joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf010cde
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0xf229bc0], eax
mov ebx, 0xf0026dc
mov edi, 0x3e9
jne 0xf010d16
push 0xfd
push ebx
call esi
push eax
push edi
call fcn.0f03dc3f
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0xf229d78], eax
jne 0xf010d3c
push 0x107
push ebx
call esi
push eax
push edi
call fcn.0f03dc3f
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0xf229d6c], eax
jne 0xf010d61
push 0x10a
push ebx
call esi
push eax
push edi
call fcn.0f03dc3f
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0xf229d68], eax
jne 0xf010d87
push 0x10d
push ebx
call esi
push eax
push edi
call fcn.0f03dc3f
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
cmp eax, ecx
mov dword [0xf229d64], eax
jne 0xf010db0
push 0x110
push ebx
call esi
push eax
push edi
call fcn.0f03dc3f
xor ecx, ecx
cmp dword [0xf0bd814], ecx
jne 0xf010eab
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0xf229bc8], eax
jne 0xf010dde
push 0x11d
push ebx
call esi
push eax
push edi
call fcn.0f03dc3f
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0xf229bcc], eax
jne 0xf010e02
push 0x120
push ebx
call esi
push eax
push edi
call fcn.0f03dc3f
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0xf229bbc], eax
jne 0xf010e26
push 0x123
push ebx
call esi
push eax
push edi
call fcn.0f03dc3f
push 1
push 0xf043309
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0xf010e46
push 0x129
push ebx
call esi
push eax
push edi
call fcn.0f03dc3f
push 0xf232a54
push 4
push 0
push 0xf0441eb
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0xf232a50], eax
jne 0xf010e79
push 0x132
push ebx
call esi
push eax
push edi
call fcn.0f03dc3f
call fcn.0f0432ea
mov esi, 0x640
jmp 0xf010e93
push 0xf001a8a
push 3
push 7
call fcn.0f03d89e
push esi
call fcn.0f009d40
test eax, eax
pop ecx
mov dword [0xf0c2618], eax
je 0xf010e85
pop edi
pop esi
pop ebx
jmp fcn.0f042f1f
pop edi
pop esi
pop ebx
ret
Function at 0xf012648
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push 0x110
call fcn.0f009d40
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 4], edi
je 0xf01271e
push esi
push edi
mov esi, 0x104
push esi
call fcn.0f094585
test eax, eax
je 0xf012710
cmp eax, esi
jae 0xf012710
push 0x111
call fcn.0f009d40
test eax, eax
pop ecx
mov dword [ebp - 8], eax
je 0xf012710
push ebx
push eax
push 0
mov ebx, 0xf006f04
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call edi
test eax, eax
jne 0xf0126d4
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0xf0126c1
cmp eax, esi
jb 0xf0126c9
mov eax, dword [ebp - 4]
mov word [eax], 0x5c
push dword [ebp - 8]
push 0
push ebx
push dword [ebp - 4]
call edi
mov edi, dword [ebp - 8]
and dword [ebp - 0x10], 0
push 0
push 0x100
push 4
lea eax, [ebp - 0x14]
push eax
push 3
xor esi, esi
push 0xc0000000
inc esi
push edi
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
pop ebx
jne 0xf012723
push edi
call fcn.0f008a60
pop ecx
xor esi, esi
push dword [ebp - 4]
call fcn.0f008a60
pop ecx
mov eax, esi
pop esi
pop edi
leave
ret 8
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
jmp 0xf012712
Function at 0xf01320d
Capabilities:
Get disk information

Disassembly:
push 0x48
push 0xf007100
call fcn.0f0213c8
mov edi, dword fs:[0x18]
add edi, 0xbf8
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
jne 0xf013234
mov eax, 0xf0070fc
