joyce8/EMBER2024-capa huggingface dataset:
Function at 0x610666f0
Capabilities:
Get file attributes

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
mov esi, 1
push ebx
sub esp, 0x13c
mov ebx, 0x61
mov dword [ebp - 0x130], eax
mov edx, dword fs:[4]
mov edi, dword [edx - 0x82c]
test edi, edi
je 0x61066680
cmp ebx, 0x7a
ja 0x6106662c
mov eax, dword [edx - 0x82c]
lea esi, [esi]
test esi, eax
jne 0x6106662c
inc ebx
add esi, esi
cmp ebx, 0x7a
jbe 0x61066620
mov dword [esp + 8], ebx
lea eax, [ebp - 0x12c]
lea edi, [ebp - 0x12c]
mov dword [esp + 4], 0x610665c9
mov dword [esp], eax
call fcn.6108c610
mov dword [esp], edi
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
inc eax
jne 0x61066690
mov edx, dword fs:[4]
mov eax, esi
not eax
mov ecx, dword [edx - 0x82c]
and eax, ecx
test eax, eax
mov dword [edx - 0x82c], eax
jne 0x6106660f
mov esi, esi
lea edi, [edi]
mov eax, dword [ebp - 0x130]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [ebp - 0x12a], 0
mov eax, dword [0x610ef814]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0x610665ce
add eax, 0xa460
mov dword [esp + 8], eax
lea eax, [ebp - 0x128]
mov dword [esp], eax
call fcn.6108c610
mov eax, dword [0x610ef814]
mov eax, dword [eax + 0xa568]
mov dword [esp], edi
mov dword [esp + 8], eax
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
call fcn.61066380
mov dword [ebp - 0x130], eax
jmp 0x61066680
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
test eax, eax
js 0x61066702
cmp eax, dword [edx + 4]
jl 0x61066708
pop ebp
jmp 0x610665e0
mov eax, dword [edx + eax*4 + 0x3fe4]
imul eax, eax, 0x214
lea eax, [eax + edx + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.610665a0
Function at 0x61067620
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], ebx
xor al, 1
and al, 1
mov dword [ebp - 8], esi
test al, al
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
jne 0x61067690
mov dword [esp + 0x10], 0
lea esi, [ebp - 0x70]
lea ebx, [ebp - 0x68]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x4c
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x610677c0
cmp dword [ebp - 0x70], 0x4c
je 0x61067700
lea esi, [esi]
lea edi, [edi]
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
test al, 0x50
jne 0x610676c0
cmp dword [ebp - 0x70], 1
jle 0x610676c0
movzx edx, byte [ebp - 0x68]
cmp dl, 0x23
je 0x610676f3
cmp dl, 0x3a
je 0x610676eb
cmp dl, 0x4d
je 0x610676db
lea esi, [esi]
lea edi, [edi]
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x74]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x67], 0x5a
jne 0x610676c0
mov edx, dword [ebp + 0x1c]
or eax, 0x10
mov dword [edx], eax
jmp 0x610676c0
cmp byte [ebp - 0x67], 0xa
jne 0x610676ad
jmp 0x610676e1
cmp byte [ebp - 0x67], 0x21
jne 0x610676a8
jmp 0x610676e1
mov dword [esp], ebx
call fcn.610675e0
test al, al
jne 0x61067690
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x6a]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x610677b0
cmp dword [ebp - 0x70], 2
jne 0x61067690
movzx eax, word [ebp - 0x6a]
test ax, ax
je 0x61067690
cmp ax, 0x104
ja 0x61067690
mov dword [esp + 0x10], 0
movzx eax, ax
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x610677b0
movzx eax, word [ebp - 0x6a]
mov edx, dword [ebp - 0x70]
cmp edx, eax
jne 0x61067690
mov eax, dword [ebp + 0x14]
test edx, edx
mov byte [edx + eax], 0
mov dword [ebp - 0x74], edx
je 0x610676c0
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x1000001
jmp 0x610676c0
mov edx, dword [ebp + 0x18]
mov dword [edx], 5
jmp 0x610676c0
mov eax, dword [ebp + 0x18]
mov dword [eax], 5
jmp 0x610676c0
Function at 0x610678a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x2c]
push edi
push esi
push ebx
sub esp, 0x5c
lea ebx, [ebp - 0x28]
mov dword [ebp - 0x30], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], ebx
mov dword [esp], edx
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
jne 0x61067990
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x61067964
mov edi, dword [ebp + 0x18]
