joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001aed0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a8b05
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10221008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.10005100
mov dword [ebp - 4], 0
lea eax, [ebx + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10005100
mov byte [ebp - 4], 1
lea eax, [ebx + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10005100
mov byte [ebp - 4], 2
lea eax, [ebx + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10005100
mov byte [ebp - 4], 3
add edi, 0x60
lea esi, [ebx + 0x60]
mov dword [ebp + 8], edi
push esi
mov ecx, edi
call fcn.10005100
mov byte [ebp - 4], 4
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10005100
mov byte [ebp - 4], 5
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10005100
mov byte [ebp - 4], 6
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10005100
mov byte [ebp - 4], 7
lea eax, [esi + 0x60]
push eax
lea ecx, [edi + 0x60]
call fcn.10005100
mov byte [ebp - 4], 8
lea eax, [esi + 0x78]
push eax
lea ecx, [edi + 0x78]
call fcn.10005100
mov byte [ebp - 4], 9
lea eax, [esi + 0x90]
push eax
lea ecx, [edi + 0x90]
call fcn.10005100
mov byte [ebp - 4], 0xa
lea eax, [esi + 0xa8]
push eax
lea ecx, [edi + 0xa8]
call fcn.10005100
mov byte [ebp - 4], 0xb
lea eax, [esi + 0xc0]
push eax
lea ecx, [edi + 0xc0]
call fcn.10005100
mov byte [ebp - 4], 0xc
lea eax, [esi + 0xd8]
push eax
lea ecx, [edi + 0xd8]
call fcn.10005100
mov byte [ebp - 4], 0xd
lea eax, [esi + 0xf0]
push eax
lea ecx, [edi + 0xf0]
call fcn.10005100
mov byte [ebp - 4], 0xe
lea eax, [esi + 0x108]
push eax
lea ecx, [edi + 0x108]
call fcn.10005100
mov byte [ebp - 4], 0x10
mov esi, dword [ebp - 0x10]
mov eax, dword [ebx + 0x180]
mov dword [esi + 0x180], eax
lea ecx, [esi + 0x190]
mov eax, dword [ebx + 0x184]
mov dword [esi + 0x184], eax
mov eax, dword [ebx + 0x188]
mov dword [esi + 0x188], eax
mov eax, dword [ebx + 0x18c]
mov dword [esi + 0x18c], eax
lea eax, [ebx + 0x190]
push eax
call fcn.10005100
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100248c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101aa1a6
mov eax, dword fs:[0]
push eax
sub esp, 0x64c
mov eax, dword [0x10221008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
jne 0x100248fd
xor al, al
jmp 0x10024ad8
xor eax, eax
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x640], eax
mov eax, dword [0x10227684]
mov dword [ebp - 0x640], 0x10227684
test eax, eax
je 0x10024951
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, dword [0x10221698]
test ecx, ecx
je 0x10024977
cmp dword [0x1022169c], 8
mov eax, 0x10221688
cmovae eax, dword [0x10221688]
jmp 0x10024a45
push 0x20c
lea eax, [ebp - 0x224]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x10024aa4
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x63c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x63c]
push 0x208
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x10024a23
test eax, eax
je 0x10024a23
add eax, eax
cmp eax, 0x412
jae 0x10024af5
xor ecx, ecx
mov word [ebp + eax - 0x63c], cx
lea ecx, [ebp - 0x63c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024a10
lea eax, [ebp - 0x63c]
jmp 0x10024a41
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10024a30
lea eax, [ebp - 0x224]
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x658]
call fcn.10004a70
mov byte [ebp - 4], 0
mov eax, dword [0x10227684]
test eax, eax
je 0x10024a66
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x644], 8
lea edx, [ebp - 0x658]
mov dword [ebp - 0x640], 0
cmovae edx, dword [ebp - 0x658]
cmp dword [esi + 0x14], 8
jb 0x10024a8c
mov esi, dword [esi]
push dword [ebp - 0x648]
mov ecx, esi
call fcn.1009eec0
add esp, 4
test eax, eax
jne 0x10024ac2
mov bl, 1
jmp 0x10024ac4
mov byte [ebp - 4], 0
mov eax, dword [0x10227684]
test eax, eax
je 0x10024ab8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x640], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x658]
call fcn.10004a00
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1018b6f4
mov esp, ebp
pop ebp
ret 4
call fcn.1018bbf5
int3
Function at 0x100317e0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10221008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x214], 0
mov dword [eax], 0
lea eax, [ebp - 0x214]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100319b2
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x100319b2
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x218]
push ecx
xor esi, esi
mov dword [ebp - 0x218], 0
push esi
push esi
push 3
push eax
call edi
test eax, eax
jne 0x100318ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1003188c
push dword [ebp - 0x218]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x100318b1
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1018b6f4
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x218]
push esi
push 3
push dword [ebp - 0x214]
call edi
test eax, eax
jne 0x100318de
test esi, esi
je 0x1003188c
push esi
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003188c
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xor edi, edi
mov dword [ebp - 0x210], 0x104
add esp, 0xc
cmp dword [esi], edi
jbe 0x10031983
lea ebx, [esi + 4]
nop word [eax + eax]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x210], 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
test eax, eax
je 0x10031983
mov eax, dword [ebp - 0x21c]
mov edx, eax
cmp dword [eax + 0x14], 8
jb 0x1003195b
mov edx, dword [eax]
lea ecx, [ebp - 0x20c]
call fcn.1009efb0
test al, al
jne 0x10031974
