joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029cd5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10029e24
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10029dfb
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0x537
mov dword [ebp - 0x28], 0x10009600
cmp dword [ebp - 0x18], 0x66a
jle 0x10029d9e
push 0
call dword [sym.imp.USER32.dll_DispatchMessageA]
and dword [ebp - 0x14], 0
jmp 0x10029d39
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x42f6
jge 0x10029d96
and dword [ebp - 0xc], 0
jmp 0x10029d4f
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x259a
jge 0x10029d94
and dword [ebp - 0x10], 0
jmp 0x10029d65
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x5a10
jge 0x10029d92
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
shl eax, cl
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10029d5e
jmp 0x10029d48
jmp 0x10029d32
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x18], 0x1c9
jge 0x10029dba
mov edx, dword [ebp - 0x28]
mov ecx, 0x10092b78
call fcn.10025597
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10029ddc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10029df9
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x34]
call fcn.10022bff
mov dword [eax], 1
jmp 0x10029dd1
jmp 0x10029e22
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10029e22
push 0x4700
push 0
push 0x3d1e
push 0x59a7
push 0
call fcn.1002bf40
add esp, 0x14
jmp 0x10029e32
push 0x6e34
push 0
call fcn.10026d2f
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100531f5
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1005321a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push 0
call fcn.1005e69e
pop ecx
pop ecx
jmp 0x10053353
mov dword [ebp - 0x18], 0x2848
mov dword [ebp - 0x20], 0x1000cb94
cmp dword [ebp - 0x18], 0x2b9a
jle 0x100532cc
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
and dword [ebp - 8], 0
jmp 0x10053254
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x83c
jge 0x100532cc
and dword [ebp - 0xc], 0
jmp 0x1005326a
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7788
jge 0x100532ca
and dword [ebp - 0x10], 0
jmp 0x10053280
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x5fa6
jge 0x100532c8
and dword [ebp - 0x14], 0
jmp 0x10053296
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x68b6
jge 0x100532c6
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
xor eax, ecx
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x1005328f
jmp 0x10053279
jmp 0x10053263
jmp 0x1005324d
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x18], 0x24dc
jge 0x100532e8
mov edx, dword [ebp - 0x20]
mov ecx, 0x10092b78
call fcn.10025597
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1005334b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1005332c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10053349
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.10022bff
mov dword [eax], 1
jmp 0x10053321
jmp 0x10053353
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esp, ebp
pop ebp
ret
Function at 0x10056f17
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10057033
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10057013
mov dword [ebp - 0x14], 0x33b1
mov dword [ebp - 0x1c], 0x1000d19c
cmp dword [ebp - 0x14], 0x34c5
jle 0x10056ff1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
and dword [ebp - 4], 0
jmp 0x10056f73
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x336c
jge 0x10056ff1
and dword [ebp - 8], 0
jmp 0x10056f89
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2d66
jge 0x10056fec
and dword [ebp - 0xc], 0
jmp 0x10056f9f
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2dc5
jge 0x10056fea
and dword [ebp - 0x10], 0
jmp 0x10056fb5
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x6d33
jge 0x10056fe8
mov ecx, dword [ebp - 4]
and ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 0x10]
xor ecx, edx
mov eax, ecx
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10056fae
jmp 0x10056f98
jmp 0x10056f82
jmp 0x10056f6c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [ebp - 0x14], 0x2fcc
jge 0x10057011
mov edx, dword [ebp - 0x1c]
mov ecx, 0x10092b78
call fcn.10025597
jmp 0x10057031
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10057031
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x10057071
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
push 0x44ba
push 0x6fd6
push dword [ebp - 0x2c]
push 1
push dword [ebp - 0x30]
push 0x7415
push dword [ebp - 0x34]
push 0x2903
push 0x2631
call fcn.10052a4f
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x10061c7b
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10061cdb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
push 0x7d7a
push dword [ebp - 0x1c]
push 0x8e7
push 0x5d0d
push dword [ebp - 0x20]
push 0x29f3
push 0x5003
push 0x267d
push 0x6f69
push 0xc07
push 0
push dword [ebp - 0x24]
call fcn.100628c0
add esp, 0x30
jmp 0x10061ddf
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10061d00
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10061ddf
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0x52dd
mov dword [ebp - 0x34], 0x1000e708
cmp dword [ebp - 0x14], 0x5487
jle 0x10061dab
and dword [ebp - 4], 0
jmp 0x10061d2e
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x5622
jge 0x10061dab
and dword [ebp - 8], 0
jmp 0x10061d44
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x5bff
jge 0x10061da6
and dword [ebp - 0xc], 0
jmp 0x10061d5a
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x556d
jge 0x10061da4
and dword [ebp - 0x10], 0
jmp 0x10061d70
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x7501
jge 0x10061da2
mov eax, dword [ebp - 4]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x10]
