joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009ab0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eade0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x1012931c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x40]
push eax
call fcn.10005780
mov ecx, eax
call fcn.1003eb66
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.10001d80
push 5
push str.scach
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.10006070
push 1
push 0x100f58d0
lea ecx, [ebp - 0x28]
call fcn.10006070
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10009b55
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.1004095b
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x100f5cc0
cmovae eax, dword [ebp - 0x28]
push edi
push esi
push eax
lea eax, [ebp - 0x58]
push str._s_d_d_s.db
push eax
call fcn.100350d8
mov esi, eax
add esp, 0x18
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x10009bad
mov ecx, eax
call fcn.10001ee0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x10009be7
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009bdd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009c9a
push edx
push ecx
call fcn.10081441
add esp, 8
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x5c]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.100492e2
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10009c31
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009c27
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009c9f
push edx
push ecx
call fcn.10081441
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x10009c7b
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009c71
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10009ca4
push edx
push ecx
call fcn.10081441
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10081454
mov esp, ebp
pop ebp
ret 0xc
call fcn.100ad050
call fcn.100ad050
call fcn.100ad050
int3
Function at 0x1000a800
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eaf98
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x1012931c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.10005780
mov ecx, eax
call fcn.1003eb3e
push 9
push str.ZNews.exe
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.10006070
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000a86d
xor bl, bl
jmp 0x1000a8ea
push 0
sub esp, 0x18
lea eax, [esi + 0x70]
mov ecx, esp
push eax
call fcn.10006c20
lea eax, [ebp - 0x58]
push eax
call fcn.100366d5
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x58]
push eax
push str._3e44bd52daa7
push str._e29692f02e21
lea eax, [ebp - 0x40]
push str._s__s_s
push eax
call fcn.100350d8
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x40]
push 0
push ecx
push eax
mov byte [ebp - 4], 2
call fcn.10047efc
add esp, 0x48
lea ecx, [ebp - 0x40]
mov bl, 1
call fcn.10001ee0
lea ecx, [ebp - 0x58]
call fcn.10001ee0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1000a920
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a916
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a93f
push edx
push ecx
call fcn.10081441
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10081454
mov esp, ebp
pop ebp
ret 4
call fcn.100ad050
int3
Function at 0x10015830
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ebe56
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x1012931c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, byte [ebp + 8]
test bl, bl
je 0x10015904
lea eax, [ebp - 0x28]
push eax
call fcn.10005780
mov ecx, eax
call fcn.1003eb3e
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.1003565b
add esp, 4
test eax, eax
jne 0x1001589f
push 1
push 0x100f58d0
lea ecx, [ebp - 0x28]
call fcn.10006070
push 0xb
push str.6789Zip.exe
lea ecx, [ebp - 0x28]
call fcn.10006070
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100158f5
lea ecx, [ebp - 0x141]
call fcn.10004070
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x141]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.1003de8a
lea ecx, [ebp - 0x141]
call fcn.10003de0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10001ee0
call fcn.10045da9
test al, al
je 0x10015a74
test bl, bl
jne 0x10015926
push str.1022
call fcn.10045bd3
add esp, 4
mov edx, eax
jmp 0x1001592b
mov edx, 0x100f55e0
mov ecx, edx
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10015944
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.10003260
push str.1021
mov dword [ebp - 4], 2
call fcn.10045bd3
mov edx, eax
add esp, 4
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x10015976
sub edx, esi
lea ecx, [ebp - 0x40]
sar edx, 1
push edx
push eax
call fcn.10006070
push str.1152
call fcn.10045bd3
mov edx, eax
add esp, 4
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x100159a1
sub edx, esi
lea ecx, [ebp - 0x40]
sar edx, 1
push edx
push eax
call fcn.10006070
call fcn.10045da9
test al, al
je 0x10015a6c
mov eax, dword [0x1012ebd0]
test eax, eax
je 0x10015a6c
cmp dword [eax + 4], 4
jl 0x10015a6c
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push str.1150
cmovae eax, dword [ebp - 0x40]
mov dword [ebp - 0x148], eax
call fcn.10045bd3
add esp, 4
lea ecx, [ebp - 0x140]
mov ebx, eax
push 0
push 0
push 0x100f5674
push 0x62
push str.CDOInstallBase::CreateTaskBarShortcut
push 4
call fcn.10006e20
mov dword [ebp - 0x14c], eax
mov esi, 0x100f5c08
mov byte [ebp - 4], 3
test ebx, ebx
lea edi, [eax + 0x28]
mov ecx, esi
cmovne ecx, ebx
push ecx
push edi
call fcn.10006220
mov eax, dword [ebp - 0x148]
test eax, eax
cmovne esi, eax
push esi
push edi
call fcn.10006220
mov ecx, dword [0x1012ebd0]
add esp, 0x10
push dword [ebp - 0x14c]
call fcn.10007f70
lea ecx, [ebp - 0x140]
call fcn.10007910
lea ecx, [ebp - 0x40]
call fcn.10001ee0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10081454
mov esp, ebp
pop ebp
ret 4
Function at 0x1001e430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1012931c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1001e4d1
cmp byte [esi + 0x3d], 0
je 0x1001e4d1
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1001e487
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1001e499
sub eax, 1
je 0x1001e49d
sub eax, 2
je 0x1001e4d1
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081454
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001e4ba
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100b7bbe
add esp, 0x10
cmp edi, eax
jne 0x1001e487
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081454
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10081454
mov esp, ebp
pop ebp
ret

