joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401bd7
pop dword [ebp - 0x2c]
mov eax, 0xca9425bb
add eax, 0x35abf61c
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x9ceef3a7
add dword [ebp - 0x3c], 0xb16351a4
mov dword [ebp - 0x38], 0x37e06345
sub dword [ebp - 0x38], 0x5ad1700
mov dword [ebp - 0x34], 0x2d66bdc6
add dword [ebp - 0x34], 0x1ee58668
mov dword [ebp - 0x30], 0x56af23d3
add dword [ebp - 0x30], 0xa950dc2d
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x62781d18
sub eax, 0x6237acb8
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x24e01b34
add dword [ebp - 0x3c], 0x4f924e22
mov dword [ebp - 0x38], 0x2963c9e4
add dword [ebp - 0x38], 0x18089791
mov dword [ebp - 0x34], 0xa2a1be6c
sub dword [ebp - 0x34], 0x3f325200
mov dword [ebp - 0x30], 0x6b10aef5
sub dword [ebp - 0x30], 0x6b10aef5
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c033
push 0
call eax
mov ecx, 0x5dc0
xor ebx, ebx
add ebx, eax
mov esi, 0xf491a8b2
sub esi, 0xf450a8b2
add esi, dword [ebp - 0x2c]
mov edx, 0xd7b857bd
xor dword [ebp - 4], eax
mov edi, dword [esi]
add dword [ebp - 0x24], ecx
xor edi, edx
sub dword [ebp - 0x18], 0xa4a329d2
mov dword [ebx], edi
xor dword [ebp - 0x10], 0x4df2f9e1
add ebx, 0xbafb10e3
add ebx, 0x4504ef21
add esi, 4
loop 0x401cea
add eax, 0x169d3
mov ebx, eax
add eax, 0xf49cad64
sub eax, 0xf49cad5f
mov ecx, 0xc13de60e
sub ecx, 0xc0fde60e
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.00401bc8
jmp 0x406676

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40301c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x403028
push 0x403024
push 0x403020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x403028]
push dword [0x403024]
push dword [0x403020]
mov dword [0x403014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x40cf9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40cfaa
pop dword [ebp - 0x38]
mov eax, 0x40cfaa
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x39f12
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x9427489
add ecx, 0xf6bdc435
xor ebx, ebx
add ebx, eax
mov edi, 0x435400
add edi, dword [ebp - 0x38]
mov edx, 0xf67c7576
add edx, 0x457c4a87
sub dword [ebp - 8], 0x1989196b
mov esi, dword [edi]
sub dword [ebp - 0x30], 0x4c50cdf3
xor esi, edx
mov dword [ebx], esi
add dword [ebp - 8], esi
add ebx, 0xa55a7630
sub ebx, 0xa55a762c
add edi, 0xa5fb7f3
add edi, 0xf5a04811
loop 0x40cffb
add eax, 0x6d042e7
sub eax, 0x6cf6d1c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x40180f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40181e
pop dword [ebp - 8]
mov eax, 0xc6f61b96
sub eax, 0xc6b60378
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x18c5ad3c
add dword [ebp - 0x18], 0x358c980f
mov dword [ebp - 0x14], 0x49ba15c6
sub dword [ebp - 0x14], 0x1786c981
mov dword [ebp - 0x10], 0x2a8b0108
sub dword [ebp - 0x10], 0xde3ebcda
mov dword [ebp - 0xc], 0x43017fcb
sub dword [ebp - 0xc], 0x43017fcb
lea eax, [ebp - 0x18]
push eax
mov eax, 0xc6d8054f
add eax, 0x3968cafd
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xef84397
sub dword [ebp - 0x18], 0x9a85da41
mov dword [ebp - 0x14], 0x62b59544
sub dword [ebp - 0x14], 0x214933cf
mov dword [ebp - 0x10], 0x39faa6e1
sub dword [ebp - 0x10], 0xd68b3a75
mov dword [ebp - 0xc], 0xde7de10e
sub dword [ebp - 0xc], 0xde7de10e
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xe640bca
add eax, 0xf1dcc47e
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3bef1
push 0
call eax
mov ecx, 0x5b7df4ed
sub ecx, 0x5b7da3b9
mov ebx, eax
mov edi, 0xef3e7311
sub edi, 0xeefcc311
add edi, dword [ebp - 8]
mov edx, 0xc7bbf829
add edx, 0xcaa90e10
sub dword [ebp - 4], 0x2e93a31f
mov esi, dword [edi]
xor dword [ebp - 4], edi
sub esi, edx
add dword [ebp - 4], ecx
mov dword [ebx], esi
xor dword [ebp - 4], 0x985244b5
add ebx, 4
add edi, 4
loop 0x401940
add eax, 0xd2cf9340
add eax, 0x2d31a463
mov ebx, eax
add eax, 0x132ba734
add eax, 0xecd458d1
mov ecx, 0x4e49ecfb
sub ecx, 0x4e09ecfb
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x4056ca
Capabilities:
Encode data using xor

