joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec078
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [0xd5afcc]
mov ebx, ecx
mov eax, dword [esi]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x4ec121
push edi
mov edi, 0x4cd
lea ecx, [edi - 0x4cd]
cmp ecx, 0xc
jge 0x4ec120
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, dword [eax]
cmp dword [eax - 0xc], 2
jne 0x4ec107
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 4]
push edi
push dword [ebx + 4]
mov esi, dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
push 0
call fcn.0041b064
mov edx, dword [ebx + 0x30]
mov cl, al
call fcn.00421b83
test eax, eax
je 0x4ec101
push 1
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov esi, dword [0xd5afcc]
push ecx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
call fcn.0040fc9f
mov eax, dword [ebp - 8]
inc edi
cmp eax, esi
jne 0x4ec09a
pop edi
mov eax, dword [ebp + 0x14]
pop esi
pop ebx
and dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4f4587
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x51a324
push str.FlsAlloc
push 0
call fcn.004f4500
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4f45b9
push dword [ebp + 8]
mov ecx, esi
call fcn.004f07f8
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x4f45fb
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x51a348
push str.FlsGetValue
push 2
call fcn.004f4500
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x4f462c
mov ecx, esi
call fcn.004f07f8
call esi
jmp 0x4f4632
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x4f4635
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x51a35c
push str.FlsSetValue
push 3
call fcn.004f4500
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x4f4669
mov ecx, esi
call fcn.004f07f8
call esi
jmp 0x4f466f
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x503052
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00502ed1
Function at 0x4029d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x417010]
mov dword [ebp - 8], eax

Function at 0x403278
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x419034], 0
je 0x4032d9
cmp word [0x419208], 0xd7b2
jne 0x4032a1
cmp dword [0x419210], 0
jbe 0x4032a1
mov eax, 0x419204
call dword [0x419220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x417050
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403300
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41701c], 0
jne 0x4032f5
push 0
push 0x417070
push 0x417050
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x10008740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x10008790
cmp edi, esi
jb 0x100087fb
cmp edi, dword [ebp + 0x10]
ja 0x10008809
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x10008792
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x10008780
jmp 0x100087ef
ja 0x10008799
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x10008755
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x100087d0
mov ebx, esi
sub ecx, edx
jns 0x100087e7
jmp 0x100087f1
cmp esi, edi
je 0x10008818
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x100087f1
xor al, 1
cmp ebx, edi
jne 0x100087b0
jmp 0x100087f1
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x1011b7ac
call fcn.1010d350
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x1011b7ac
call fcn.1010d040
mov ecx, 0x1011b79c
call fcn.1010d3b0
int3

Function at 0x10009010
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov ebx, edx
mov esi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov byte [esp + 0x1c], 0x30
mov dword [esp + 0x18], 0x30303030
mov dword [esp + 0x14], 0x30303030
mov dword [esp + 8], ebx
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], edx
call fcn.10009057
