joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403490
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
test eax, eax
jge 0x4034a1
xor eax, eax
add esp, 0xc
ret
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
push edi
jl 0x403540
mov edi, dword [esp + 0x20]
test edi, edi
jl 0x403540
push ebx
mov ebx, dword [esp + 0x28]
test ebx, ebx
jne 0x4034cd
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret
push esi
push 0
push eax
mov dword [esp + 0x28], 0
call fcn.00402d00
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
je 0x403534
mov ecx, 0x200
mov eax, ebp
mul ecx
push 0
mov dword [esp + 0x1c], edx
lea edx, [esp + 0x1c]
push edx
push eax
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x14]
push eax
shl edi, 9
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40352d
cmp dword [esp + 0x10], edi
jne 0x40352d
mov dword [esp + 0x20], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x403550
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7f4
mov eax, dword [0x40d204]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
mov dword [esp + 0x7f8], eax
push edi
jl 0x403631
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x403631
xor eax, eax
mov ecx, 0x1f4
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
push ebx
mov byte [esp + 0x2c], bl
call fcn.004026f0
add esp, 4
test eax, eax
je 0x403631
lea ecx, [esp + 0x29]
mov edx, eax
mov eax, ecx
mov esi, 0x12c
sub edx, eax
mov al, byte [edx + ecx]
test al, al
je 0x4035c1
mov byte [ecx], al
inc ecx
dec esi
jne 0x4035b2
jmp 0x4035c5
test esi, esi
jne 0x4035c6
dec ecx
push ebx
mov byte [ecx], 0
call fcn.00402640
add esp, 4
test eax, eax
je 0x403631
lea ecx, [esp + 0x155]
mov edx, eax
mov eax, ecx
mov esi, 0x3e9
sub edx, eax
mov al, byte [edx + ecx]
test al, al
je 0x4035f7
mov byte [ecx], al
inc ecx
dec esi
jne 0x4035e8
jmp 0x4035fb
test esi, esi
jne 0x4035fc
dec ecx
mov byte [ecx], 0
lea ecx, [esp + 0x558]
push ecx
lea edx, [esp + 0x544]
push edx
push ebx
call fcn.00402840
add esp, 0xc
test eax, eax
je 0x403631
lea eax, [esp + 0x560]
push eax
push ebx
call fcn.00402dc0
add esp, 8
test eax, eax
jne 0x403646
xor eax, eax
mov ecx, dword [esp + 0x7fc]
call fcn.00403e52
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x20]
mov edx, str..A:
mov ecx, eax
mov esi, 7
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x403667
mov byte [eax], cl
inc eax
dec esi
jne 0x403658
jmp 0x40366b
test esi, esi
jne 0x40366c
dec eax
mov byte [eax], 0
cmp byte [esp + 0x24], 0x5a
jg 0x403732
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, dword [esp + 0x24]
push edx
call fcn.004027b0
add esp, 4
test eax, eax
je 0x403720
mov eax, dword [esp + 0x24]
push eax
call fcn.00402940
add esp, 4
test eax, eax
jne 0x403720
push eax
push 0xa0000000
push 3
push eax
push 3
push 0x80000000
lea ecx, [esp + 0x38]
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x403720
push 0
lea edx, [esp + 0x20]
push edx
push 0xc
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x2d1080
push esi
call ebx
test eax, eax
je 0x403719
mov ecx, dword [ebp + 8]
cmp dword [esp + 0x14], ecx
jne 0x403719
cmp dword [esp + 0x10], 7
jne 0x403719
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x403719
cmp eax, 5
jge 0x403719
mov edx, dword [esp + 0x24]
dec eax
push eax
push edx
lea eax, [esp + 0x30]
push eax
call fcn.00402a50
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x24]
inc al
cmp al, 0x5a
mov byte [esp + 0x24], al
jle 0x403686
mov edi, dword [ebp + 0xc]
mov ecx, 0x1f4
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x7fc]
mov eax, 1
call fcn.00403e52
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405464
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x40e178], esi
push edi
jne 0x405484
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x40e174], esi
mov byte [0x40e170], al
jne 0x4054ea
mov ecx, dword [0x40f6c8]
test ecx, ecx
je 0x4054cb
mov eax, dword [0x40f6c4]
sub eax, 4
cmp eax, ecx
jmp 0x4054c4
mov eax, dword [eax]
test eax, eax
je 0x4054b6
call eax
mov eax, dword [0x40f6c4]
sub eax, 4
cmp eax, dword [0x40f6c8]
mov dword [0x40f6c4], eax
jae 0x4054ae
mov eax, 0x40d020
mov esi, 0x40d028
cmp eax, esi
mov edi, eax
jae 0x4054ea
mov eax, dword [edi]
test eax, eax
je 0x4054e3
call eax
add edi, 4
cmp edi, esi
jb 0x4054db
mov eax, 0x40d02c
mov esi, 0x40d030
cmp eax, esi
mov edi, eax
jae 0x405509
mov eax, dword [edi]
test eax, eax
je 0x405502
call eax
add edi, 4
cmp edi, esi
jb 0x4054fa
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x405523
push dword [ebp + 8]
mov dword [0x40e178], 1
call fcn.004053ca
pop ebp
ret