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push esi
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
cmp eax, esi
jge 0xf013270
cmp eax, 0x80000005
jne 0xf01325d
push 0xce
jmp 0xf013265
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0xf013394
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x36], si
mov word [ebp - 0x3e], si
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c], ecx
mov ebx, dword [ebp + 0x10]
lea eax, [ebx + 1]
mov word [ebp - 0x4e], ax
mov edx, dword [ebp + 0x20]
mov dword [ebp - 0x44], edx
mov edx, dword [ebp + 0x24]
inc edx
mov word [ebp - 0x46], dx
mov dword [ebp - 4], esi
cmp ecx, esi
je 0xf0132d5
movzx eax, ax
shl eax, 1
mov word [ebp - 0x36], ax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x24], ecx
movzx eax, ax
push eax
push esi
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x34], eax
cmp eax, esi
jne 0xf0132d5
push 8
jmp 0xf013381
cmp dword [ebp + 0x20], esi
je 0xf013306
movzx eax, word [ebp - 0x46]
shl eax, 1
mov word [ebp - 0x3e], ax
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x28], ecx
movzx eax, ax
push eax
push esi
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x3c], eax
cmp eax, esi
je 0xf0132ce
push dword [ebp + 0x24]
push dword [ebp - 0x3c]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push dword [ebp - 0x34]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0xf013398
cmp dword [ebp + 0xc], esi
je 0xf013351
push dword [ebp - 0x34]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push esi
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
mov dword [ebp - 0x1c], eax
cmp eax, esi
jl 0xf013379
cmp dword [ebp + 0x20], esi
je 0xf013398
push dword [ebp - 0x3c]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToOemString]
mov dword [ebp - 0x1c], eax
cmp eax, esi
jge 0xf013398
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.0f01e9c6
pop ecx
pop ecx
xor eax, eax
jmp 0xf0133a4
or dword [ebp - 4], 0xffffffff
call fcn.0f0133ae
mov eax, dword [ebp - 0x20]
call fcn.0f021403
ret 0x20
Function at 0xf014419
Capabilities:
Resume thread

Disassembly:
cmp dword [0xf0c2418], 0
je 0xf014438
mov dword [0xf22a630], 2
mov dword [0xf0c2398], 1
jmp 0xf014448
call fcn.0f011801
push dword [0xf22a69c]
call fcn.0f00c35d
push dword [0xf232a48]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call fcn.0f0077f5
cmp dword [0xf22a630], 1
jne 0xf014466
push 0
jmp 0xf014468
push 1
call fcn.0f0128bb
jmp 0xf019f84
mov edi, edi
push esi
xor esi, esi
cmp dword [0xf0bd804], esi
jne 0xf019fab
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push esi
mov dword [0xf0bd808], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0xf0bd804], eax
pop esi
ret

Function at 0xf0147ae
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
mov esi, dword fs:[0x18]
add esi, 0xbf8
test eax, eax
jne 0xf0147cf
mov eax, 0xf0070fc
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push 0
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlOemStringToUnicodeString]
test eax, eax
jge 0xf01480c
cmp eax, 0x80000005
jne 0xf0147f9
push 0xce
jmp 0xf014801
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc eax
jmp 0xf014843
mov eax, dword fs:[0x18]
cmp dword [eax + 0xf18], 0
push dword [esi + 4]
je 0xf01483d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf18]
mov eax, dword [eax + 0x670]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
