joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bafe4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call int.005c3ff3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x5bb02a
xor eax, eax
jmp 0x5bb02d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.005c4628
lea eax, [edi + 0x7c]
test eax, eax
je 0x5bb048
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.005c498d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x5bb086
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.005c498d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.005c3d0d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005c46a9
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5c65aa
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
mov dh, 0x53
popfd
mov cl, dl
cmc
jo 0x5c6620
pop es
retf
stosb byte es:[edi], al
xor dword [edx*4 + 0x5d1ac9f6], ecx
or al, 0x95
test cl, 0x1a
pop ebp
fstp dword [edi + 0x18]
sal byte [ecx], 1
mov cl, dl
clc
clc
jnp 0x5c661e
jmp 0x90d71644

Function at 0x5c7f29
Capabilities:
Encode data using xor

Disassembly:
out dx, al
pop edx
mov eax, dword [0x41aca5f5]
xor dh, ch
lcall 0xa90f, 0xf24f97e7
stosd dword es:[edi], eax
mov edi, 0xb47fbba7
push eax
test byte [eax - 0x50], ah
mov al, byte [0x6f5b74ba]
outsd dx, dword [esi]
xor byte [eax - 0x31], al
aad 0x89
fild word [edx + 0x38]
xchg esp, eax
mov eax, dword [0x38d253ca]
mov dl, 0xf6
stc
mov ah, 0x4a
mov eax, 0x6db42063
and byte [0xc820fee], ah
or al, 0xd3
les edx, [ebx - 0x10]
or al, 0xd3
les edx, [ebx - 0x10]
jge 0x5c7f0b
fnsave dword [esi - 0x3c5f0dba]
rcr byte [eax + 0x49040184], cl
sub bl, bh
xor eax, 0xa45ea51
and edx, dword [eax + ebx*4]
or al, 0x15
aas
push ebx
mov esi, 0x6bc12453
mov bh, 0x72
insd dword es:[edi], dx
pushal
mov gs, word [ebx + 0x3c]
cmc
jecxz 0x5c7eed
popal
ret 0xdf43
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..pdata
mov ebx, 0x40de38
nop
nop
mov ecx, 0xbff5a7a
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x308b4b70
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x10001010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10041004]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
jne 0x1000118b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push edi
push eax
push 0x40
push 7
push 0x44bfbf
call esi
mov dword [0x44bfc0], 0x90909090
mov edi, 0x9090
mov word [0x44bfc4], di
mov eax, 0x100015a0
sub eax, 0x44bfc4
mov byte [0x44bfbf], 0xe9
mov dword [0x44bfc0], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 7
push 0x44bfbf
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x478f8a
call esi
mov dword [0x478f8b], 0x90909090
mov eax, 0x10001500
sub eax, 0x478f8f
mov byte [0x478f8a], 0xe9
mov dword [0x478f8b], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 5
push 0x478f8a
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 0xa
push 0x491045
call esi
mov eax, 0x491045
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
mov eax, 0x10001b20
sub eax, 0x49104a
mov byte [0x491045], 0xe9
mov dword [0x491046], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 0xa
push 0x491045
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x44490b
call esi
mov dword [0x44490c], 0x90909090
mov eax, 0x100011a0
sub eax, 0x444910
mov byte [0x44490b], 0xe9
mov dword [0x44490c], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 5
push 0x44490b
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push 0x44bfc6
call esi
mov dword [0x44bfc7], 0x90909090
mov eax, 0x100011f0
mov word [0x44bfcb], di
sub eax, 0x44bfcb
mov byte [0x44bfc6], 0xe9
mov dword [0x44bfc7], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 7
push 0x44bfc6
call esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10001b40
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10004dd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.100049f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10004e02
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1003211c]
call dword [ebp - 8]
jmp 0x10004e0c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x1001b090
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.100070f0
lea ecx, [ebp - 4]
call fcn.1001b060
movzx eax, al
test eax, eax
jne 0x1001b0cd
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.1001afa0
mov eax, dword [ebp - 0x18]
jmp 0x1001b1f5
lea ecx, [ebp - 4]
call fcn.10007490
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1001b020
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.10007490
push eax
push 0
push 0
call fcn.1001aee0
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1001b133
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.1001afa0
mov eax, dword [ebp - 0x20]
jmp 0x1001b1f5
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1000b1e0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.100031e0
lea ecx, [ebp - 8]
call fcn.10003220
movzx edx, al
test edx, edx
jne 0x1001b17c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.10003200
lea ecx, [ebp - 4]
call fcn.1001afa0
mov eax, dword [ebp - 0x24]
jmp 0x1001b1f5
lea ecx, [ebp - 8]
call fcn.10003260
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.10007490
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.1001aee0
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1001b1d7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.10003200
lea ecx, [ebp - 4]
call fcn.1001afa0
mov eax, dword [ebp - 0x34]
jmp 0x1001b1f5
lea ecx, [ebp - 8]
call fcn.10007e00
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.10003200
lea ecx, [ebp - 4]
call fcn.1001afa0
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret

Function at 0x1001b8c0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1001b280
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001b8f4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1003211c]
call dword [ebp - 8]
jmp 0x1001b8fa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b950
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1001b2c0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001b984
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x1003211c]
call dword [ebp - 8]
jmp 0x1001b98e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001b9a0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1001b2e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001b9d8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x1003211c]
call dword [ebp - 8]
jmp 0x1001b9e6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8
Function at 0x1002a430
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10030ee0
mov eax, dword [0x10041004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10042168]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x1002a608
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x1002a557
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x1002a557
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x1002a535
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x1002a4b9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002a5c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x1002a628
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x1002a603
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x1002a628
jmp 0x1002a492
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001b40
mov esp, ebp
pop ebp
ret
Function at 0x1002a640
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10030ee0
mov eax, dword [0x10041004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10042168]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x1002a82b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x1002a776
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x1002a776
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x1002a752
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x1002a6c9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002a7e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x1002a84b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x1002a826
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x1002a84b
jmp 0x1002a6a2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001b40
mov esp, ebp
pop ebp
ret
Function at 0x4013b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x14], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
je 0x4013d2
push esi
push ebx
push dword [ebp + 8]
call fcn.0040131a
add esp, 0xc
push esi
call fcn.0040444a
mov edi, eax
push esi
push edi
call fcn.004012eb
mov eax, dword [ebx]
xor edx, edx
div esi
add esp, 0xc
test eax, eax
jbe 0x401413
xor edx, edx
mov dword [ebp + 0x14], eax
xor ecx, ecx
test esi, esi
jle 0x40140c
mov eax, dword [ebp + 8]
mov bl, byte [ecx + edi]
mov eax, dword [eax]
add eax, edx
add eax, ecx
xor byte [eax], bl
inc ecx
cmp ecx, esi
jl 0x4013f9
add edx, esi
dec dword [ebp + 0x14]
jne 0x4013f3
push edi
call fcn.0040441b
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x401522
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, 0xff
push edi
push esi
call fcn.00404180
pop ecx
mov dword [esp + 0xc], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
call fcn.00404180
pop ecx
mov edi, eax
push esi
push edi
push 0
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push edi
call fcn.004044c0
and byte [eax + 1], 0
push esi
call fcn.00404180
push dword [esp + 0x28]
mov edi, eax
mov dword [esp + 0x24], edi
mov ebx, edi
push edi
call fcn.004045c0
push edi
call fcn.004043a0
push edi
call fcn.004043a0
add esp, 0x1c
cmp eax, 5
jbe 0x401673
push ebp
push 5
push 0x40b074
push ebx
call fcn.00404d30
add esp, 0xc
test eax, eax
jne 0x401661
push esi
call fcn.00404180
add ebx, 5
mov edi, eax
push ebx
push edi
mov dword [esp + 0x2c], ebx
call fcn.004045c0
push 0x3b
push edi
call fcn.00404500
add esp, 0x14
test eax, eax
jne 0x4015df
push 0x22
push edi
call fcn.00404500
pop ecx
test eax, eax
pop ecx
je 0x4015e2
and byte [eax], 0
push 0x40b06c
push edi
call fcn.004045d0
push esi
call fcn.00404180
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call fcn.004045c0
push esi
call fcn.00404180
push dword [esp + 0x2c]
mov ebp, eax
push ebp
call fcn.004045c0
push edi
push ebp
call fcn.004045d0
push 0x5c
push edi
call fcn.004044c0
add esp, 0x30
test eax, eax
je 0x401631
inc eax
push eax
push edi
call fcn.004045c0
pop ecx
pop ecx
push edi
push ebx
call fcn.004045d0
pop ecx
pop ecx
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
call fcn.00404175
push ebp
call fcn.00404175
push edi
call fcn.00404175
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
add esp, 0xc
inc ebx
push ebx
call fcn.004043a0
cmp eax, 5
pop ecx
ja 0x401594
pop ebp
push edi
call fcn.00404175
push dword [esp + 0x10]
call fcn.00404175
push dword [esp + 0x18]
call fcn.00404175
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x403d36
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push 1
pop ebx
mov esi, 0xfa
push esi
call fcn.00404180
mov edi, eax
push esi
push 0
push edi
call fcn.004046b0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Rasapi32.dll
push edi
call fcn.004045d0
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x403d9e
push str.RasEnumConnectionsA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403d97
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.00404175
pop ecx
pop edi
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x403dab
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push 1
pop ebx
mov esi, 0xfa
push esi
call fcn.00404180
mov edi, eax
push esi
push 0
push edi
call fcn.004046b0
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.Rasapi32.dll
push edi
call fcn.004045d0
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x403e0b
push str.RasHangUpA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403e04
push dword [esp + 0x10]
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.00404175
pop ecx
pop edi
mov eax, ebx
pop esi
pop ebx
ret