inc edi
add ebx, 0xc
cmp edi, dword [esi]
jb 0x10031910
jmp 0x10031983
mov ecx, dword [ebp - 0x220]
lea eax, [edi + edi*2]
mov eax, dword [esi + eax*4 + 0xc]
mov dword [ecx], eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1018b6f4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.1018b6f4
mov esp, ebp
pop ebp
ret
Function at 0x10031d50
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac067
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x10221008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov ecx, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov dword [ebp - 0x3c], eax
push 4
mov dword [ebp - 0x38], ecx
mov byte [eax], 0
call fcn.1018b705
mov esi, eax
add esp, 4
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], 0
push 4
mov dword [esi], 0
call fcn.1018b705
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 1
mov dword [eax], 0
mov dword [eax], 0xffffffff
mov byte [ebp - 4], 0
mov dword [esi], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov dword [eax + 4], esi
mov esi, eax
lea eax, [esi + 0x28]
mov dword [eax], 0
mov dword [ebp - 0x34], eax
mov word [eax + 4], 0
mov dword [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 7
mov word [esi + 0x3c], cx
mov byte [ebp - 4], 4
mov edx, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
call fcn.10034630
mov eax, dword [esi + 0x30]
lea ecx, [ebp - 0x58]
add esp, 4
mov dword [esi + 0x34], eax
xorps xmm0, xmm0
mov edx, edi
movups xmmword [esi + 8], xmm0
push dword [ebp - 0x38]
movups xmmword [esi + 0x18], xmm0
call fcn.10097e70
add esp, 4
mov esi, eax
mov byte [ebp - 4], 5
mov edi, dword [ebp - 0x30]
add edi, 0x3c
cmp edi, esi
je 0x10031ea3
mov ecx, edi
call fcn.10004a00
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
call fcn.10004a00
push 0x2c
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x2c]
push str.RC_SAFE_140D511E_F5F7_419D_95B8_F66D4E2333D5
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.10004a70
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
mov edx, dword [ebp - 0x38]
call fcn.100a2230
mov byte [ebp - 4], 7
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x10031efd
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.100088e0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
call fcn.10004a00
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push eax
call fcn.100aac40
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.10004a00
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1018b6f4
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x100355a0
Capabilities:
Get file size
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10221008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 8
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov byte [ebp - 0x11], 0
jb 0x100355c2
mov ecx, dword [ecx]
push 0
push 0
push 3
push 0
push 7
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003569f
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
push eax
push edi
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1003569c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add ecx, 0xffffffc0
adc eax, 0xffffffff
test eax, eax
ja 0x1003569c
jb 0x10035622
cmp ecx, 0x13fffc0
ja 0x1003569c
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x1003569c
push 0
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
test edx, edx
je 0x10035699
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x10035692
mov esi, dword [edx + 0x3c]
mov ecx, dword [ebp - 0x10]
add esi, edx
add ecx, edx
lea eax, [esi + 0xf8]
cmp eax, ecx
jae 0x1003568c
cmp dword [esi], 0x4550
jne 0x1003568c
mov ecx, dword [ebp - 0x18]
mov eax, dword [esi + 8]
mov byte [ebp - 0x11], 1
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x50]
mov dword [ecx], eax
mov eax, dword [esi + 0x58]
mov dword [ecx + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x11]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1018b6f4
mov esp, ebp
pop ebp
ret
Function at 0x100359c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac518
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10221008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x10035ab0
push 0xc
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x24]
push str.wintrust.dll
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
call fcn.10004a70
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
call fcn.100ab550
mov ecx, eax
call fcn.100ab610
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.10004a00
test ebx, ebx
jne 0x10035a69
mov dword [edi + 0x18], 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
mov dword [edi + 0x14], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a3d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov edx, ecx
test edi, edi
je 0x1003a40c
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1003a40b
not dword [edx]
movzx eax, byte [edi]
lea edi, [edi + 1]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x101ed350]
xor eax, ecx
mov dword [edx], eax
sub esi, 1
jne 0x1003a3e7
not eax
mov dword [edx], eax
pop esi
pop edi
pop ebp
ret 8
Function at 0x1003aec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10208330
push 0x1018b766
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x10221008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
push 0x200
push 0
lea eax, [ebp - 0x220]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x20], 0
xor ebx, ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 4], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
push 0x48
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1003af40