call dword [eax + 0x11c]
jmp 0xf014843
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
pop esi
leave
ret 4
Function at 0xf015150
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1f4
mov eax, dword [0xf0ad034]
push ebx
push esi
push edi
mov esi, 0xf0026bc
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
add byte [ebp - 8], al
movzx edi, al
mov esi, edi
imul esi, esi, 0x12c
add esi, 0xf229da0
or dword [esi], 0xffffffff
lea eax, [ebp - 0xc]
lea ecx, [esi + 0x25]
mov edx, eax
sub ecx, edx
xor ebx, ebx
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
cmp dl, bl
jne 0xf015198
push dword [ebp + 8]
mov word [esi + 4], bx
call fcn.0f014d86
cmp eax, ebx
mov dword [esi], eax
je 0xf015293
push 0x11
push 4
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jge 0xf0151da
push esi
call fcn.0f014e2c
jmp 0xf015293
mov eax, dword [ebp - 0xc]
cmp eax, dword [0xf0c252c]
mov dword [esi + 0x1c], eax
jbe 0xf0151ed
mov dword [0xf0c252c], eax
push 0x1e0
lea eax, [ebp - 0x1f4]
push eax
push ebx
push ebx
push 0x70c00
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push dword [esi]
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
push esi
jl 0xf0151d0
call fcn.0f014e2c
mov eax, dword [ebp - 0x10]
push 0x18
xor edx, edx
pop ecx
div ecx
cmp eax, ebx
je 0xf01528d
lea edx, [eax + eax*2]
lea edx, [ebp + edx*8 - 0x204]
mov ecx, dword [edx]
dec ecx
je 0xf015281
dec ecx
je 0xf015272
dec ecx
je 0xf01526a
dec ecx
dec ecx
je 0xf015252
dec ecx
jne 0xf015287
cmp word [esi + 4], 2
je 0xf015287
mov word [esi + 4], 1
jmp 0xf015287
mov cx, word [esi + 4]
cmp cx, 4
je 0xf015287
cmp cx, 5
je 0xf015287
mov word [esi + 4], 3
jmp 0xf015287
mov word [esi + 4], 5
jmp 0xf015287
cmp word [esi + 4], 5
je 0xf015287
mov word [esi + 4], 4
jmp 0xf015287
mov word [esi + 4], 2
sub edx, 0x18
dec eax
jne 0xf015231
cmp word [esi + 4], bx
jne 0xf015297
xor eax, eax
jmp 0xf0152fa
mov eax, edi
imul eax, eax, 0x1c
mov dword [eax + 0xf229580], 0xf00fbe9
mov dword [eax + 0xf229584], 0xf041ee4
mov dword [eax + 0xf229588], 0xf041f18
mov dword [eax + 0xf22958c], 0xf01b090
mov dword [eax + 0xf229590], 0xf01530e
mov dword [eax + 0xf229594], 0xf010a71
mov dword [eax + 0xf229598], 0xf042101
xor eax, eax
mov byte [esi + 0x22], bl
mov byte [esi + 0x21], bl
mov byte [esi + 0x23], 1
mov byte [esi + 0x24], 2
mov byte [esi + 0xd], bl
mov word [esi + 0xe], bx
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0f01dda0
leave
ret 4
Function at 0xf01733a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0xf0ad034]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x430], ebx
call fcn.0f03a1d3
lea eax, [ebp - 0x418]
push 0xf0016c0
push eax
call fcn.0f01def0
lea eax, [ebp - 0x418]
push eax
call fcn.0f01deb0
shl eax, 1
lea esi, [ebp + eax - 0x416]
push 0xf0016b8
push esi
mov dword [ebp - 0x41c], eax
call fcn.0f01def0
push esi
call fcn.0f01deb0
shl eax, 1
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x42c]
add esp, 0x18
sub esi, eax
push eax
mov dword [ebp - 0x424], esi
call fcn.0f01dac9
lea eax, [ebp - 0x418]
push 0xf00169c
push eax
call fcn.0f01def0
lea eax, [ebp - 0x418]
push eax
call fcn.0f01deb0
shl eax, 1
lea esi, [ebp + eax - 0x416]
push 0xf00168c
push esi
mov dword [ebp - 0x41c], eax
call fcn.0f01def0
push esi
call fcn.0f01deb0
shl eax, 1
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x42c]
add esp, 0x18
sub esi, eax
push eax