Function at 0x1001e630
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eb520
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1012931c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10081411
mov edi, eax
add esp, 4
test edi, edi
je 0x1001e6db
push 1
mov dword [ebp - 4], 0
call fcn.10068730
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001ea50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1012931c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001ea80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081454
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1001eabc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1001eabc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081454
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1001eba1
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001eae4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001eb17
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.100b71b8
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081454
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x1001eba1
cmp eax, 1
jle 0x1001eb74
cmp eax, 3
jne 0x1001eba1
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.1001bc80
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081454
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001eb91
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100b7bbe
add esp, 0x10
cmp edi, eax
jne 0x1001eba1
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x1001eaa7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10081454
mov esp, ebp
pop ebp
ret 4
Function at 0x1001f860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1001f884
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001f950
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x1001f8a5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1001f8a7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x1001f92f
jg 0x1001f8ba
test esi, esi
je 0x1001f92f
test ecx, ecx
jl 0x1001f8fc
jg 0x1001f8c4
test eax, eax
je 0x1001f8fc
cmp ebx, ecx
jg 0x1001f8d6
jl 0x1001f8ce
cmp esi, eax
jae 0x1001f8d6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.100a1ac0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x1001f902
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x1001f92f
jg 0x1001f90c
test esi, esi
je 0x1001f92f
cmp dword [edi + 0x4c], 0
je 0x1001f92f
mov ecx, edi
call fcn.1001e710
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.100b74cc
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001fa20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1001fa44
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001fb00
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x1001fa65
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1001fa67
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x1001fae4
jg 0x1001fa7a
test esi, esi
je 0x1001fae4
test ecx, ecx
jl 0x1001fabe
jg 0x1001fa84
test eax, eax
je 0x1001fabe
cmp edi, ecx
jg 0x1001fa96
jl 0x1001fa8e
cmp esi, eax
jae 0x1001fa96
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.100a1ac0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1001fac1
mov edx, dword [ebp + 8]
test edi, edi
jl 0x1001fae4
jg 0x1001facb
test esi, esi
je 0x1001fae4
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1001fae4
push eax
push esi
push 1
push edx
call fcn.100b7bbe
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002c710
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x10130b00], eax
inc edx
cmp edx, 0x100
jb 0x1002c712
push esi
mov eax, 0x10130b04
mov esi, 0x1c0
mov edx, dword [eax - 4]
lea eax, [eax + 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x10130b00]
mov dword [eax + 0x3ec], edx
mov edx, dword [eax - 0x10]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x10130b00]
mov dword [eax + 0x3f0], edx
mov edx, dword [eax - 0xc]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x10130b00]
mov dword [eax + 0x3f4], edx
mov edx, dword [eax - 8]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x10130b00]
mov dword [eax + 0x3f8], edx
sub esi, 1
jne 0x1002c7b7
mov dword [0x10130ae0], 0x1002e270
mov dword [0x10130ad8], 0x1002e270
mov dword [0x10130adc], 0x1002e310
call fcn.1002e030
mov ecx, dword [0x10130ad8]
test eax, eax
mov edx, 0x1002e310
cmove ecx, edx
mov dword [0x10130ad8], ecx
pop esi
ret