Disassembly:
call 0x4055d8
mov ecx, 0x1e8
call 0x4056ca
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x4056cd
mov eax, 0x50402d4
out dx, al
clc
div esi
cmc
retf 0x3d52

Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
dec esp
aaa
push ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0x2c]
test byte [edx + 0xf], bl
test byte [esi + 0x77000000], bh
dec esi
dec eax
xor eax, eax
push ebx
cmp ecx, 1
cwde
mov dword [ebp - 4], eax
test byte [ebp + 8], 0xf
test dword [eax + eax + 0x7e8b0000], ebx
cmp al, 0x3b
clc
je 0x40b395
mov ebx, dword [esi + 0x38]
cmp edi, 0xffffffff
jbe 0x40b311
or eax, 0xffffffa4
jmp 0x40b313
mov eax, edi
mov edx, dword [esi + 0x5d]
lea ecx, [ebp + 0x50]
push 0
push ecx
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b358
and dword [eax + 0x36568bfc], esi
mov ecx, dword [esi + 0x54]
add edx, eax
outsd dx, dword [esi]
rol dword [eax], 1
sub edi, eax
add ebp, dword [ebp - 0x77]
push esi
push eax
test edi, edi
mov dword [esi + 0x54], ecx
mov edi, 0xd7458bc2
pop edi
inc edi
inc esi
cmp al, 0
out 0, eax
rcr byte [ebx + 0x5e], 1
mov esp, ebp
pop ebp
ret 4
mov edi, dword [0x2e40c098]
call edi
test eax, eax
jne 0x40b369
mov dword [ebp + 8], eax
jmp 0x40b373
insb byte es:[edi], dx
xlatb
add eax, 0xacc80
mov esi, ecx
scasd eax, dword es:[edi]
mov eax, dword [ebp - 4]
mov edx, dword [esi + 0x50]
mov esi, dword [edx]
push esp
add edx, eax
mov eax, dword [ebp - 0xd]
mov dword [esi + 0x50], edx
adc ecx, 0
test dword [edi], edx
scasd eax, dword es:[edi]
dec esi
push esp
stc
pop es
invalid
mov eax, dword [ebp - 0x58]
Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.004014da

Function at 0x4014da
Capabilities:
Delete file
Encode data using base64 via winapi
Get common file path

Disassembly:
push ecx
push edx
enter 0x220, 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x8985058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.089851a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x898507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x898506a
add dl, dl
jne 0x8985089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x89850dc
xor eax, eax
add dl, dl
jne 0x8985096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x898517d
add dl, dl
jne 0x89850a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x89850b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x89850bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x89850c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x89850d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8985075
mov eax, 1
add dl, dl
jne 0x89850ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x89850f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x89850e1
sub eax, ebx
mov ebx, 1
jne 0x8985128
mov ecx, 1
add dl, dl
jne 0x898510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8985119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8985105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8985075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x898513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x898514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8985136
cmp eax, 0x7d00
jae 0x898516d
cmp eax, 0x500
jb 0x8985168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8985075
cmp eax, 0x7f
ja 0x8985170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8985075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x898519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8985075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x62c1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0062c140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0062c140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0062c140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0062c140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x62cbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x62cc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x63e87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x62cc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x62cc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40189d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edx, dword [0x403050]
mov ebx, eax
add edx, eax
mov eax, 0x403054
call fcn.004017e0
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x40277c
push edx
sub edi, fcn.00401f26
push edi
xor eax, eax
push fcn.00401f26
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401907
mov eax, fcn.00401f26
mov ebx, esi
mov edx, edi
call fcn.004017e0
mov edx, 0x1c000
mov eax, 0x403054
mov ebx, esi
call fcn.004010f2
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401dfd
Capabilities:
Check if file exists
Check mutex on windows
Get common file path