Function at 0x1001a4b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov dword [esp], ecx
test edi, edi
je 0x1001a503
mov ebx, dword [esp + 0x20]
mov ebp, dword [edx]
mov esi, dword [sym.imp.ws2_32.dll_send]
nop
cmp edi, 0x7fffffff
mov eax, 0x7fffffff
cmovb eax, edi
push 0
push eax
push ebx
push dword [ebp]
call esi
cmp eax, 0xffffffff
je 0x1001a50b
test eax, eax
mov byte [esp + 4], 4
mov dword [esp + 8], eax
je 0x1001a52c
cmp edi, eax
jb 0x1001a544
add ebx, eax
sub edi, eax
jne 0x1001a4d0
mov eax, dword [esp]
mov byte [eax], 4
jmp 0x1001a53c
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov byte [esp + 7], 0
mov word [esp + 5], 0
mov byte [esp + 4], 0
mov dword [esp + 8], eax
lea eax, [esp + 4]
jmp 0x1001a531
mov eax, 0x1018be90
mov ecx, dword [esp]
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, eax
mov edx, edi
push 0x1011ff10
call fcn.1010cf80
int3
Function at 0x10061850
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, edx
mov eax, edx
mov dword [esp + 8], edx
shr ecx, 1
shl eax, 4
mov dword [esp + 0xc], ecx
shl ecx, 4
lea ebp, [esi + eax - 0x10]
lea ebx, [esi + ecx]
lea edi, [esi + ecx - 0x10]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], ecx
lea ecx, [ecx + eax - 0x10]
nop word cs:[eax + eax]
nop
mov eax, dword [ebx + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 8]
mov dword [esp], edi
mov edi, esi
mov dword [esp + 0x14], ebp
mov ebp, ebx
mov esi, eax
sub esi, ecx
cmovb ecx, eax
push ecx
push dword [edi + 4]
push dword [ebx + 4]
call fcn.10100b6a
add esp, 0xc
test eax, eax
cmovne esi, eax
movzx eax, byte [ebx + 0xc]
xor ecx, ecx
sub al, byte [edi + 0xc]
cmp al, 0xff
sete cl
xor eax, eax
test esi, esi
sets al
cmove eax, ecx
mov ecx, edi
test al, al
cmovne ecx, ebx
movzx ebx, al
xor al, 1
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov ecx, dword [esp + 4]
shl ebx, 4
movzx esi, al
add ebx, ebp
mov ebp, dword [esp + 0x14]
shl esi, 4
add esi, edi
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
add ecx, 0x10
mov dword [esp + 4], ecx
mov ecx, dword [esp]
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov edi, eax
sub edi, ecx
cmovb ecx, eax
push ecx
mov eax, dword [esp + 4]
push dword [eax + 4]
push dword [ebp + 4]
call fcn.10100b6a
add esp, 0xc
test eax, eax
mov ecx, dword [esp]
cmovne edi, eax
movzx eax, byte [ebp + 0xc]
sub al, byte [ecx + 0xc]
xor ecx, ecx
cmp al, 0xff
sete cl
xor eax, eax
test edi, edi
mov edi, dword [esp]
sets al
cmove eax, ecx
mov ecx, ebp
test al, al
movzx eax, al
cmovne ecx, edi
shl eax, 4
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov ecx, dword [esp + 0x10]
sub edi, eax
lea ebp, [eax + ebp - 0x10]
movsd qword [ecx + 8], xmm1
movsd qword [ecx], xmm0
add ecx, 0xfffffff0
dec dword [esp + 0xc]
jne 0x10061890
add edi, 0x10
test byte [esp + 8], 1
je 0x100619c9
xor eax, eax
xor ecx, ecx
cmp esi, edi
mov edx, ebx
cmovb edx, esi
setae al
setb cl
movsd xmm0, qword [edx]
movsd xmm1, qword [edx + 8]
mov edx, dword [esp + 4]
shl ecx, 4
shl eax, 4
add esi, ecx
add ebx, eax
movsd qword [edx + 8], xmm1
movsd qword [edx], xmm0
cmp esi, edi
jne 0x100619dc
add ebp, 0x10
cmp ebx, ebp
jne 0x100619dc
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.100089e0
int3
Function at 0x100619f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov esi, edx
cmp edi, 8
jb 0x10061a55
shr edi, 3
mov ebp, edi
imul ebx, edi, 0x70
shl ebp, 6
lea eax, [ecx + ebx]
lea edx, [ecx + ebp]
push edi
push eax
call fcn.100619f0
add esp, 8
mov dword [esp + 4], eax
lea eax, [esi + ebx]
mov ecx, esi
lea edx, [esi + ebp]
push edi
push eax
call fcn.100619f0
add esp, 8
mov ecx, dword [esp + 0x34]
mov dword [esp + 0xc], eax
add ebp, ecx
add ebx, ecx
mov edx, ebp