Function at 0x1002caf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
je 0x1002cb43
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
push 0
mov ecx, 0x400000
mov dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
cmp esi, ecx
push eax
mov eax, esi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x10]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x1002cb4a
test ecx, ecx
je 0x1002cb43
test esi, esi
jne 0x1002cb08
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1002cbf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
test esi, esi
je 0x1002cc43
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
push 0
mov ecx, 0x400000
mov dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
cmp esi, ecx
push eax
mov eax, esi
cmova eax, ecx
push eax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x10]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x1002cc4a
test ecx, ecx
je 0x1002cc43
test esi, esi
jne 0x1002cc08
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1002e740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x1002e760
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
add dword [ebp + 0x10], 5
mov ecx, dword [ebp + 8]
push ebx
lea ebx, [eax - 4]
add ebx, ecx
mov dword [ebp - 4], ebx
lea eax, [edi + ecx]
cmp eax, ebx
jae 0x1002e789
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x1002e786
inc eax
cmp eax, ebx
jb 0x1002e777
mov ecx, dword [ebp + 8]
mov edx, eax
sub edx, edi
mov edi, eax
sub edx, ecx
sub edi, ecx
cmp eax, ebx
jae 0x1002e88d
cmp edx, 2
jbe 0x1002e812
xor esi, esi
movzx edx, byte [eax + 4]
lea ecx, [edx + 1]
test cl, 0xfe
jne 0x1002e879
movzx ecx, byte [eax + 3]
mov ebx, dword [ebp + 0x10]
shl edx, 8
add ebx, edi
or edx, ecx
movzx ecx, byte [eax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
add edx, ebx
sub ecx, ebx
cmp dword [ebp + 0x18], 0
cmove edx, ecx
mov dword [ebp + 0xc], edx
mov ebx, edx
test esi, esi
je 0x1002e849
and esi, 6
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x1002e847
mov ebx, 0x100
shl ebx, cl
mov ecx, dword [ebp + 0x10]
dec ebx
xor ebx, dword [ebp + 0xc]
add ecx, edi
cmp dword [ebp + 0x18], 0
je 0x1002e845
add ebx, ecx
jmp 0x1002e847
mov ecx, edx
shr esi, cl
test esi, esi
je 0x1002e7a2
cmp esi, 4
ja 0x1002e837
cmp esi, 3
je 0x1002e837
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x1002e7a2
mov ecx, dword [ebp + 8]
or esi, 8
shr esi, 1
inc edi
jmp 0x1002e770
sub ebx, ecx
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov ecx, dword [ebp + 8]
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [ebp - 4]
add edi, eax
jmp 0x1002e770
mov ecx, dword [ebp + 8]
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x1002e770
mov eax, dword [ebp + 0x14]
mov ecx, edx
shr esi, cl
xor ecx, ecx
cmp edx, 2
pop ebx
cmovbe ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003ccdb
Capabilities:
Create directory
Get common file path
Get startup folder

Disassembly:
push 0x224
mov eax, 0x100ee50c
call fcn.10082248
mov edi, dword [ebp + 8]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.100a25c0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0xb
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1003cd8a
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10022050
push 0x100f58d0
lea ecx, [ebp - 0x230]
call fcn.1003768b
push edi
lea ecx, [ebp - 0x230]
call fcn.1003768b
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.100c203a
pop ecx
test eax, eax
je 0x1003cd87
cmp eax, 0x11
jne 0x1003cd8a
xor esi, esi
inc esi
lea ecx, [ebp - 0x230]
call fcn.10001ee0
mov eax, esi
call fcn.100821f2
ret 4

Function at 0x1003d171
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x224
mov eax, 0x100ee50c
call fcn.10082248
mov edi, dword [ebp + 8]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.100a25c0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0xb
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1003d215
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10022050
push 0x100f58d0
lea ecx, [ebp - 0x230]
call fcn.1003768b
push edi
lea ecx, [ebp - 0x230]
call fcn.1003768b
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.10041b35
pop ecx
inc esi
lea ecx, [ebp - 0x230]
call fcn.10001ee0
mov eax, esi
call fcn.100821f2
ret 4

Function at 0x1003d327
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x228
mov eax, 0x100ee5ff
call fcn.10082248
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor edi, edi
mov dword [ebp - 0x234], esi
push edi
push eax
call fcn.100a25c0
xor eax, eax
mov dword [ebp - 0x220], edi
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push edi
push 0x1a
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10022050
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x1003d3d2
dec eax
lea ecx, [ebp - 0x230]
push eax
call fcn.1003e4de
cmp word [eax], 0x5c
je 0x1003d3c2
push 0x100f58d0
lea ecx, [ebp - 0x230]
call fcn.1003768b
push str.MicrosoftInternet_ExplorerQuick_Launch
lea ecx, [ebp - 0x230]
call fcn.1003768b
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.10034371
lea ecx, [ebp - 0x230]
call fcn.10001ee0
mov eax, esi
call fcn.100821f2
ret 4