mov dword [edi], 5
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x61067920
mov edi, dword [ebp + 0x10]
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x30]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp + 0x1c]
mov edx, dword [ebp - 0x30]
mov eax, dword [edi]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x61067840
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], 0x610677e0
mov dword [esp + 4], 0x10
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp], 0x610f089c
mov dword [esp + 0x14], eax
call fcn.6108fd50
jmp 0x61067900
mov dword [esp + 0xc], 0x61067869
mov dword [esp + 8], 0x610677e0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x610678ee
mov eax, dword [ebp - 0x2c]
cmp eax, 0xa
mov dword [ebp - 0x3c], eax
je 0x610679f3
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
test al, 0x50
jne 0x610678f7
cmp dword [ebp - 0x3c], 1
jle 0x610679c1
movzx edx, byte [ebp - 0x28]
cmp dl, 0x23
je 0x610679eb
cmp dl, 0x3a
je 0x610679e3
cmp dl, 0x4d
je 0x610679d0
mov edx, dword [ebp + 0x1c]
or eax, 0x100
mov dword [edx], eax
jmp 0x610678f7
cmp byte [ebp - 0x27], 0x5a
jne 0x610679c1
mov edi, dword [ebp + 0x1c]
or eax, 0x10
mov dword [edi], eax
jmp 0x610678f7
cmp byte [ebp - 0x27], 0xa
jne 0x610679bc
jmp 0x610679d6
cmp byte [ebp - 0x27], 0x21
jne 0x610679b7
jmp 0x610679d6
cld
mov eax, 0x61066d65
mov ecx, 0xa
mov esi, ebx
mov edi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x61067a27
cld
mov eax, 0x6106787a
mov ecx, 0xa
mov esi, ebx
mov edi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x6106799b
mov eax, dword [ebp + 0x1c]
or dword [eax], 0x40000000
jmp 0x610678f7
mov eax, dword [ebp + 0x1c]
lea edx, [ebp - 0x2c]
mov edi, dword [ebp + 0x14]
mov dword [eax], 1
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x105
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
mov dword [ebp - 0x30], eax
sub esp, 0x14
test eax, eax
jne 0x61067aa0
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x61067a7a
mov edx, dword [ebp + 0x18]
mov dword [edx], 5
jmp 0x610678f7
mov dword [esp + 0xc], 0x61067885
mov dword [esp + 8], 0x610677e0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61067a6c
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov dword [esp], edi
call sym.cygwin1.dll__memchr
test eax, eax
jne 0x61067ac9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
jmp 0x610678f7
mov dword [esp], edi
call sym.cygwin1.dll__strlen
jmp 0x61067ac1
Function at 0x61069270
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, 0xffffffff
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
call fcn.610907e0
mov eax, dword [edi + 4]
mov edx, 1
test eax, eax
jne 0x61069300
xor esi, esi
mov ebx, 0x104
lea esi, [esi]
lea edx, [ebx + 2]
call fcn.61002a50
mov dword [edi + 4], eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_GetCurrentDirectoryA
sub esp, 8
cmp eax, ebx
jb 0x610692cb
inc esi
add ebx, ebx
cmp esi, 2
jg 0x610692cb
mov eax, dword [edi + 4]
jmp 0x610692a0
test eax, eax
jne 0x61069330
mov edx, 0xe4b
mov eax, 0x610620a0
call fcn.61022e70
mov eax, dword [edi + 0xc]
call fcn.61090890
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x6106930a
mov eax, dword [edi + 0xc]
call fcn.61090890
xor edx, edx
lea esi, [esi]
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x6106924c
mov dword [esp + 8], 0x6106922f
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x610692ef
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call fcn.61069350
mov edx, 1
jmp 0x61069300
Function at 0x6106fb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movzx eax, byte [eax + 5]
mov edx, dword [edx + 0x1c]
mov ecx, edx
mov byte [ebp - 0x19], al
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x2c], edx
mov edx, dword [edx + 0x10]
shl eax, 4
lea eax, [eax + edx]
mov ebx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 8]
cmp edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
jae 0x6106fb71
lea esi, [esi]
movzx edx, byte [ebp - 0x19]