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x460, 0
lea ebx, [ebp - 0x258]
push ebx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHFOLDER.DLL_SHGetFolderPathW]
push 0x104
lea ebx, [ebp - 0x460]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push 0
push 0
push 0
lea ebx, [ebp - 0x460]
mov byte [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
push ebx
mov byte [ebp - 8], 0
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea ebx, [ebp - 0x258]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push 0
push 0
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
push ebx
lea ebx, [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
lea ebx, [ebp - 0x10]
push ebx
lea ebx, [ebp - 0x50]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push ebx
push ebx
push ebx
sub esi, 5
mov byte [ebp - 0x50], 0
call dword [sym.imp.SHLWAPI.DLL_PathCombineA]
mov eax, esi
jmp 0x401666
Function at 0x1000ffb0
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x74], 0x10
lea eax, [edi + 0x60]
jb 0x1000ffbe
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [edi + 0x78], eax
test eax, eax
jne 0x1000ffd0
xor al, al
pop edi
ret
push esi
push str.IMS_createRef
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.IMS_createRefEx
push dword [edi + 0x78]
mov dword [edi + 0x84], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.IMS_releaseRef
push dword [edi + 0x78]
mov dword [edi + 0x88], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.IMS_fetchDefaultUserInfoForClientId
push dword [edi + 0x78]
mov dword [edi + 0x8c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.IMS_fetchAccessToken
push dword [edi + 0x78]
mov dword [edi + 0x90], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.IMS_registerClientToGroup
push dword [edi + 0x78]
mov dword [edi + 0x94], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.IMS_getProxyCredentialsFromIMSLibSession
push dword [edi + 0x78]
mov dword [edi + 0x98], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.IMS_releaseData
push dword [edi + 0x78]
mov dword [edi + 0x9c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
cmp dword [edi + 0x98], 0
mov dword [edi + 0xa0], eax
je 0x1001010d
cmp dword [edi + 0x84], 0
je 0x1001010d
mov esi, dword [edi + 0x88]
test esi, esi
je 0x1001010d
cmp dword [edi + 0x8c], 0
je 0x1001010d
cmp dword [edi + 0x90], 0
je 0x1001010d
cmp dword [edi + 0x94], 0
je 0x1001010d
cmp dword [edi + 0x9c], 0
je 0x1001010d
test eax, eax
je 0x1001010d
cmp dword [edi + 0x5c], 0x10
lea eax, [edi + 0x48]
jb 0x100100c6
mov eax, dword [eax]
push eax
push edi
mov ecx, esi
call dword [0x100423e8]
call esi
add esp, 8
mov dword [edi + 0x7c], eax
test eax, eax
je 0x1001010d
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x100100e6
mov ecx, dword [edi]
mov esi, dword [edi + 0x98]
push 0
push ecx
push eax
mov ecx, esi
call dword [0x100423e8]
call esi
add esp, 0xc
test eax, eax
jne 0x1001010d
pop esi
mov byte [edi + 0x80], 1
mov al, 1
pop edi
ret
xor al, al
pop esi
mov byte [edi + 0x80], al
pop edi
ret
Function at 0x10030140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1003014f
pop dword [ebp - 4]
mov eax, 0x1003014f
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x4827bf39
sub dword [ebp - 0x14], 0xf9d579ee
mov dword [ebp - 0x10], 0x454a284b
add dword [ebp - 0x10], 0xece923fa
mov dword [ebp - 0xc], 0x6ab080f3
sub dword [ebp - 0xc], 0x1e643cc5
mov dword [ebp - 8], 0x6b4f86d3
sub dword [ebp - 8], 0x6b4f86d3
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xd6221b8b
sub dword [ebp - 0x14], 0x61afb235
mov dword [ebp - 0x10], 0x56c987c7
add dword [ebp - 0x10], 0xeaa2d9ae
mov dword [ebp - 0xc], 0x14356768
sub dword [ebp - 0xc], 0xb0c5fafc
mov dword [ebp - 8], 0xdf2b27f5
sub dword [ebp - 8], 0xdf2b27f5
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x938d1a52
sub eax, 0x8388fa06
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x458e9
push 0
call eax
mov ecx, 0x543875ee
sub ecx, 0x543834fa
xor edx, edx
add edx, eax
mov ebx, 0xd7c98093
sub ebx, 0xc7c40293
add ebx, dword [ebp - 4]
mov esi, 0xd2a26dc8
add esi, 0x72bc29a3
mov edi, dword [ebx]
xor edi, esi
mov dword [edx], edi
add edx, 0x4a875f4
sub edx, 0x4a875f0
add ebx, 4
loop 0x10030269
add eax, 0x749833d0
add eax, 0x8b68c2d3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xad506ac3
add ecx, 0x62af953d
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10030140
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4