Function at 0x405565
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x40d204]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x40d240]
je 0x40559a
inc eax
cmp eax, 0x13
jb 0x40558b
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40d240]
jne 0x4056c0
mov eax, dword [0x40e124]
cmp eax, 1
je 0x405698
cmp eax, edx
jne 0x4055ca
cmp dword [0x40d214], 1
je 0x405698
cmp ecx, 0xfc
je 0x4056c0
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405600
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00406080
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.004062b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x405634
mov eax, edi
push eax
call fcn.004062b0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x40ab3c
push edi
call fcn.00406180
add esp, 0x10
push edi
call fcn.004062b0
push dword [esi + 0x40d244]
mov ebx, eax
call fcn.004062b0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004042e0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00406080
push edi
push ebx
call fcn.00406090
push 0x40ab38
push ebx
call fcn.00406090
push dword [esi + 0x40d244]
push ebx
call fcn.00406090
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00405f78
add esp, 0x2c
jmp 0x4056c0
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x40d244]
push dword [esi]
call fcn.004062b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00403e52
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x405f78
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40e294], ebx
push esi
push edi
jne 0x405ff8
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x406033
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40b6d4
push edi
call esi
test eax, eax
mov dword [0x40e294], eax
je 0x406033
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40e298], eax
call esi
cmp dword [0x40e138], 2
mov dword [0x40e29c], eax
jne 0x405ff8
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40e2a4], eax
je 0x405ff8
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40e2a0], eax
mov eax, dword [0x40e2a0]
test eax, eax
je 0x40603d
call eax
test eax, eax
je 0x406024
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40e2a4]
test eax, eax
je 0x406024
test byte [ebp - 8], 1
jne 0x40603d
cmp dword [0x40e144], 4
jb 0x406037
or byte [ebp + 0x12], 0x20
jmp 0x40605c
xor eax, eax
jmp 0x40606c
or byte [ebp + 0x12], 4
jmp 0x40605c
mov eax, dword [0x40e298]
test eax, eax
je 0x40605c
call eax
mov ebx, eax
test ebx, ebx
je 0x40605c
mov eax, dword [0x40e29c]
test eax, eax
je 0x40605c
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40e294]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40633c
Capabilities:
Enumerate pe sections

Disassembly:
and al, 8
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x406375
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40635c
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40636d
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x406377
inc edi
add eax, 0x28
cmp edi, esi
jb 0x406352
xor eax, eax
pop edi
pop esi
ret
Function at 0x406899
Capabilities:
Inspect section memory permissions

Disassembly:
je 0x406942
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.004062fa
inc ecx
mov dh, 0x7e
cmp dword [ecx], edi
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
call fcn.004062fa
sar byte [esi], 1
sbb bl, cl
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x4069ae
add eax, esi
cmp dword [eax], ebx
je 0x4069ae
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x4069a9
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x406993
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x40699b
cmp edx, ebx
jne 0x406ae9
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x40696a
add eax, dword [eax + 4]
jmp 0x406957
mov dword [ebp + 0xc], ebx
jmp 0x4069b9
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4069d1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4069ef
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x406a4d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x406a34
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x406a3d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x406a47
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x406a29
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4069b3
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x406bae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
invalid
test dword [ebx - 4], ecx

Function at 0x40722f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
invalid
invalid
invalid
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xfee3ec
Capabilities:
Encode data using xor