cmp byte [ebx + 5], dl
je 0x6106fb90
add ebx, 0x10
cmp ebx, dword [ebp - 0x20]
jb 0x6106fb60
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx + 0x10]
sub dword [ebp + 0xc], ecx
sar dword [ebp + 0xc], 4
mov eax, dword [ebp + 0xc]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebx, dword [ebp + 0xc]
je 0x6106fb69
xor ecx, ecx
cmp ecx, dword [ebp - 0x24]
jae 0x6106fbe8
movzx eax, byte [ebx + 4]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebx]
mov byte [ebp - 0x2d], al
mov esi, dword [edx]
movzx eax, byte [edx + 4]
mov byte [ebp - 0x25], al
jmp 0x6106fbc0
movzx edx, byte [ebp - 0x2d]
movzx eax, cl
test byte [eax + edi], dl
movzx edx, byte [ebp - 0x25]
setne byte [ebp - 0x48]
test byte [eax + esi], dl
movzx edx, byte [ebp - 0x48]
setne al
xor eax, edx
test al, 1
jne 0x6106fbe8
inc ecx
cmp ecx, dword [ebp - 0x24]
jb 0x6106fbc0
cmp ecx, dword [ebp - 0x24]
jne 0x6106fb69
cmp ebx, dword [ebp - 0x20]
jae 0x6106fb71
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.6106fab0
mov dword [ebp + 0xc], ebx
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x1c]
mov dword [ebp - 0x2c], edx
jmp 0x6106fb71
Function at 0x61074340
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x33c
mov eax, dword [ebp + 8]
test eax, eax
je 0x6107444f
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x6107444f
mov dword [ebp - 0x31c], eax
lea ebx, [ebp - 0x118]
mov esi, 0x610742f0
mov dword [esp + 4], ebx
lea eax, [ebp - 0x31c]
lea edi, [ebp - 0x218]
mov dword [esp], eax
call fcn.61077e50
cld
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
movzx eax, word [0x61074328]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x218]
mov dword [esp], ebx
mov word [edi], ax
call sym.cygwin1.dll__strcat
mov dword [esp + 0xc], 0x20019
lea eax, [ebp - 0x320]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call fcn.610f48e8
sub esp, 0x14
test eax, eax
jne 0x6107444f
mov byte [ebp - 0x218], 0
mov eax, 0x100
lea esi, [ebp - 0x318]
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x324]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x328]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x320]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6107432a
mov dword [esp], eax
call fcn.610f4938
sub esp, 0x18
test eax, eax
je 0x61074471
mov eax, dword [ebp - 0x320]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
cmp byte [ebp - 0x218], 0
jne 0x61074460
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov dword [esp + 4], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
jmp 0x61074451
mov dword [esp + 8], 0x100
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
sub esp, 0xc
jmp 0x61074435
Function at 0x61079870
Capabilities:
Encrypt data using rc4 prga
Get hostname

Disassembly:
push ebp
mov ecx, 0x101
mov ebp, esp
push edi
lea eax, [ebp - 0x22c]
push esi
push ebx
sub esp, 0x23c
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x22c], ecx
mov ebx, dword [ebp + 8]
mov dword [esp + 4], eax
add edi, 2
mov dword [esp], edi
call sub.KERNEL32.dll_GetComputerNameA
sub esp, 8
test eax, eax
je 0x61079903
mov esi, ebx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x610798c0
xor al, byte [eax + 0x610ef1e4]
cmp al, byte [edi - 1]
jne 0x610798cb
test al, al
jne 0x610798b1
mov eax, 1
jmp 0x610798cd
xor eax, eax
test eax, eax
jne 0x610798d6
cmp byte [ebx], 0
jne 0x61079903
mov eax, dword [ebp + 0xc]
mov byte [eax + 1], 0x5c
mov byte [eax], 0x5c
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x610798f6
mov edx, eax
mov ecx, 0x101
mov eax, dword [ebp + 0x10]
call fcn.610555c0
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [ebp - 0x228]
mov ecx, 0x101
mov edx, ebx
mov eax, esi
call fcn.610555c0
mov dword [esp + 4], esi
lea eax, [ebp - 0x230]
mov dword [esp + 8], eax
mov dword [esp], 0
call fcn.610f6028
sub esp, 0xc
test eax, eax
jne 0x61079990
mov edx, dword [ebp - 0x230]
mov ecx, 0x101
mov eax, dword [ebp + 0xc]
call fcn.61055560