push 0x1e7
jmp 0x1003b072
cmp dword [esi + 0x40], 0
je 0x1003af4d
push 0x57
jmp 0x1003b072
mov eax, dword [esi]
test eax, eax
je 0x1003b070
cmp eax, 0xffffffff
je 0x1003b070
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
movq qword [ebp - 0x230], xmm0
push 0
push 0
push dword [ebp - 0x22c]
push dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1003b074
push 0
lea eax, [ebp - 0x20]
push eax
push 0x200
lea eax, [ebp - 0x220]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003b074
cmp dword [ebp - 0x20], 0x200
jne 0x1003b074
mov eax, 0xaa55
cmp word [ebp - 0x22], ax
jne 0x1003b016
mov al, byte [ebp - 0x220]
cmp al, 0xeb
jne 0x1003afe5
cmp byte [ebp - 0x21e], 0x90
je 0x1003afe9
cmp al, 0xe9
jne 0x1003b016
movzx ecx, word [ebp - 0x215]
movzx eax, word [ebp - 0x20f]
shl eax, 5
dec eax
add eax, ecx
cdq
idiv ecx
mov edx, eax
movzx ecx, word [ebp - 0x20a]
test ecx, ecx
cmove ecx, dword [ebp - 0x1fc]
test ecx, ecx
jne 0x1003b01a
push 0xd
jmp 0x1003b072
movzx eax, byte [ebp - 0x210]
imul eax, ecx
movzx ecx, word [ebp - 0x212]
add eax, edx
add ecx, eax
movzx eax, word [ebp - 0x215]
imul eax, ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x34]
cmp eax, 0xff5
jae 0x1003b056
mov dword [esi + 0x40], 3
jmp 0x1003b063
cmp eax, 0xfff5
sbb eax, eax
add eax, 5
mov dword [esi + 0x40], eax
mov ebx, 1
mov dword [ebp - 0x224], ebx
jmp 0x1003b074
push 6
call edi
mov dword [ebp - 4], 0xfffffffe
call fcn.1003b0aa
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1018b6f4
mov esp, ebp
pop ebp
ret
Function at 0x10053e50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
mov bh, byte [ecx + 0x100]
push ebp
mov ebp, dword [esp + 0x10]
push edi
xor edi, edi
mov dword [esp + 0xc], edx
mov dl, byte [ecx + 0x101]
test ebp, ebp
je 0x10053ea9
push esi
nop
inc bh
movzx esi, bh
mov bl, byte [esi + ecx]
add dl, bl
mov byte [esp + 0x18], dl
movzx edx, dl
movzx eax, byte [edx + ecx]
mov byte [esi + ecx], al
mov byte [edx + ecx], bl
movzx eax, byte [esi + ecx]
mov edx, dword [esp + 0x10]
add al, bl
movzx eax, al
movzx eax, byte [eax + ecx]
xor byte [edi + edx], al
inc edi
mov dl, byte [esp + 0x18]
cmp edi, ebp
jb 0x10053e70
pop esi
pop edi
pop ebp
mov byte [ecx + 0x101], bh
mov byte [ecx + 0x100], bh
pop ebx
pop ecx
ret
Function at 0x10056920
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b13b7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10221008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x18
mov byte [edi], 0
call fcn.1018b705
add esp, 4
mov dword [edi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0
lea esi, [edi + 8]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10058280
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10058280
mov dword [esi], eax
mov byte [ebp - 4], 6
xor eax, eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 7
mov word [edi + 0x20], ax
mov byte [ebp - 4], 7
lea ecx, [edi + 0x38]
call fcn.10039af0
mov byte [ebp - 4], 8
lea eax, [edi + 0xb8]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], cl
mov byte [ebp - 4], 0xa
xor eax, eax
mov dword [edi + 0x100], ecx
mov dword [edi + 0x104], 7
mov word [edi + 0xf0], ax
mov byte [ebp - 4], 0xb
mov dword [edi + 0x118], eax
mov dword [edi + 0x11c], 0xf
mov byte [edi + 0x108], al
mov byte [ebp - 4], 0xc
mov dword [edi + 0x130], eax
mov dword [edi + 0x134], 0xf
mov byte [edi + 0x120], al
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005c1a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2138
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10221008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, dword [esi]
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
test ecx, ecx
je 0x1005c278
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x1c], edx
call fcn.10057ec0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0
je 0x1005c269
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push 0
cmovae eax, dword [ebp - 0x38]
push 0x80
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1005c269
test esi, esi
je 0x1005c269
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10004a00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1018b6f4
mov esp, ebp
pop ebp
ret 4
Function at 0x1005f3a0
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b27d3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10221008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.10058280
mov dword [edi], eax
mov dword [ebp - 4], 2
lea esi, [edi + 8]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10062de0
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x10]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10062d50
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10062de0
mov dword [esi], eax
mov byte [ebp - 4], 0xb
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1000ef10
mov dword [esi], eax
mov byte [ebp - 4], 0xe
lea esi, [edi + 0x28]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10062cc0
mov dword [esi], eax
mov byte [ebp - 4], 0x11
lea esi, [edi + 0x30]
push 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10062cc0
mov dword [esi], eax
mov byte [ebp - 4], 0x14
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0
call fcn.10062cc0
mov dword [esi], eax
mov byte [ebp - 4], 0x17
lea eax, [edi + 0x40]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x18
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], cl
mov byte [ebp - 4], 0x19
xor eax, eax
mov dword [edi + 0x88], ecx
mov dword [edi + 0x8c], 7
mov word [edi + 0x78], ax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret