joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a156e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x101a0e50
jmp 0x101a147a
jno 0x101a14a1
jmp 0x101a1497
push ebx
jno 0x101a149e
push ebx
pop ebx
pop ebx
pushal
pushal
jbe 0x101a14a9
jne 0x101a14af
popal
push ecx
jmp 0x101a14be
push edi
pop edi
pop ecx
popal
pushfd
sub esp, 4
mov dword [esp], eax
push edi
mov edi, 0x3e6b7852
mov dword [esp + 4], edi
pop edi
push ebx
mov ebx, 0x3e6b7821
sub dword [esp + 4], ebx
pop ebx
push edi
push ebx
push ecx
mov ecx, 0x77f3209b
mov ebx, ecx
pop ecx
mov dword [esp + 4], ebx
pop ebx
shl dword [esp], 1
push ebp
mov ebp, 0x706f3962
add dword [esp + 4], ebp
pop ebp
add dword [esp], 0x78fed900
xor dword [esp], 0xd94e5dcd
push eax
mov dword [esp], edx
mov edx, esp
push esi
mov esi, 0x7ffbe391
dec esi
dec esi
sub esi, 0x6bfb675a
shl esi, 7
xor esi, 0x3fbf2651
xor esi, 0x3f813cd5
add edx, esi
pop esi
sub edx, 4
xchg dword [esp], edx
pop esp
mov dword [esp], ebp
mov dword [esp], eax
sub esp, 4
mov dword [esp], eax
mov eax, esp
add eax, 4
sub eax, 4
xchg dword [esp], eax
pop esp
mov dword [esp], ebp
mov dword [esp], 0x1b5a743c
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
pop eax
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
push dword [esp + 8]
mov ebx, dword [esp]
sub esp, 4
mov dword [esp], eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push eax
mov eax, esp
push edx
mov edx, 0x50f701bc
neg edx
shr edx, 3
shr edx, 2
and edx, 0x7dffa504
inc edx
xor edx, 0x5780505
add eax, edx
pop edx
add eax, 4
xchg dword [esp], eax
pop esp
push dword [esp]
pop eax
sub esp, 4
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
jmp 0x10178e20
Function at 0x101ae98b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x101ae2c2
jmp 0x101ae8da
jmp 0x101ae8e4
jg 0x101ae8ee
push eax
pushal
popal
pop eax
pushfd
push eax
mov dword [esp], 0x5ff25001
and dword [esp], 0x57f3d390
not dword [esp]
not dword [esp]
neg dword [esp]
push edx
mov edx, 0xa80db031
xor dword [esp + 4], edx
mov edx, dword [esp]
push eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
pop esp
push 0x67a8ca00
mov dword [esp], ebp
mov dword [esp], 0x1484863d
mov dword [esp], ecx
mov dword [esp], 0x3f7f5ae4
dec dword [esp]
inc dword [esp]
not dword [esp]
xor dword [esp], 0x7df77b87
xor dword [esp], 0xbd6d3c5b
sub esp, 4
mov dword [esp], ebx
mov dword [esp], 0x5df3dde2
inc dword [esp]
sub dword [esp], 0x7fbdf98e
xor dword [esp], 0x3f95728c
xor dword [esp], 0x6fcf8a7a
or dword [esp], 0x1ffc7205
xor dword [esp], 0xbe32ae36
mov dword [esp], eax
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
push ebp
push dword [esp + 4]
mov ebp, dword [esp]
add esp, 4
pop dword [esp]
mov esp, dword [esp]
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
pop eax
push ecx
push esp
pop ecx
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push dword [esp + 8]
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
pop ebx
push edi
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
mov esp, dword [esp]
push dword [esp]
pop eax
push eax
push esp
pop eax
add eax, 4
push ecx
mov ecx, 4
add eax, ecx
pop ecx
xchg dword [esp], eax
pop esp
jmp 0x10173aec
Function at 0x101af189
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x101aea5a
jmp 0x101af074
push ebx
pushal
push eax
push edx
rdtsc
pop edx
pop eax
jno 0x101af082
jl 0x101af088
push eax
push edx
rdtsc
pop edx
pop eax
popal
pop ebx
jmp 0x101af09e
pushfd
push edx
mov dword [esp], 0x275f7231
shl dword [esp], 6
add dword [esp], 0xffffffff
not dword [esp]
xchg dword [esp], edx
inc edx
xchg dword [esp], edx
shr dword [esp], 8
xor dword [esp], 0x282342
push ebx
mov dword [esp], edi
mov dword [esp], 0x75de07e1
add dword [esp], 1
sub dword [esp], 0xffffffff
sub dword [esp], 0x75c31d84
push ecx
mov dword [esp], edi
mov dword [esp], 0x3dd2d8a5
not dword [esp]
dec dword [esp]
xor dword [esp], 0xbda22989
mov dword [esp], ebx
mov dword [esp], eax
push ebx
push ebx
mov ebx, 0x47e88bce
mov dword [esp + 4], ebx
mov ebx, dword [esp]
add esp, 4
mov dword [esp], ecx
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
pop eax
push eax
mov eax, esp
add eax, 4
add eax, 4
xchg dword [esp], eax
mov esp, dword [esp]
push dword [esp + 8]
mov ebx, dword [esp]
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
push ecx
push dword [esp + 4]
pop ecx
pop dword [esp]
mov esp, dword [esp]
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push edi
mov edi, esp
add edi, 4
add edi, 4
xor edi, dword [esp]
xor dword [esp], edi
xor edi, dword [esp]
pop esp
push dword [esp]
mov eax, dword [esp]
add esp, 4
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
jmp 0x10175b28
Function at 0x101b5676
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x101b501e
jmp 0x101b5646
jl 0x101b5654
push ebx
jae 0x101b5653
pop ebx
pushfd
push eax
mov dword [esp], ebx
push ebx
mov ebx, esp
add ebx, 4
sub ebx, 4
xchg dword [esp], ebx
pop esp
mov dword [esp], eax
mov eax, 0x100
mov dword [esp + 4], eax
pop eax
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], edx
push ecx
push edi
mov edi, 0x1b5023
mov ecx, edi
pop edi
mov dword [esp + 4], ecx
pop ecx
push ebx
mov dword [esp], ecx
mov dword [esp], 0x7ffbcb2c
push ecx
mov ecx, 0x7bfcaaa8
or dword [esp + 4], ecx
pop ecx
add dword [esp], 0x7bf7d420
neg dword [esp]
shl dword [esp], 6
xor dword [esp], 0x5d6a73ab
mov dword [esp], eax
push ecx
mov ecx, esp
add ecx, 4
push ebx
mov ebx, 4
sub ecx, ebx
mov ebx, dword [esp]
add esp, 4
xchg dword [esp], ecx
mov esp, dword [esp]
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
push dword [esp]
pop eax
add esp, 4
add esp, 4
push dword [esp + 8]
push dword [esp]
pop ebx
push esi
mov esi, esp
push edi
mov edi, 4
add esi, edi
pop edi
add esi, 4
xchg dword [esp], esi
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push eax
mov eax, esp
push ecx
mov ecx, 0x7bb7f19c
shl ecx, 8
xor ecx, 0xb7f19c04
add eax, ecx
pop ecx
add eax, 4
xchg dword [esp], eax
pop esp
push dword [esp]
mov eax, dword [esp]
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
jmp 0x10177d1a
Function at 0x101bbc0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x101bb56a
jmp 0x101bbbc3
jp 0x101bbbde
jmp 0x101bbbde
pushfd
push eax
mov dword [esp], 0x3be1f2fc
push eax
mov eax, 0x7a7c60ea
and dword [esp + 4], eax
pop eax
sub dword [esp], 0x6c6f3906
push esi
mov esi, 0xb14e5844
add dword [esp + 4], esi
pop esi
add dword [esp], 0x80c0826e
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 4
xchg dword [esp], ebp
pop esp
mov dword [esp], ebp
mov dword [esp], 0x3fafa7d4
sub dword [esp], 0x7cc6f1e1
dec dword [esp]
inc dword [esp]
add dword [esp], 0x7d072017
shr dword [esp], 4
sub dword [esp], 0x3e347f1
push ebx
push esp
pop ebx
add ebx, 4
push ecx
mov ecx, 0x7cfc9c0e
push esi
mov esi, 0x67f4370f
sub esi, 0x1d7febd2
dec esi
inc esi
sub esi, 0xcebe3737
or ecx, esi
pop esi
xor ecx, 0x7ffe9c0a
sub ebx, ecx
pop ecx
xchg dword [esp], ebx
pop esp
mov dword [esp], eax
push edi
mov dword [esp], 0x7e8bb0d0
or dword [esp], 0x77f3da47
push edx
mov edx, 0x2feed914
add dword [esp + 4], edx
pop edx
or dword [esp], 0x67cf1068
or dword [esp], 0x6ff5bb53
shl dword [esp], 6
sub dword [esp], 0xb8767508
mov dword [esp], ebp
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
mov eax, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
add esp, 4
push dword [esp + 8]
mov ebx, dword [esp]
sub esp, 4
mov dword [esp], esi
mov esi, esp
add esi, 4
add esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
mov ebx, dword [esp]
add esp, 4
push edi
push esp
pop edi
add edi, 4
add edi, 4
xchg dword [esp], edi
pop esp
push dword [esp]
pop eax
sub esp, 4
mov dword [esp], edx
push esp
pop edx
add edx, 4
add edx, 4
xchg dword [esp], edx
pop esp
jmp 0x10175b28
Function at 0x101bd445
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x101bcd1f
jmp 0x101bd346
push ebx
push esi
push edx
pop edx
pop esi
jmp 0x101bd363
pop ebx
jmp 0x101bd37c
pushfd
push edx
mov dword [esp], 0x7effcfd6
xchg dword [esp], ebp
not ebp
xchg dword [esp], ebp
dec dword [esp]
xor dword [esp], 0xa049751e
mov dword [esp], edx
mov dword [esp], 0x100
push eax
mov eax, esp
add eax, 4
sub eax, 4
push eax
push dword [esp + 4]
pop eax
pop dword [esp]
pop esp
mov dword [esp], edx
mov dword [esp], 0x757f7537
and dword [esp], 0x7fff3f01
sub dword [esp], 0x756367dd
push eax
mov dword [esp], 0x2cb1b29f
mov dword [esp], ebx
mov dword [esp], 0x7c7f4f17
or dword [esp], 0x756cebe5
sub dword [esp], 0x3ffd2b3c
and dword [esp], 0x77ffef9a
and dword [esp], 0x7e7e0dea
sub dword [esp], 0xe5edb877
mov dword [esp], eax
push eax
push esp
pop eax
add eax, 4
push edi
mov edi, 0x5def8453
sub edi, 0x5f9a0da7
shr edi, 3
inc edi
add edi, 0x4f7d1d81
xor edi, 0x6f47cc53
add eax, 0x7a7690fc
sub eax, edi
sub eax, 0x7a7690fc
pop edi
xchg dword [esp], eax
pop esp
mov dword [esp], ebx
push dword [esp + 0x10]
mov eax, dword [esp]
push ebp
mov ebp, esp
push eax
mov eax, 0x7e3fc257
add eax, 0x7f7f7500
xor eax, 0x7e9bcf98
shl eax, 4
sub eax, 0x324f8cec
add ebp, eax
pop eax
add ebp, 4
push ebp
push dword [esp + 4]
pop ebp
pop dword [esp]
pop esp
push dword [esp + 8]
push dword [esp]
pop ebx
push edi
mov edi, esp
add edi, 4
push edx
mov edx, 4
add edi, edx
pop edx
xchg dword [esp], edi
pop esp
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
push edi
mov edi, esp
add edi, 4
push eax
mov eax, 4
add edi, 0x6ecf4bd1
add edi, eax
sub edi, 0x6ecf4bd1
pop eax
push edi
push dword [esp + 4]
pop edi
pop dword [esp]
pop esp
push dword [esp]
pop eax
push ecx
push esp
pop ecx
add ecx, 4
push eax
mov eax, 4
add ecx, eax
pop eax
xchg dword [esp], ecx
pop esp
jmp 0x101719fb
Function at 0x101c3430
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x101c2c82
jmp 0x101c32d5
pushal
jmp 0x101c32e7
push eax
jmp 0x101c32f5
push ecx
pop ecx
pop eax
jne 0x101c3309
jmp 0x101c3309
popal
pushal
pushal
jg 0x101c3312
push edx
pop edx
jmp 0x101c3327
popal
jmp 0x101c3338
pushal
push eax
push edx
rdtsc
pop edx
pop eax
jmp 0x101c3354
popal
popal
pushfd
push 0x420afb00
mov dword [esp], ebx
mov dword [esp], 0x23df6189
add dword [esp], 0x76db9725
shl dword [esp], 6
shl dword [esp], 8
add dword [esp], 0x1b337d69
dec dword [esp]
sub dword [esp], 0x9d7f59b8
push edi
mov edi, 0xc4205ee4
add dword [esp + 4], edi
pop edi
push ecx
push 0x6b3a322
mov dword [esp], ecx
mov dword [esp], eax
mov eax, 0x1c2c87
mov dword [esp + 4], eax
mov eax, dword [esp]
add esp, 4
push edi
mov edi, esp
add edi, 4
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], ecx
mov dword [esp], eax
mov dword [esp], edi
mov dword [esp], eax