or eax, edx
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10061d69
jmp 0x10061d53
jmp 0x10061d3d
jmp 0x10061d27
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x14], 0x5296
jge 0x10061dc7
mov edx, dword [ebp - 0x34]
mov ecx, 0x10092b78
call fcn.10025597
push 2
mov ecx, dword [ebp - 0x38]
call fcn.10022bff
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10064bc5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10064c0f
push 0x9e7
push 0xb12
push 0x5ca0
push 0x18a5
push 1
push 0x18ee
push 0x2276
push 0x5bae
push 0x3417
push 0x11d8
call fcn.10064d18
add esp, 0x28
jmp 0x10064d14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10064ced
mov dword [ebp - 0x14], 0x24df
mov dword [ebp - 0x1c], 0x1000eb78
cmp dword [ebp - 0x14], 0x269c
jle 0x10064ccf
and dword [ebp - 4], 0
jmp 0x10064c57
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41ec
jge 0x10064ccf
and dword [ebp - 8], 0
jmp 0x10064c6d
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x5fd6
jge 0x10064ccd
and dword [ebp - 0xc], 0
jmp 0x10064c83
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x320b
jge 0x10064ccb
and dword [ebp - 0x10], 0
jmp 0x10064c99
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x6d7e
jge 0x10064cc9
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sar eax, cl
xor eax, dword [ebp - 0x10]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0x10092b78
call fcn.10022847
jmp 0x10064c92
jmp 0x10064c7c
jmp 0x10064c66
jmp 0x10064c50
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [ebp - 0x14], 0x2493
jge 0x10064ceb
mov edx, dword [ebp - 0x1c]
mov ecx, 0x10092b78
call fcn.10025597
jmp 0x10064d14
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret
Function at 0x10073839
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x2c], 0
push ebx
push esi
mov byte [ebp - 4], dl
mov ebx, ecx
je 0x100738e4
test dl, dl
je 0x1007387e
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10073900
mov esi, dword [ebp + 0x28]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xa8c6
inc dword [edx]
cmp dword [edx], 2
jl 0x10073867
jmp 0x10073900
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
inc esi
mov ecx, dword [edi]
mov eax, dword [ebx]
cmp dword [eax + ecx*4], 0xe1947684
jne 0x100738bd
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dword [eax], 0xfffffff8
mov eax, dword [edi]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, esi
mov eax, dword [edi]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xde45221b
setge cl
sub eax, ecx
jne 0x100738bd
xor esi, esi
mov ecx, dword [edi]
xor edx, edx
mov eax, dword [ebp + 0x10]
pop edi
mov eax, dword [eax]
sub esi, eax
mov eax, dword [ebx]
cmp dword [eax + ecx*4], esi
mov eax, dword [ebp + 0xc]
setle dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [ebp + 8]
setle cl
mov dword [eax], ecx
jmp 0x10073900
cmp byte [ebp + 0x24], 0
je 0x100738f8
mov eax, dword [ebp + 0x20]
push dword [eax + 4]
call fcn.10077a19
pop ecx
jmp 0x10073900
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10087cff
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10091750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1007af08
mov dword [ebp - 0x14], eax
cmp dword [0x10093bd4], esi
jne 0x10087df2
push 0x800
push esi
push 0x1000675c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10087d7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10087ed2
push esi
push esi
push 0x1000675c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10087ed2
push 0x10006774
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10087ed2
push eax
call ebx
push 0x10006780
push edi
mov dword [0x10093bd4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006790
push edi
mov dword [0x10093bd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100067a4
push edi
mov dword [0x10093bdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10093be4], eax
test eax, eax
je 0x10087def
push 0x100067c0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10093be0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10087e17
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10087e0a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10087e2c
push 4
pop eax
jmp 0x10087ed4
cmp dword [ebp - 0x14], esi
je 0x10087e2c
push dword [0x10093bd4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10087e11
mov eax, dword [0x10093be0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10087e8a
cmp dword [0x10093be4], edi
je 0x10087e8a
push eax
call ebx
push dword [0x10093be4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10087e8a
test eax, eax
je 0x10087e8a
call ecx
test eax, eax
je 0x10087e7f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10087e7f
test byte [ebp - 8], 1
jne 0x10087e8a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10087eba
mov eax, dword [0x10093bd8]
cmp eax, edi
je 0x10087eb7
push eax
call ebx
test eax, eax
je 0x10087eb7
call eax
mov esi, eax
test esi, esi
je 0x10087eb7
mov eax, dword [0x10093bdc]
cmp eax, edi
je 0x10087eb7
push eax
call ebx
test eax, eax
je 0x10087eb7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10093bd4]
call ebx
test eax, eax
je 0x10087ed2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10087ed4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007841a
mov esp, ebp
pop ebp
ret
Function at 0x9de210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9de25c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9de222
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9de2c0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9de312
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9de318
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9f6815
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f64d5