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x61079987
mov ecx, dword [ebp - 0x230]
mov edx, ecx
lea esi, [esi]
movzx eax, word [edx]
add edx, 2
mov ebx, dword [ebp + 0x10]
mov word [ebx], ax
add ebx, 2
test ax, ax
mov dword [ebp + 0x10], ebx
jne 0x61079960
mov dword [esp], ecx
call section.noname7
sub esp, 4
jmp 0x610798f6
mov ecx, dword [ebp - 0x230]
jmp 0x61079977
mov ecx, eax
mov edx, 0x125
mov eax, 0x610794d0
call fcn.61022e00
xor eax, eax
jmp 0x610798fb
Function at 0x6107a2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x44]
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x50], 0
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call fcn.61050d50
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x6107a3d7
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov edx, dword [ebp - 0x4c]
cmp dword [edx + 8], eax
je 0x6107a335
mov ecx, dword [edx + 0xc]
test ecx, ecx
jne 0x6107a2f0
inc dword [ebp - 0x50]
jmp 0x6107a2c0
mov eax, dword [ecx]
xor ebx, ebx
test eax, eax
je 0x6107a2eb
mov eax, dword [ebp + 8]
mov edx, dword [eax]
lea esi, [esi]
mov edi, dword [ecx + ebx*4]
mov esi, edx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6107a31a
xor al, byte [eax + 0x610ef1e4]
cmp al, byte [edi - 1]
jne 0x6107a325
test al, al
jne 0x6107a30b
mov eax, 1
jmp 0x6107a327
xor eax, eax
test eax, eax
jne 0x6107a335
inc ebx
mov eax, dword [ecx + ebx*4]
test eax, eax
jne 0x6107a300
jmp 0x6107a2eb
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.61078230
test eax, eax
je 0x6107a2eb
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp - 0x48]
cmp ebx, dword [eax + 4]
jge 0x6107a3a5
xor edi, edi
lea esi, [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
add eax, edi
mov edx, dword [eax]
test edx, edx
je 0x6107a3d0
test esi, esi
je 0x6107a3d0
mov dword [esp + 4], esi
mov eax, dword [eax]
mov dword [esp], eax
call fcn.610f4240
sub esp, 8
test eax, eax
setne al
nop
lea esi, [esi]
movzx eax, al
mov edx, ebx
test al, al
jne 0x6107a3aa
mov eax, dword [ebp + 0xc]
inc ebx
add edi, 0x2c
cmp ebx, dword [eax + 4]
jl 0x6107a360
mov edx, 0xffffffff
test edx, edx
jns 0x6107a2eb
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.610e6fa0
jmp 0x6107a2eb
cmp esi, edx
sete al
jmp 0x6107a390
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x61089e40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, eax
mov dword [ebp - 4], esi
call sub.KERNEL32.dll_GetCurrentThreadId
cmp eax, dword [0x610f0888]
je 0x61089e74
neg ebx
mov esi, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [0x610ef740]
mov edx, ebx
mov ebx, dword [ebp - 8]
mov esp, ebp
pop ebp
jmp fcn.6108a4a0
mov esi, dword [0x61147118]
mov eax, 0x61147100
mov dword [0x61147118], eax
mov eax, 0x61147100
mov dword [0x61147114], eax
mov esi, esi
mov dword [esp], 0x61146ef0
call fcn.6108b440
test eax, eax
je 0x61089eaa
cmp dword [eax], ebx
jne 0x61089e90
mov dword [eax], 0xffffffdb
mov dword [0x61147118], esi
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x61089fb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x20
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x610ef788
call sub.KERNEL32.dll_CreateEventA
mov dword [0x610ef834], eax
sub esp, 0x10
mov edx, 0x61089f58
mov eax, section.noname28
call fcn.61090770
mov dword [0x610f0884], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0x610ef788
call sub.KERNEL32.dll_CreateEventA
mov dword [0x610ef820], eax
sub esp, 0x10
mov dword [esp], 0x28
call fcn.610031d0
mov dword [esp], eax
mov ebx, eax
mov dword [esp + 0xc], 0x61089f6a
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6108b560
call fcn.61003420
mov dword [0x610ef82c], ebx
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov dword [ebx + 8], 0
mov eax, dword [0x610eda8c]
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6108a0e2
cld
xor eax, eax
mov ecx, 7
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x61146ee0]
mov ecx, 0x50000000
mov dword [eax + 0xd4], ecx
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x6108a0b0