push ebx
mov dword [esp], 0x1fefab82
dec dword [esp]
push esi
mov esi, 0x45bd035e
add dword [esp + 4], esi
mov esi, dword [esp]
add esp, 4
mov dword [esp], ebx
push dword [esp + 0x10]
push dword [esp]
pop eax
push ecx
push esp
pop ecx
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push dword [esp + 8]
push dword [esp]
pop ebx
push esi
mov esi, esp
add esi, 4
add esi, 4
xchg dword [esp], esi
mov esp, dword [esp]
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
push dword [esp]
pop ebx
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
push ebp
push dword [esp + 4]
mov ebp, dword [esp]
add esp, 4
pop dword [esp]
pop esp
mov eax, dword [esp]
push ecx
mov ecx, esp
add ecx, 4
push ebx
mov ebx, 4
add ecx, 0x7f56c805
add ecx, ebx
sub ecx, 0x7f56c805
mov ebx, dword [esp]
add esp, 4
xchg dword [esp], ecx
pop esp
jmp 0x10177d1a
Function at 0x101c5be8
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop esi
add esi, 9
jmp 0x101c5489
jmp 0x101c5adb
pushal
push eax
push edx
jge 0x101c5ae4
push eax
push edx
rdtsc
pop edx
pop eax
rdtsc
push eax
push edx
rdtsc
pop edx
pop eax
push eax
push edx
rdtsc
pop edx
pop eax
pop edx
pop eax
pushal
jmp 0x101c5b0c
push eax
push edx
rdtsc
pop edx
pop eax
ja 0x101c5b18
jo 0x101c5b1e
popal
popal
pushfd
push ecx
mov dword [esp], 0x2db70540
neg dword [esp]
push eax
mov eax, 0x6febc97f
add dword [esp + 4], 0x6f7f8b52
add dword [esp + 4], 0x5ef6274f
sub dword [esp + 4], eax
sub dword [esp + 4], 0x5ef6274f
sub dword [esp + 4], 0x6f7f8b52
pop eax
sub dword [esp], 0x625d3041
push ebp
mov dword [esp], 0x795f2b23
push esi
mov esi, 0x1c37e117
and dword [esp + 4], esi
pop esi
xor dword [esp], 0x63e1bd03
shr dword [esp], 2
push ebx
mov ebx, 0x1ee15272
sub dword [esp + 4], ebx
pop ebx
push 0x219054f9
mov dword [esp], ebp
push ebx
mov ebx, 0x46a4ab53
mov dword [esp + 4], ebx
mov ebx, dword [esp]
add esp, 4
mov dword [esp], eax
push eax
push esp
pop eax
add eax, 4
push edx
mov edx, 4
sub eax, edx
pop edx
xchg dword [esp], eax
pop esp
mov dword [esp], ebp
mov dword [esp], ebx
push dword [esp + 0x10]
mov eax, dword [esp]
push ebx
mov ebx, esp
push ecx
mov ecx, 4
add ebx, ecx
pop ecx
add ebx, 4
push ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
pop esp
push dword [esp + 8]
push dword [esp]
pop ebx
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
mov dword [esp + 8], eax
mov dword [esp + 0x10], ebx
mov ebx, dword [esp]
push esi
mov dword [esp], edx
push esp
pop edx
add edx, 4
add edx, 4
xchg dword [esp], edx
mov esp, dword [esp]
push dword [esp]
pop eax
push eax
push esp
pop eax
add eax, 4
push ecx
mov ecx, 4
add eax, ecx
pop ecx
xchg dword [esp], eax
pop esp
jmp 0x1016a550
Function at 0x401900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40190f
pop dword [ebp - 0x50]
mov eax, 0xcc4c57fc
add eax, 0x33f3c113
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x2b898b42
sub dword [ebp - 0x60], 0xdd3745f7
mov dword [ebp - 0x5c], 0x9973ab99
add dword [ebp - 0x5c], 0x98bfa0ac
mov dword [ebp - 0x58], 0xa855d52a
add dword [ebp - 0x58], 0xa3f66f04
mov dword [ebp - 0x54], 0x42e1729c
add dword [ebp - 0x54], 0xbd1e8d64
lea eax, [ebp - 0x60]
push eax
mov eax, 0x9188d394
add eax, 0x6eb85d04
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x336fa076
sub dword [ebp - 0x60], 0xbefd3720
mov dword [ebp - 0x5c], 0xf37fe59
sub dword [ebp - 0x5c], 0xcdcb9ce4
mov dword [ebp - 0x58], 0x3b10aae8
sub dword [ebp - 0x58], 0xd7a13e7c
mov dword [ebp - 0x54], 0x1b74af54
add dword [ebp - 0x54], 0xe48b50ac