Disassembly:
dec ebx
add ebx, dword [ebp - 0xb3486e3]
cmp dword [eax], esi
mov esp, 0xa8d302ae
lodsd eax, dword [esi]
and dword [ecx + ebp + 0x33], esi
inc edx
jp 0xfee465
xor bh, al
jmp 0xfee3f6
pushal
call 0xfee3fc
pop ebp
sub ebp, 0x10
sub ebp, 0xbee3ec
jmp 0xfee412
add al, 0
add byte [eax], al
adc eax, 0xb8ec9adf
in al, dx
jecxz 0xfee3d4
mov eax, 0xbee3ec
add eax, ebp
add eax, 0x4c
mov ecx, 0x591
add byte [ebx], al
lds eax, [ecx + 0x4cc0]
add byte [ecx + 0x591], bh
mov edx, 0x91b1bd2b
xor byte [eax], dl
inc eax
dec ecx
jne 0xfee429
jmp 0xfee43c
mov al, byte [0x17a2a0e6]
sub ebp, dword [ebx]
sub ebp, dword [edx + 0x2b2bd3ea]
sub ebp, dword [eax]
out 0x93, al
sub ebp, dword cs:[ebx]
sub edx, dword [ecx + 0x2b2b2b03]
fmul st(1), st(0)
sub bl, ah
mov al, byte [0x2b2b27aa]
sub ebp, dword [eax]
out dx, al
jnp 0xfee40a
dec edi
invalid
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10001396
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x100013cc
mov eax, dword [ebp - 8]
add eax, 1
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
call ecx
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x61
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
jne 0x100013cc
add esp, 0x38
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, esp
mov dword [ecx + 8], 0xc6ff96
mov dword [ecx + 4], 0x8ac21
mov dword [ecx], 0xf68
mov dword [ebp - 8], eax
call sub.USER32.dll_PackDDElParam
sub esp, 0xc
mov ecx, esp
mov dword [ecx], 0x414
mov ecx, dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x14], eax
call ecx
sub esp, 4
mov ecx, dword [ebp - 8]
sub ecx, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
je 0x1000142f
jmp 0x10001416
mov eax, dword [ebp - 8]
sub eax, 0x3c
mov dword [ebp - 0x20], eax
jne 0x100013a3
jmp 0x10001423
mov eax, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call eax
mov dword [ebp - 0x24], eax
jmp 0x1000142f
mov eax, esp
mov dword [eax], 0xa6b92e
mov eax, dword [sym.imp.USER32.dll_ShowCaret]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0x281
mov dword [ecx], 0x281
mov ecx, dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov dword [ebp - 0x28], eax
call ecx
sub esp, 8
mov dword [ebp - 0x2c], eax
jmp 0x100013a3
Function at 0x10199503
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x1021cb48], 0x132a
mov dword [0x1021cb44], 0x3614
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x101995ae
lea eax, [ebp - 0x2c]
mov dword [0x1021cb48], 0x156a
mov dword [ebp - 0x13c], eax
call fcn.10199da4
mov dword [esp], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp + 4], eax
call fcn.1019a6b6
mov ecx, eax
mov dword [0x1021cb64], eax
mov eax, esp
mov edx, dword [ebp - 0x140]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], ecx
jmp 0x10199651
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
mov esi, eax
add esi, 1
imul edi, eax, 0x178
mov ebx, edx
add ebx, edi
add ebx, 0xc0
imul eax, eax, 0x178
add edx, eax
add edx, 0xbc
mov eax, dword [ebx]
movzx edx, word [edx]
xor edx, eax
add edx, ecx
cmp esi, 0x57a
mov eax, edx
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], esi
jne 0x101995ae
mov dword [0x1021cb44], 0x1177
xor eax, eax
mov dword [ebp - 0x150], eax
jmp 0x1019961f
mov eax, dword [ebp - 0x150]
mov cl, byte [eax + 0x1019b634]
mov dl, byte [eax + 0x1019b605]
sub dl, cl
mov byte [ebp + eax - 0x2c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x150], eax
je 0x1019953e
jmp 0x1019961f
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x148]
lea edx, section..data
imul esi, eax, 0x178
mov edi, edx
add edi, esi
add edi, 0xc0
mov esi, dword [edi]
imul edi, eax, 0x178
mov ebx, edx
add ebx, edi
add ebx, 0x2c
mov edi, dword [ebx]
imul ebx, eax, 0x178
add edx, ebx
add edx, 0xbc
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x144]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.1019a073
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x57a
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
jne 0x10199651
lea eax, [0x1019b613]
mov ecx, 0x20
lea edx, [ebp - 0x12c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.10199b0d
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x140]
mov dword [esp + 0xc], edx
call fcn.1019a0ff
xor eax, eax
mov ecx, dword [ebp - 0x144]
add ecx, 0x851ea
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x11ce00
mov ecx, dword [ebp - 0x144]
add ecx, 0x56388
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x1f40
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019978b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.1000108e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x101997b4
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
lea eax, [esp + 0x38]
mov ecx, dword [0x1021cb44]
add ecx, 0xffffefd3
mov dword [0x1021cb44], ecx
mov dword [esp + 0x20], eax
call fcn.10199c6b
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
je 0x1019985f
jmp 0x10199902
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x101998d2
mov eax, dword [esp + 0x18]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x38]
mov dword [0x1021cb44], 0xfffff682
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x4c], esi
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1019a35f
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x1021cb44]
add ecx, 0xffffe5c3
mov dword [0x1021cb48], ecx
mov dword [esp + 0x1c], eax
jmp 0x10199902
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.10199503
lea ecx, [0x1019a8dd]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x68], edx
mov dword [esp + 0x70], 0x11ce00
mov dword [0x1021cb44], 0x15a6
mov edx, dword [0x1021cb30]
mov dword [esp + 0x64], edx
mov edx, dword [0x1021cb34]
mov dword [esp + 0x88], edx
mov edx, dword [0x1021cb38]
mov dword [esp + 0x58], edx
mov edx, dword [0x1021cb3c]
mov dword [esp + 0x44], edx
mov edx, dword [0x1021cb40]
mov dword [esp + 0x60], edx
mov dword [0x1021cb48], 0x109b
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x101997e5
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], ecx
je 0x101997fc
jmp 0x101997e5
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
jmp 0x101997aa