Function at 0x9fb60f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009fb48e

Function at 0xa00bc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa00bed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa00bed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x411014
Capabilities:
Terminate process

Disassembly:
jmp 0x412a30
jmp fcn.00413230
cmp ecx, dword [0x417014]
jne 0x412a3a
repz ret
jmp 0x411082
Function at 0x180fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x181b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.01806e52
and dword [ebp - 0x14], 0
cmp dword [0x185d558], 0
mov dword [ebp - 0x18], eax
jne 0x180fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x180fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x180fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x185d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x185d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x185d560], eax
call edi
push eax
call esi
mov dword [0x185d568], eax
test eax, eax
je 0x180fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x185d564], eax
mov eax, dword [0x185d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x180fc78
cmp dword [0x185d568], ecx
je 0x180fc78
push eax
call esi
push dword [0x185d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x180fc78
test ebx, ebx
je 0x180fc78
call edi
test eax, eax
je 0x180fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x180fc6f
test byte [ebp - 8], 1
jne 0x180fc78
or dword [ebp + 0x10], 0x200000
jmp 0x180fcab
mov eax, dword [0x185d55c]
cmp eax, dword [ebp - 0x18]
je 0x180fcab
push eax
call esi
test eax, eax
je 0x180fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x180fcab
mov eax, dword [0x185d560]
cmp eax, dword [ebp - 0x18]
je 0x180fcab
push eax
call esi
test eax, eax
je 0x180fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x185d558]
call esi
test eax, eax
je 0x180fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x180fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.018013cb
leave
ret

Function at 0x77d06d
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea esp, [esp + 0x14]
ja 0x778283
sbb al, 0x6e
sub ebx, edi
sete al
adc di, bp
add ebx, esp
test esi, edi
pushfd
dec al
mov edi, ebx
clc
not al
bt sp, sp
add al, 0x90
mov al, 0x2e
test al, ah
mov byte [esp], 0xb7
pushfd
repne scasb al, byte es:[edi]
call fcn.00777281
dec esi
xor byte [esi + 0x2a4807c7], 0x45
or eax, 0xc2f66634
jnp 0x77d08a
invalid
invalid
Function at 0x10002ca2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop eax
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10002a3f
jp 0x10002d0f
xor al, 0x8d
inc ebp
test al, 0x50
call fcn.10002a4f
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10002a04
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10002d2d
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10002a3f
sub ebp, dword [esi + 0x458d7811]
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x10003107
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10003116
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10003134
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add dword [eax], eax
add byte [ebp + 0xf8c784], cl
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10003192
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10003179
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10003182
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000318c
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000316e
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100030f8
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100031df
dec eax
je 0x100031d6
sub eax, 3
je 0x100031cd
mov dword [ebp - 4], 0x40
jmp 0x100031fc
mov dword [ebp - 4], 4
jmp 0x100031e2
mov dword [ebp - 4], 0x20
jmp 0x100031e2
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1000322e
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
invalid

Function at 0x10003127
Capabilities:
Inspect section memory permissions

Disassembly:
add dword [eax], eax
add byte [ebp + 0xf8c784], cl
add byte [eax], al