push edi
push ebx
call fcn.100619f0
mov ecx, dword [esp + 0xc]
add esp, 8
jmp 0x10061a59
mov dword [esp + 0xc], esi
mov ebp, dword [esp + 0xc]
mov esi, dword [ecx + 8]
mov dword [esp + 8], eax
mov edx, dword [ecx + 4]
mov dword [esp + 4], ecx
mov eax, dword [ebp + 8]
mov edi, esi
mov ecx, dword [ebp + 4]
mov dword [esp + 0x1c], edx
sub edi, eax
mov dword [esp + 0x14], eax
cmovb eax, esi
push eax
mov dword [esp + 0x1c], ecx
push ecx
push edx
call fcn.10100b6a
add esp, 0xc
test eax, eax
cmovne edi, eax
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0xc]
movzx eax, byte [ebp + 0xc]
mov ebp, esi
mov byte [esp + 3], cl
sub cl, al
mov byte [esp + 2], al
xor eax, eax
cmp cl, 0xff
sete al
xor ebx, ebx
test edi, edi
sets bl
cmove ebx, eax
mov eax, dword [esp + 8]
mov edi, dword [eax + 8]
mov ecx, dword [eax + 4]
sub ebp, edi
cmovae esi, edi
push esi
mov dword [esp + 0x14], ecx
push ecx
push dword [esp + 0x24]
call fcn.10100b6a
add esp, 0xc
test eax, eax
movzx ecx, byte [esp + 3]
cmovne ebp, eax
mov eax, dword [esp + 8]
movzx edx, byte [eax + 0xc]
xor eax, eax
sub cl, dl
cmp cl, 0xff
sete al
xor ecx, ecx
test ebp, ebp
sets cl
cmove ecx, eax
mov eax, dword [esp + 4]
cmp bl, cl
jne 0x10061b57
mov eax, dword [esp + 0x14]
mov ebp, ebx
mov esi, eax
sub esi, edi
cmovb edi, eax
push edi
push dword [esp + 0x14]
push dword [esp + 0x20]
mov ebx, edx
call fcn.10100b6a
add esp, 0xc
test eax, eax
cmovne esi, eax
movzx eax, byte [esp + 2]
xor ecx, ecx
sub al, bl
cmp al, 0xff
sete cl
xor eax, eax
test esi, esi
sets al
cmove eax, ecx
mov ecx, ebp
xor cl, al
mov eax, dword [esp + 0xc]
cmovne eax, dword [esp + 8]
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1008e6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov edi, edx
mov esi, ecx
cmp ebx, 8
jb 0x1008e73d
mov dword [esp + 4], edi
mov edi, ebx
and ebx, 0xfffffff8
mov ecx, esi
shr edi, 3
lea edx, [esi + ebx]
mov ebp, edi
shl ebp, 4
sub ebp, edi
sub ebp, edi
lea eax, [esi + ebp]
push edi
push eax
call fcn.1008e6d0
add esp, 8
mov ecx, dword [esp + 4]
mov esi, eax
lea edx, [ecx + ebx]
lea eax, [ecx + ebp]
push edi
push eax
call fcn.1008e6d0
add esp, 8
mov ecx, dword [esp + 0x1c]
add ebx, ecx
add ebp, ecx
mov edx, ebx
push edi
mov edi, eax
push ebp
call fcn.1008e6d0
add esp, 8
mov ebp, eax
movzx eax, byte [esi + 1]
movzx ecx, byte [edi + 1]
movzx edx, byte [edi]
mov ah, byte [esi]
xor ebx, ebx
cmp al, cl
mov byte [esp + 2], cl
mov byte [esp + 4], al
mov byte [esp + 3], dl
mov al, byte [ebp]
setb bl
xor ecx, ecx
cmp ah, dl
setb cl
cmove ecx, ebx
movzx ebx, byte [ebp + 1]
xor edx, edx
cmp byte [esp + 4], bl
mov byte [esp + 1], bl
mov byte [esp + 4], al
setb dl
xor ebx, ebx
cmp ah, al
setb bl
cmove ebx, edx
cmp cl, bl
jne 0x1008e7b3
movzx edx, byte [esp + 1]
xor eax, eax
movzx ebx, byte [esp + 4]
cmp byte [esp + 2], dl
setb al
xor edx, edx
cmp byte [esp + 3], bl
setb dl
cmove edx, eax
xor cl, dl
cmovne edi, ebp
mov esi, edi
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100dbcb0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
xorps xmm0, xmm0
mov esi, edx
mov edi, ecx
mov ebp, esp
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
push 2
push 0x20
push ebp
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x100dbcec
mov ebx, eax
push 0x20
push ebp
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x100dbd35
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [edi], xmm0
xorps xmm0, xmm0
movups xmmword [edi + 0x10], xmm1
movsd qword [edi + 0x20], xmm0
movsd qword [edi + 0x28], xmm0
mov dword [edi + 0x40], 0
mov ecx, 0xffffff00
mov edx, esi
mov eax, dword [edi + 0x34]
add ecx, dword [edi + 0x30]
adc eax, 0xffffffff
mov dword [edi + 0x38], ecx
mov ecx, edi
mov dword [edi + 0x3c], eax
call fcn.100c9f30
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [0x10199148]
xor ecx, ecx
mov edx, 4
call fcn.100ea7d0
test eax, eax
je 0x100dbd65
and ebx, 0x7fffffff
mov dword [eax], ebx
push eax
push 0
push dword [0x101990e0]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x100dbd09
mov ecx, 4
mov edx, 4
call fcn.1010cb80
int3
Function at 0x100df3b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x103
lea edx, [ebp - 0x18]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x100df402
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x18]
cmp eax, 0x103
je 0x100df423
test eax, eax
js 0x100df40d
mov eax, dword [ebp - 0x14]
mov bl, 4
jmp 0x100df416
xor ebx, ebx
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov byte [esi], bl
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x10]
mov dword [ebp - 0x38], 0x1018c8e0
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0
lea esi, [ebp - 0x40]
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], 0
mov ecx, esi
push eax
call fcn.100de9a0
add esp, 4
mov ecx, esi
call fcn.100deb30
mov ecx, 7
int 0x29
ud2
Function at 0x100e1d40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100ff2c0
mov dword [ebp - 0x2c], ecx
mov edi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 0
cmp edi, 0x201
jae 0x100e1dd0
jmp 0x100e1dbe
jbe 0x100e1e54
cmp edi, 0x201
jae 0x100e1dd0
mov dword [ebp - 0x34], 0x200
lea ebx, [ebp - 0x448]
mov esi, edi
jmp 0x100e1e01
mov esi, dword [ebp - 0x38]
sub edi, esi
je 0x100e1df5
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
mov edx, esi
push edi
call fcn.10114960
add esp, 4
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x100e1e24
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x100e1eb5
cmp edi, esi
jne 0x100e1db0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x100e1ed2
lea edi, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x100e1dbe
jmp 0x100e1dd0
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x10], 0
cmp edi, edx
ja 0x100e1ef2
lea ecx, [ebp - 0x48]
mov edx, ebx
push edi
call fcn.100e2810
add esp, 4
movsd xmm0, qword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x40]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
cmp dword [ebp - 0x28], 0
je 0x100e1ea1
push dword [ebp - 0x24]
push 0
push dword [0x101990e0]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
cmp dword [ebp - 0x28], 0
jne 0x100e1e90
jmp 0x100e1ea1
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_codeC:Users_runneradmin_.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.1.10_srcdense.rs
mov edx, 0x28
push 0x1018cdf0
call fcn.1010d0a0
add esp, 4
jmp 0x100e1f01
mov ecx, edi
push 0x1018cde0
call fcn.1010d040
add esp, 4
ud2
Function at 0x100e3a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [ebp - 0x14], ecx
mov ecx, edx
mov edi, edx
call fcn.100e3b40
mov edx, dword [edi + 4]
cmp eax, edx
ja 0x100e3b2b
mov ecx, dword [edi]
mov ebx, ecx
lea esi, [ecx + eax]
movzx ecx, byte [edi + 8]
mov edi, eax
sub edi, edx
mov byte [ebp - 0xd], cl
jne 0x100e3a57
mov ebx, dword [ebp - 0x14]
xor edi, edi
movzx ecx, byte [ebp - 0xd]
sub edx, eax
jne 0x100e3ad3
jmp 0x100e3ab1
cmp cl, 3
mov dword [ebp - 0x18], esi
jae 0x100e3a7f
mov ecx, ebx
lea esi, [edx + ebx - 1]
mov ebx, dword [ebp - 0x14]
mov edi, eax
sub edi, edx
nop dword [eax]
cmp byte [esi], 0x5c
je 0x100e3b15
dec esi
inc edi
jne 0x100e3a70
jmp 0x100e3aa4
mov ecx, ebx
lea esi, [edx + ebx - 1]
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
cmp ebx, 0x2f
je 0x100e3ab5
cmp ebx, 0x5c
je 0x100e3ab5
dec esi
inc edi
jne 0x100e3a90
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
xor edi, edi
movzx ecx, byte [ebp - 0xd]
sub edx, eax