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
mov eax, dword [0x610ef740]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], 0x61089f80
mov dword [esp + 8], 0x61089f44
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x800
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6108a0a9
mov dword [esp], 0x610eda88
mov ebx, 0x610f0868
mov dword [esp + 4], ebx
call fcn.6104c440
jmp 0x6108a083
Function at 0x6108c640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x4038
mov ebp, esp
call sym.cygwin1.dll__alloca
mov dword [ebp - 8], ebx
lea eax, [ebp + 0xc]
lea ebx, [ebp - 0x4008]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.6108c130
mov dword [esp], 0xfffffff4
mov esi, eax
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
lea edx, [ebp - 0x400c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp], 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_FlushFileBuffers
sub esp, 4
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x6108cd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [esp], eax
call sym.cygwin1.dll__strlen
mov dword [esp], edi
mov ebx, eax
call sym.cygwin1.dll__strlen
mov edx, ebx
sub edx, eax
cmp edx, 1
jle 0x6108cdc8
mov ebx, dword [ebp + 8]
cmp byte [ebx + 1], 0x3a
je 0x6108cdc8
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
xor ecx, ecx
test edx, edx
js 0x6108ce10
mov esi, dword [ebp + 8]
add esi, edx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6108cde8
xor al, byte [eax + 0x610ef1e4]
cmp al, byte [edi - 1]
jne 0x6108cdf3
test al, al
jne 0x6108cdd9
mov eax, 1
jmp 0x6108cdf5
xor eax, eax
test eax, eax
je 0x6108ce10
test edx, edx
je 0x6108ce14
mov ebx, dword [ebp + 8]
movzx eax, byte [edx + ebx - 1]
cmp al, 0x2f
je 0x6108ce14
cmp al, 0x5c
je 0x6108ce14
lea esi, [esi]
mov eax, ecx
jmp 0x6108cdbb
mov ecx, 1
jmp 0x6108ce10
Function at 0x6108fb60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
mov edi, esp
add eax, 0x26
and eax, 0xfffffff0
call sym.cygwin1.dll__alloca
mov eax, dword [ebp + 0x10]
lea ebx, [esp + 0x1c]
lea esi, [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x6108fb47
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.6108c610
mov ecx, ebx
jmp 0x6108fbb0
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x6108fbb0
test edx, 0x8080
jne 0x6108fbd5
shr edx, 0x10
add ecx, 2
mov dword [esp], esi
add dl, dl
sbb ecx, 3
sub ecx, ebx
lea eax, [ecx + 1]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x6108fb4d
call fcn.6108c610
mov byte [esi + 0xb], 0x20
mov dword [esp], esi
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov esp, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6108fc30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, 0x274c
mov ebp, esp
push edi
push esi
push ebx
call sym.cygwin1.dll__alloca
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x2728]
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
mov edi, eax
mov byte [ebp - 0x19], 0
call sub.KERNEL32.dll_SetLastError
mov eax, dword [ebp + 0x18]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
call fcn.6108f920
cmp byte [ebp - 0x19], 0
mov dword [ebp - 0x2730], eax
jne 0x6108fd2f
mov eax, dword [ebp + 0xc]
and eax, 0xffff8000
test ax, ax
jne 0x6108fcd6
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x6108fcb7
mov dword [esp], edi
call sub.KERNEL32.dll_SetLastError
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x2730]
mov edx, dword [ebp + 0xc]
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
call fcn.6108fb60
jmp 0x6108fca4
mov dword [esp], 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
lea edx, [ebp - 0x272c]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x2730]
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp], 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_FlushFileBuffers
sub esp, 4
jmp 0x6108fc9d
mov dword [esp + 4], 0xd2
mov dword [esp], 0x6108fc0c
call fcn.6108c640
mov dword [esp], 1
call sub.KERNEL32.dll_ExitProcess
nop