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x27129c69
add eax, 0xd92e93cf
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x36580
push 0
call eax
mov ecx, 0x686607cb
add ecx, 0x979a3548
mov edi, eax
mov ebx, 0x15931816
add ebx, 0xeaae8bea
add ebx, dword [ebp - 0x50]
mov esi, 0xe09e16de
sub esi, 0x1a2f05be
xor dword [ebp - 0x10], eax
mov edx, dword [ebx]
sub dword [ebp - 8], ecx
xor edx, esi
xor dword [ebp - 4], 0x5b9a3c76
mov dword [edi], edx
add edi, 0xebf66a33
sub edi, 0xebf66a2f
add ebx, 0x60d6cf14
add ebx, 0x9f2930f0
loop 0x401a31
add eax, 0xb3ed7f48
sub eax, 0xb3ec9829
xor ebx, ebx
add ebx, eax
add eax, 0x30fbcbdd
add eax, 0xcf043428
mov ecx, 0x74888080
sub ecx, 0x74488080
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x407a60
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0
jne 0x407b30
push ebx
push esi
push str.mapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0xc
mov dword [edi + 0x18], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407ad0
xorps xmm0, xmm0
movq qword [ebx], xmm0
push str.MAPIFreeBuffer
mov dword [ebx + 8], 0
push dword [edi + 0x18]
call esi
push str.MAPIAllocateBuffer
push dword [edi + 0x18]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx + 8], esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
jmp 0x407ad2
xor ebx, ebx
push str.MAPIInitialize
push dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
call esi
push str.MAPIUninitialize
push dword [edi + 0x18]
mov dword [edi + 0x24], eax
call esi
push str.MAPILogonEx
push dword [edi + 0x18]
mov dword [edi + 0x28], eax
call esi
push str.MAPIAdminProfiles
push dword [edi + 0x18]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x24]
pop esi
pop ebx
test eax, eax
je 0x407b30
cmp dword [edi + 0x28], 0
je 0x407b30
cmp dword [edi + 0x2c], 0
je 0x407b30
push 0
call eax
mov dword [edi + 0x14], eax
test eax, eax
js 0x407b30
mov dword [edi + 0x34], 1
pop edi
ret
Function at 0x1000cac3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x100139e8]
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 8], edi
mov esi, dword [eax + esi*4]
mov eax, dword [0x10013e80]
cmp eax, dword [esi + 4]
jg 0x1000cb78
lea eax, [ebx + edi]
cmp eax, ebx
ja 0x1000cb01
mov eax, 0x10dd
jmp 0x1000cb71
mov eax, dword [0x10013e7c]
cmp edi, eax
jbe 0x1000cb0f
push 0x32
pop eax
jmp 0x1000cb71
mov edi, dword [ebp + 8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
lea esi, [eax - 1]
push ecx
not esi
push dword [edi]
and esi, ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x1000cb37
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x1000cb71
mov ecx, dword [0x10013e7c]
mov eax, dword [ebp - 8]
dec ecx
mov edx, dword [ebp - 4]
dec eax
add eax, ebx
mov dword [edi], edx
not ecx
and ecx, eax
cmp ecx, esi
je 0x1000cb6c
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
push dword [0x10013e7c]
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x1000cb2f
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, 0x10013e80
push esi
call fcn.1000cd54
cmp dword [0x10013e80], 0xffffffff
pop ecx
jne 0x1000caf3
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
push esi
mov dword [0x10013e7c], eax
call fcn.1000cd54
mov edi, dword [ebp - 8]
pop ecx
jmp 0x1000caf3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001ac6c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001acef
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 8]
push edi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x1001acb9
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001acb9