jne 0x100e3ad3
mov al, 0xa
jmp 0x100e3b00
mov ebx, dword [ebp - 0x14]
not edi
lea eax, [eax + edi + 1]
cmp eax, edx
ja 0x100e3b1f
add ecx, eax
mov edi, 1
mov esi, ecx
movzx ecx, byte [ebp - 0xd]
sub edx, eax
je 0x100e3ab1
mov al, 9
cmp edx, 2
je 0x100e3af2
cmp edx, 1
jne 0x100e3b00
cmp byte [esi], 0x2e
jne 0x100e3b00
xor eax, eax
cmp cl, 3
setae al
lea eax, [eax + eax*2 + 7]
jmp 0x100e3b00
cmp byte [esi], 0x2e
jne 0x100e3b00
cmp byte [esi + 1], 0x2e
sete al
xor al, 9
add edi, edx
mov dword [ebx], edi
mov byte [ebx + 4], al
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], edx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
not edi
lea eax, [eax + edi + 1]
cmp eax, edx
jbe 0x100e3ac2
mov ecx, eax
push 0x1018bf74
call fcn.1010cf80
mov ecx, eax
push 0x1018bf64
call fcn.1010cf80
int3
Function at 0x100e71f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [ebp - 0x24]
push dword [ebp + 8]
call fcn.100e5c70
add esp, 4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp edx, 0x80000000
je 0x100e723f
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
call fcn.100e6c10
mov ebx, dword [ebp - 0x18]
cmp ebx, 0x80000000
jne 0x100e724c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp - 0x14]
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x100e7265
mov byte [esi], 4
test ebx, ebx
jne 0x100e7274
jmp 0x100e7244
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x100e7244
push edi
push 0
push dword [0x101990e0]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x100e7244
Function at 0x100ece00
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
movzx eax, byte [edx]
mov esi, ecx
cmp al, 4
jne 0x100ece7a
mov ebx, dword [edx + 4]
mov eax, dword [0x101990e4]
cmp eax, 4
jne 0x100ecf5f
cmp word [ebx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
push 0x81
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x100ece96
cmp word [ebx], 0
je 0x100eceea
mov ecx, dword [ebx + 0x18]
movups xmm0, xmmword [ebx + 4]
lea eax, [ebx + 0x14]
mov di, 0x17
mov edx, 0x1c
mov dword [ebp - 0x18], ecx
mov ecx, 0x1c
jmp 0x100ecf04
movzx ecx, byte [edx + 3]
movzx edi, word [edx + 1]
mov edx, dword [edx + 4]
mov byte [esi + 3], cl
mov word [esi + 1], di
mov byte [esi], al
mov dword [esi + 4], edx
jmp 0x100ecf89
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x100eceae
cmp eax, 0x2726
jne 0x100ecf79
push 1
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x100ecf57
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x100ecf69
mov dword [ebp - 0x10], edi
cmp word [ebx], 0
jne 0x100ece5a
lea eax, [ebx + 2]
xorps xmm0, xmm0
mov edx, 0x10
mov di, 2
mov ecx, 6
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx ecx, word [ebx + ecx]
mov eax, dword [eax]
mov word [ebp - 0x34], di
rol cx, 8
mov word [ebp - 0x32], cx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push edx
push eax
mov edi, dword [ebp - 0x10]
push edi
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100ecf3f
mov dword [esi + 4], edi
mov byte [esi], 4
jmp 0x100ecf89
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x100ecf89
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
jmp 0x100ecf79
call fcn.10114ed0
jmp 0x100ece23
call sub.kernel32.dll_GetLastError
mov ebx, eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
mov eax, ebx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1010426a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x101042a9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101042a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101042a9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x101042a9
cmp dword [ecx + 0x74], 0xe
jbe 0x101042a9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret