b3b
push 0x80010020
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
mov dword [ebp - 0x14], ebx
cmp ebx, edi
je 0x61021b18
mov eax, dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x61021a10
cmp eax, 3
je 0x61021a10
cmp eax, 4
je 0x61021a10
cmp eax, 1
jne 0x61021a5e
lea eax, [ebp - 0x34]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x61021a36
call edi
push eax
push dword [ebp + 8]
push 0x61005e78
push 3
call fcn.6101b566
add esp, 0x10
push ebx
lea ebx, [ebp - 0x34]
call 0x61025717
test eax, eax
jne 0x61021a5e
push dword [ebp + 8]
push 0x61005e40
push 2
call fcn.6101b566
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [eax], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x61021af8
push dword [ebp + 8]
push 0x61005e08
push 1
call fcn.6101b566
add esp, 0xc
push dword [ebp - 0x14]
call esi
xor edi, edi
cmp dword [ebp + 0xc], 2
je 0x61021a9b
cmp dword [ebp + 0xc], 3
mov dword [ebp + 0xc], 6
jne 0x61021aa2
mov dword [ebp + 0xc], 3
push 0x80000000
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
inc edi
test ebx, ebx
je 0x61021b34
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push ebx
call esi
cmp edi, dword [ebp + 0xc]
jne 0x61021ae6
push 0x61005d30
push 2
call fcn.6101b566
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
mov dword [eax], 1
jmp 0x61021af1
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, dword [ebp + 0xc]
jb 0x61021aa2
jmp 0x61021b34
and dword [ebp - 0x10], 0
call edi
push eax
push dword [ebp + 8]
push 0x61005cb8
push 3
call fcn.6101b566
add esp, 0x10
push dword [ebp - 0x14]
call esi
jmp 0x61021b34
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x61005c28
push 3
call fcn.6101b566
add esp, 0x10
push dword [ebp - 0x18]
call esi
jmp 0x61021b54
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x61005b88
push 3
call fcn.6101b566
add esp, 0xc
mov dword [ebp - 0x10], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
mov eax, dword [ebp - 0x10]
call fcn.6102b3c2
ret 0xc
Function at 0x61026fdd
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0x2c
mov eax, 0x61040cea
call fcn.6102b2d6
mov eax, dword [ebp + 0x18]
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [eax], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
call fcn.6100d83e
mov dword [ebp - 4], ebx
push dword [0x610480f8]
lea ecx, [ebp - 0x1c]
call fcn.6100dfda
mov byte [ebp - 4], 1
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
call fcn.6101836c
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.6100d793
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push ebx
push dword [ebp - 0x18]
mov edi, 0x80000002
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x61027080
push dword [esi]
cmp eax, 2
je 0x6102706f
push eax
push 0x61006138
push 3
call fcn.6101b566
add esp, 0x10
mov dword [ebp - 0x14], ebx
jmp 0x610270bb
push 0x61008130
push 1
call fcn.6101b566
add esp, 0xc
jmp 0x610270bb
cmp dword [ebp + 0x10], ebx
jne 0x6102708e
mov dword [ebp - 0x20], 1
jmp 0x610270bb
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 7
push ebx
push dword [0x610480fc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x610270b4
push dword [esi]
push eax
push 0x61007ba0
jmp 0x61027060
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x10], ebx
je 0x610270c9
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20], ebx
je 0x610270d8
push dword [ebp - 0x18]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x38]
call fcn.6100d565
mov byte [ebp - 4], 2
cmp dword [ebp + 0x10], ebx
je 0x610270f4
push dword [ebp + 0x10]
lea ecx, [ebp - 0x38]
call fcn.61019ecc
push dword [ebp + 0x18]
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp + 0x10], esp
push esi
call fcn.6100d869
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
call fcn.61026a0b
cmp eax, ebx
jne 0x6102712d
push 0x610080c8
push 3
call fcn.6101b566
pop ecx
pop ecx
xor eax, eax
jmp 0x61027130
xor eax, eax
inc eax
cmp dword [ebp - 0x14], ebx
je 0x6102713d
cmp eax, ebx
je 0x6102713d
xor esi, esi
jmp 0x61027142
mov esi, 0x643
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x38]
call fcn.6100d5a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.6100d793
mov eax, esi
call fcn.6102b3c2
ret 0x14
Function at 0x6103bdbc
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x61048110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
jae 0x6103bf9c
test eax, eax
jne 0x6103be09
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x6103bf9f
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x6103bf9c
lea ecx, [ebp - 0x210]
cmp eax, ecx
je 0x6103bf9c
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x210]
cmp ax, 0x41
jb 0x6103be3c
cmp ax, 0x5a
jbe 0x6103be45
lea ecx, [eax - 0x61]
cmp cx, 0x19
ja 0x6103be69
cmp word [ebp - 0x20e], 0x3a
jne 0x6103be69
cmp word [ebp - 0x20c], 0x5c
jne 0x6103bf9c
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], ecx
push 0x5c
pop edi
cmp ax, di
jne 0x6103beab
cmp word [ebp - 0x20e], di
jne 0x6103beab
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.6102c413
pop ecx
pop ecx
test eax, eax
je 0x6103bf9c
add eax, 2
push edi
push eax
call fcn.6102c413
pop ecx
pop ecx
mov dword [ebp - 0x214], eax
test eax, eax
je 0x6103bf9c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x6103bed5
and al, 0x10
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xfffffef5
add eax, 0x10b
jmp 0x6103bf9f
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x210]
cmp esi, eax
jne 0x6103bee9
mov esi, eax
jmp 0x6103beec
add esi, 0xfffffffe
cmp esi, dword [ebp - 0x214]
je 0x6103bf9c
cmp word [esi], di
jne 0x6103bf9c
cmp esi, dword [ebp - 0x214]
jbe 0x6103bf9c
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x210]
push 0x5c
push eax
call fcn.6102c80f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x6103bf9c
movzx ebx, word [edi + 2]
xor eax, eax
mov word [edi + 2], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [edi + 2], bx
cmp eax, 0xffffffff
jne 0x6103bf64
mov esi, edi
cmp edi, dword [ebp - 0x214]
ja 0x6103bf0d
cmp esi, dword [ebp - 0x214]
jbe 0x6103bf9c
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
jmp 0x6103bf85
test al, 0x10
jne 0x6103bf52
mov eax, 0x10b
jmp 0x6103bf9f
cmp word [esi + 2], bx
je 0x6103bf98
push 0x5c
pop eax
push esi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
push ebx
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
jne 0x6103bf6f
jmp 0x6103bdfe
xor eax, eax
jmp 0x6103bf9f
push 0x7b
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6102b2c1
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4012b5
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov dword [esp + 0x10], ecx
xor eax, eax
mov byte [eax + 0xe12ee8], al
inc eax
cmp eax, 0x100
jne 0x4012c2
xor edi, edi
xor esi, esi
mov dword [0xe12fe8], edi
mov dword [0xe12ee4], esi
xor edx, edx
mov bl, byte [esi + 0xe12ee8]
mov eax, esi
div ebp
movsx eax, byte [edx + ecx]
add eax, edi
movzx ecx, bl
add ecx, eax
movzx edi, cl
mov ecx, dword [esp + 0x10]
mov dword [0xe12fe8], edi
mov al, byte [edi + 0xe12ee8]
mov byte [esi + 0xe12ee8], al
inc esi
mov byte [edi + 0xe12ee8], bl
mov dword [0xe12ee4], esi
cmp esi, 0x100
jne 0x4012e0
and dword [0xe12fe8], 0
and dword [0xe12ee4], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x687ec0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x176000]
push edi
or ebp, 0xffffffff
jmp 0x687ee2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x687ee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x687ed8
mov eax, 1
add ebx, ebx
jne 0x687efb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x687f0c
jne 0x687f1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x687f1c
dec eax
add ebx, ebx
jne 0x687f18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x687ef0
xor ecx, ecx
sub eax, 3
jb 0x687f34
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x687fa6
sar eax, 1
mov ebp, eax
jmp 0x687f3f
add ebx, ebx
jne 0x687f3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x687f4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x687f70
inc ecx
add ebx, ebx
jne 0x687f5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x687f51
jne 0x687f6d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x687f51
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x687f90
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x687f81
jmp 0x687ede
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x687f90
add edi, ecx
jmp 0x687ede
pop esi
mov edi, esi
mov ecx, 0xc84
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x687fae
cmp byte [edi], 9
jne 0x687fae
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x687fb3
lea edi, [esi + 0x285000]
mov eax, dword [edi]
or eax, eax
je 0x68802b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x29a3cc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x29a444]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x687fe0
mov ecx, edi
jns 0x68800f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x29a448]
or eax, eax
je 0x688025
mov dword [ebx], eax
add ebx, 4
jmp 0x687ffd
call dword [esi + 0x29a44c]
popal
jmp 0x416aec
Function at 0x402f90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x40b5f0]
mov dword [0x40b7d4], eax
mov ecx, dword [0x40b7d4]
mov dword [0x40b7d0], ecx
mov dword [0x40b7c4], 0
mov esi, esp
push str.POSIXLY_CORRECT
call dword [sym.imp.ucrtbased.dll_getenv]
add esp, 4
cmp esi, esp
call fcn.004010af
mov dword [0x40b7cc], eax
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 0x10]
movsx edx, byte [ecx + eax]
cmp edx, 0x2d
jne 0x402ff9
mov dword [0x40b7c8], 2
mov eax, dword [ebp + 0x10]
add eax, 1
mov dword [ebp + 0x10], eax
jmp 0x403041
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 0x10]
movsx ecx, byte [eax + edx]
cmp ecx, 0x2b
jne 0x403022
mov dword [0x40b7c8], 0
mov edx, dword [ebp + 0x10]
add edx, 1
mov dword [ebp + 0x10], edx
jmp 0x403041
cmp dword [0x40b7cc], 0
je 0x403037
mov dword [0x40b7c8], 0
jmp 0x403041
mov dword [0x40b7c8], 1
mov eax, dword [ebp + 0x10]
pop esi
cmp ebp, esp
call fcn.004010af
pop ebp
ret