mov dword [ebp - 0x424], esi
call fcn.0f01dac9
push 0xf001610
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x454]
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x44c]
push eax
push 0x20019
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x44c], 0x18
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x440], 0x40
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0xf0174bf
mov esi, dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
push edi
mov edi, 0x428
jmp 0xf017494
lea eax, [ebp - 0x42c]
push eax
call fcn.0f01dac9
test al, al
je 0xf0174b2
inc ebx
lea eax, [ebp - 0x434]
push eax
push edi
lea eax, [ebp - 0x42c]
push eax
push 1
push ebx
push dword [ebp - 0x430]
call esi
test eax, eax
jge 0xf017483
push dword [ebp - 0x430]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0f01dda0
leave
ret
Function at 0xf01c3d1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0xf0ad034]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
xor eax, eax
inc eax
lea ecx, [ebp - 0x20]
push ecx
push eax
xor ebx, ebx
push ebx
push 0xf007064
push 0x80000002
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf01c4bf
push edi
push 0x5c
push esi
call fcn.0f09a8a0
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0xf01c431
mov edi, esi
jmp 0xf01c432
inc edi
push 0x2e
push edi
call fcn.0f09a670
cmp eax, ebx
pop ecx
pop ecx
jne 0xf01c451
push 9
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.0f01f720
mov byte [ebp - 8], bl
jmp 0xf01c46b
sub eax, edi
cmp ax, 8
jg 0xf01c4be
movsx esi, ax
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.0f01f720
mov byte [ebp + esi - 0x10], bl
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf01c4be
cmp dword [ebp - 0x2c], 1
jne 0xf01c4be
lea eax, [ebp - 0x1c]
push eax
call fcn.0f09bf40
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push 0xf00705c
push eax
call fcn.0f09b0c0
add esp, 0x10
cmp eax, 1
jne 0xf01c4be
test byte [ebp - 0x25], 8
je 0xf01c4be
mov dword [ebp - 0x24], ebx
pop edi
cmp dword [ebp - 0x20], ebx
pop esi
pop ebx
je 0xf01c4cf
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
call fcn.0f01dda0
leave
ret 4
Function at 0xf01da9a
Capabilities:
Check processdebugport

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0
push 4
lea eax, [ebp - 4]
push eax
push 7
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jl 0xf01dac2
cmp dword [ebp - 4], 0
je 0xf01dac2
call dword [sym.imp.KERNEL32.dll_DebugBreak]
leave
ret

Function at 0xf01dda0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0xf0ad034]
jne 0xf01dda9
ret
jmp fcn.0f01ddc0

Function at 0xf01e130
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0xf0b61a4], 1
jne 0xf01e150
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0xf0b61a0], 1
mov cl, byte [ebp + 0x10]
mov byte [0xf0b619c], cl
cmp dword [ebp + 0xc], 0
jne 0xf01e1b0
cmp dword [0xf207704], 0
je 0xf01e19e
mov edx, dword [0xf207700]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [0xf207704]
jb 0xf01e19e
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0xf01e19c
mov eax, dword [ebp - 4]
call dword [eax]
jmp 0xf01e17b
push 0xf0ad020
push 0xf0ad018
call fcn.0f01e1f0
add esp, 8
push 0xf0ad028
push 0xf0ad024
call fcn.0f01e1f0
add esp, 8
cmp dword [ebp + 0x10], 0
je 0xf01e1ca
jmp 0xf01e1de
mov dword [0xf0b61a4], 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0xf01ead0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1bc
mov dword [ebp - 4], 0
jmp 0xf01eaed
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x11
jae 0xf01eb06
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx*8 + 0xf0ad460]
jne 0xf01eb04
jmp 0xf01eb06
jmp 0xf01eae4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax*8 + 0xf0ad460]
jne 0xf01ec97
cmp dword [0xf0b6154], 1
je 0xf01eb34
cmp dword [0xf0b6154], 0
jne 0xf01eb95
cmp dword [0xf0ad03c], 1
jne 0xf01eb95
mov edx, dword [0xf207600]
cmp dword [edx + 0x10], 0xffffffff
je 0xf01eb50
mov eax, dword [0xf207600]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x1bc], ecx
jmp 0xf01eb5e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x1bc], eax
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0xf0ad464]
push ecx
call fcn.0f01f470
add esp, 4
push eax
mov edx, dword [ebp - 4]
mov eax, dword [edx*8 + 0xf0ad464]
push eax
mov ecx, dword [ebp - 0x1bc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0xf01ec97
cmp dword [ebp + 8], 0xfc
je 0xf01ec97
push 0x104
lea edx, [ebp - 0x1b8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0xf01ebce
push 0xf0019dc
lea eax, [ebp - 0x1b8]
push eax
call fcn.0f01f370
add esp, 8
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0xac]
push edx
call fcn.0f01f470
add esp, 4
add eax, 1
cmp eax, 0x3c
jbe 0xf01ec26
lea eax, [ebp - 0x1b8]
push eax
call fcn.0f01f470
add esp, 4
mov ecx, dword [ebp - 0xac]
lea edx, [ecx + eax - 0x3b]
mov dword [ebp - 0xac], edx
push 3
push 0xf0019d8
mov eax, dword [ebp - 0xac]
push eax
call fcn.0f01f720
add esp, 0xc
push 0xf0019bc
lea ecx, [ebp - 0xa8]
push ecx
call fcn.0f01f370
add esp, 8
mov edx, dword [ebp - 0xac]
push edx
lea eax, [ebp - 0xa8]
push eax
call fcn.0f01f380
add esp, 8
push 0xf0019b8
lea ecx, [ebp - 0xa8]
push ecx
call fcn.0f01f380
add esp, 8
mov edx, dword [ebp - 4]
mov eax, dword [edx*8 + 0xf0ad464]
push eax
lea ecx, [ebp - 0xa8]
push ecx
call fcn.0f01f380
add esp, 8
push 0x12010
push 0xf001990
lea edx, [ebp - 0xa8]
push edx
call fcn.0f01f650
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0xf02a185
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x449
call fcn.0f05c1a9
cmp al, 0x11
jne 0xf02a19e
or dword [ebp + 0x10], 0xffffffff
jmp 0xf02a1ae
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov eax, dword [eax*4 + 0xf0ae980]
mov dword [ebp + 0x10], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x485
call fcn.0f05c1a9
mov ebx, dword [ebp + 0x14]
cmp ebx, 1
mov ecx, dword [ebp + 0xc]
mov edx, dword [0xf208b60]
movzx eax, al
lea esi, [edx + ecx*4]
jne 0xf02a208
test eax, eax
jbe 0xf02a24b
mov ebx, dword [ebp + 0x18]
shl ebx, 2
mov dword [ebp + 0x18], eax
push edi
call fcn.0f05c1a9
movzx eax, al
mov ecx, eax
shl ecx, 8
or eax, ecx
mov ecx, eax
shl ecx, 0x10
or ecx, eax
and ecx, dword [ebp + 0x10]
inc edi
xor dword [esi], ecx
add esi, ebx
dec dword [ebp + 0x18]
jne 0xf02a1e2
jmp 0xf02a24b
mov ecx, dword [ebp + 0x18]
sub ecx, ebx
test eax, eax
jbe 0xf02a24b
shl ecx, 2
mov dword [ebp + 8], ecx
mov dword [ebp + 0x18], eax
push edi
call fcn.0f05c1a9
movzx ecx, al
mov eax, ecx
shl eax, 8
or ecx, eax
mov eax, ecx
shl eax, 0x10
or eax, ecx
and eax, dword [ebp + 0x10]
inc edi
test ebx, ebx
jbe 0xf02a243
mov ecx, ebx
xor dword [esi], eax
add esi, 4
dec ecx
jne 0xf02a23b
add esi, dword [ebp + 8]
dec dword [ebp + 0x18]
jne 0xf02a21a
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0xf02d858
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
mov eax, dword [ebp + 8]
mov esi, edx
push edi
lea eax, [esi + eax - 1]
push eax
push esi
mov edi, ecx
call dword [0xf0adc14]
call dword [0xf0b3f18]
mov dword [ebp - 4], eax
xor eax, eax
inc eax
cmp dword [ebp + 0xc], eax
jne 0xf02d8fd
test ebx, ebx
jne 0xf02d891
add edi, dword [ebp + 0x10]
add esi, dword [ebp + 0x10]
mov ecx, edi
mov edx, esi
and ecx, eax
and edx, eax
test ebx, ebx
je 0xf02d8b5
xor ebx, ebx
test ecx, ecx
setne bl
xor eax, eax
test edx, edx
setne al
lea ebx, [ebx + ebx + 1]
lea eax, [eax + eax + 1]
jmp 0xf02d8cb
xor ebx, ebx
test ecx, ecx
setne bl
xor eax, eax
test edx, edx
setne al
lea ebx, [ebx + ebx - 3]
lea eax, [eax + eax - 3]
and edi, 0xfffffffe
and esi, 0xfffffffe
shl edi, 1
or edi, ecx
mov ecx, dword [ebp + 8]
shl esi, 1
or esi, edx
test ecx, ecx
je 0xf02d94d
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp - 4]
mov dl, byte [edi + ecx]
mov byte [esi + ecx], dl
add esi, eax
add edi, ebx
xor eax, 2
xor ebx, 2
dec dword [ebp + 0x10]
jne 0xf02d8e3
jmp 0xf02d94d
test ebx, ebx
jne 0xf02d907
add esi, dword [ebp + 0x10]
add edi, dword [ebp + 0x10]
mov ecx, esi
and ecx, eax
xor edx, edx
test ebx, ebx
je 0xf02d91f
test ecx, ecx
setne dl
mov dword [ebp + 0x10], eax
lea edx, [edx + edx + 1]
jmp 0xf02d92c
or dword [ebp + 0x10], 0xffffffff
test ecx, ecx
setne dl
lea edx, [edx + edx - 3]
and esi, 0xfffffffe
shl esi, 1
or esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0xf02d94d
mov al, byte [edi]
mov ebx, dword [ebp - 4]
add edi, dword [ebp + 0x10]
mov byte [esi + ebx], al
add esi, edx
xor edx, 2
dec ecx
jne 0xf02d93a
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0xf02e653
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
xor ebx, esi
test bl, 1
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
je 0xf02e671
inc eax
inc ecx
mov dword [ebp - 4], eax
dec edi
mov eax, ecx
and eax, 0xfffffffe
and ecx, 1
shl eax, 1
xor ebx, ebx
or eax, ecx
inc ebx
mov ecx, esi
shl ebx, cl
test dword [0xf208ba0], ebx
je 0xf02e6f7
test edi, edi
mov cl, byte [esi + 0xf208ba4]
mov byte [ebp + 8], cl
jle 0xf02e778
add eax, edx
dec edi
shr edi, 1
mov dword [ebp - 4], eax
inc edi
call dword [0xf233180]
mov dword [0xf208854], eax
call dword [0xf233180]
mov dword [0xf208854], eax
call dword [0xf0b3f28]
mov ebx, eax
and bl, byte [ebp + 8]
call dword [0xf0b3f2c]
xor bl, al
and bl, byte [esi + 0xf208854]
call dword [0xf0b3f30]
xor al, byte [esi + 0xf208854]
and al, byte [ebp + 8]
or bl, al
mov eax, dword [ebp - 4]
add dword [ebp - 4], 4
dec edi
mov byte [eax], bl
jne 0xf02e6a6
jmp 0xf02e778
test edi, edi
jle 0xf02e778
add eax, edx
dec edi
shr edi, 1
mov dword [ebp - 8], eax
inc edi
mov eax, dword [ebp - 4]
mov al, byte [eax]
add dword [ebp - 4], 2
mov byte [ebp + 8], al
call dword [0xf0b3f80]
test eax, eax
jbe 0xf02e72c
call dword [0xf0b3f80]
push eax
push dword [ebp + 8]
call fcn.0f02d6ff
mov byte [ebp + 8], al
call dword [0xf233180]
mov dword [0xf208854], eax
call dword [0xf233180]
mov dword [0xf208854], eax
call dword [0xf0b3f28]
mov ebx, eax
and bl, byte [ebp + 8]
call dword [0xf0b3f2c]
xor bl, al
and bl, byte [esi + 0xf208854]
call dword [0xf0b3f30]
xor al, byte [esi + 0xf208854]
and al, byte [ebp + 8]
or bl, al
mov eax, dword [ebp - 8]
add dword [ebp - 8], 4
dec edi
mov byte [eax], bl
jne 0xf02e704
pop edi
pop ebx
leave
ret 4