cmp edi, ebx
jge 0x1001acb9
mov eax, ebx
sub eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, edi
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ace9
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ace9
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
push 1
push dword [esi + 0x20]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 8]
mov eax, edi
pop edi
pop ebx
jmp 0x1001ad01
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR120.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x1001aedb
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100296f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100299a8], 0
mov eax, dword [ebp + 8]
je 0x1001af03
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001af1d
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1001f555
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100204a4
mov esp, ebp
pop ebp
ret 4

Function at 0x1001b0c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100296f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100299a8], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001b0fa
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001b160
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1001f555
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1001f555
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1001f555
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100204a4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001b173
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100296f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100299a8], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001b19f
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001b1d0
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001b1ce
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1001f555
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001b1d0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100204a4
mov esp, ebp
pop ebp
ret 8

Function at 0x1001f555
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1001f564
pop dword [ebp - 0x30]
mov eax, 0x1001f564
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x2018fc4f
sub dword [ebp - 0x40], 0xd1c6b704
mov dword [ebp - 0x3c], 0xd19c7ad0
sub dword [ebp - 0x3c], 0x9f692e8b
mov dword [ebp - 0x38], 0xe9274f85
add dword [ebp - 0x38], 0x6324f4a9
mov dword [ebp - 0x34], 0xfa192a66
sub dword [ebp - 0x34], 0xfa192a66
lea eax, [ebp - 0x40]
push eax
mov eax, 0xaab9f59c
sub eax, 0x9ab7d518
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xf20ff2a7
add dword [ebp - 0x40], 0x826276af
mov dword [ebp - 0x3c], 0x3d4577c1
add dword [ebp - 0x3c], 0x426e9b4
mov dword [ebp - 0x38], 0x83d56aba
sub dword [ebp - 0x38], 0x2065fe4e
mov dword [ebp - 0x34], 0xc95a32b1
sub dword [ebp - 0x34], 0xc95a32b1
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x43bb32c5
add eax, 0xcc46edb7
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3ad09
push 0
call eax
mov ecx, 0xc3ad0aeb
add ecx, 0x3c533d87
mov ebx, eax
mov edx, 0x936df9a7
add edx, 0x7c94ce59
add edx, dword [ebp - 0x30]
mov edi, 0xb05e19ee
add edi, 0x43b9810
mov esi, dword [edx]
mov dword [ebp - 0x10], 0xedc2e76f
xor esi, edi
sub dword [ebp - 4], 0xb9b69585
mov dword [ebx], esi
add dword [ebp - 0x10], edx
add ebx, 4
add edx, 0x9dbe3fe1
add edx, 0x6241c023
loop 0x1001f681
add eax, 0xcd8e582c
add eax, 0x3272bc6f
mov ebx, eax
add eax, 0xad2948a0
sub eax, 0xad29489b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret