joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10061c50
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 0x2710
call esi
push 0x208
call fcn.1001a154
push 0x208
mov edi, eax
push 0
push edi
call fcn.1003a580
add esp, 0x10
push 0x104
push edi
push dword [0x1010cc6c]
call dword [0x1010cffc]
push edi
call dword [0x1010ce4c]
push edi
call dword [0x1010d1dc]
push 0x100cabc8
mov edx, 0x104
mov ecx, edi
call fcn.10001480
push 0x100cabd8
mov edx, 0x104
mov ecx, edi
call fcn.10001480
push edi
call dword [0x1010ce38]
test eax, eax
je 0x10061ce8
push edi
call dword [0x1010cf64]
push edi
call fcn.10035d9e
add esp, 4
push 0x2710
call esi
push 0x4e20
call esi
jmp 0x10061cd8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10062910
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3b78
push 0x100b6db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x424
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x228], ax
push 0x206
push eax
lea eax, [ebp - 0x226]
push eax
call fcn.1003a580
add esp, 0xc
xor eax, eax
mov word [ebp - 0x430], ax
push 0x206
push eax
lea eax, [ebp - 0x42e]
push eax
call fcn.1003a580
add esp, 0xc
mov edi, dword [ebp + 0xc]
push edi
call dword [0x1010cf64]
push edi
mov edx, 0x104
lea ecx, [ebp - 0x228]
call fcn.10001450
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x100629cd
push 0
lea eax, [ebp - 0x228]
push eax
push 0
call dword [0x1010ce60]
push edi
mov ecx, esi
call fcn.100634f0
push 0x208
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.1003a580
add esp, 0xc
push 0x100cad48
mov edx, 0x104
lea ecx, [ebp - 0x430]
call fcn.10001450
mov eax, dword [ebp + 8]
mov ax, word [eax]
mov word [ebp - 0x430], ax
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.10062a50
mov ecx, esi
call fcn.10063480
mov eax, 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10062a4c
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10066840
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x84]
test edx, edx
je 0x100668a1
mov ecx, dword [edi + 0x8c]
mov ebx, dword [edi + 0x88]
cmp ecx, ebx
jae 0x100668eb
mov esi, dword [esp + 0x14]
sub ebx, ecx
cmp ebx, dword [esp + 0x18]
lea eax, [ecx + edx]
cmova ebx, dword [esp + 0x18]
push ebx
push eax
push esi
call fcn.10037e80
mov ecx, dword [edi + 0x78]
add dword [edi + 0x8c], ebx
add dword [edi + 0x74], ebx
push ebx
mov edx, esi
call fcn.10067280
add esp, 0x10
mov dword [edi + 0x78], eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x100668e4
mov ebx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push dword [esp + 0x20]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100668eb
mov esi, dword [esp + 0xc]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
mov edx, ebx
call fcn.10067280
add esp, 4
mov dword [edi + 0x78], eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x10066cf0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x2d], 0
mov edi, dword [esp + 0x14]
je 0x10066d6e
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x10066d1f
cmp dword [esi + 0x40], edi
jae 0x10066d1f
push eax
call fcn.10035d9e
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x10066d37
lea eax, [edi + edi]
push eax
call fcn.1001a154
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push dword [esi + 0x3c]
call fcn.10037e80
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x10066d6b
push ebp
jmp 0x10066d50
mov eax, dword [esi + 0x3c]
lea ecx, [esi + 0x30]
mov dl, byte [ebx + eax]
call fcn.100671f0
mov ecx, dword [esi + 0x3c]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, edi
jb 0x10066d50
pop ebp
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10066da7
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x10066d8f
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
add ecx, edx
push ebx
push ecx
call fcn.10037e80
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x10066dc8
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x10066eb0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x24]
mov edi, ecx
push eax
push edi
mov dword [esp + 0x28], edx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x10066eda
mov eax, 0x200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
mov eax, dword [esp + 0x24]
xor esi, esi
mov edx, eax
and edx, 1
mov ecx, 1
cmovne esi, ecx
test al, 2
je 0x10066ef4
or esi, 2
test al, 4
je 0x10066efb
or esi, 4
mov ecx, eax
and ecx, 0x10
je 0x10066f05
or esi, 0x10
test al, 0x20
je 0x10066f0c
or esi, 0x20
test ecx, ecx
je 0x10066f18
or esi, 0x40000000
jmp 0x10066f1e
or esi, 0x80000000
or esi, 0x1000000
test edx, edx
jne 0x10066f2e
or esi, 0x800000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0x28
jbe 0x10066fde
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0
push edi
call ebp
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0x24
push edi
call ebp
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [esp + 0x10], ax
jne 0x10066fde
mov ecx, dword [esp + 0x14]
lea eax, [ecx + 0x34]
cmp ebx, eax
jbe 0x10066fde
push 0
push 0
push ecx
push edi
call ebp
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x1c]
cmp eax, 0x5a4d
je 0x10066fd8
cmp eax, 0x454e
je 0x10066fd8
cmp eax, 0x454c
je 0x10066fd8
cmp eax, 0x4550
jne 0x10066fde
or esi, 0x400000
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10066fe8
mov dword [eax], esi
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x10066ff2
mov dword [eax], ebx
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
test esi, esi
je 0x10067037
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.100670e0
push edi
push ebx
mov dword [esi], eax
mov dword [esi + 4], edx
call fcn.100670e0
push dword [esp + 0x3c]
mov dword [esi + 8], eax
push dword [esp + 0x3c]
mov dword [esi + 0xc], edx
call fcn.100670e0
add esp, 0x18
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x64]
test esi, esi
je 0x10067062
push edi
push ebx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x18]
call fcn.10067070
movzx ecx, word [esp + 0x18]
movzx eax, word [esp + 0x1c]
shl ecx, 0x10
add esp, 8
or ecx, eax
mov dword [esi], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48
ret
Function at 0x10067230
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x100cb518]
xor eax, esi
movzx ecx, al
add ecx, dword [edi + 4]
mov dword [edi], eax
mov eax, dword [edi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x100cb518]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x10067280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
jne 0x10067287
xor eax, eax
ret
push esi
mov esi, dword [esp + 8]
not ecx
cmp esi, 8
jb 0x10067355
push edi
mov edi, esi
shr edi, 3
lea ecx, [ecx]
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100cb518]
movzx eax, byte [edx + 1]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100cb518]
movzx eax, byte [edx + 2]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100cb518]
movzx eax, byte [edx + 3]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100cb518]
movzx eax, byte [edx + 4]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100cb518]
movzx eax, byte [edx + 5]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100cb518]
movzx eax, byte [edx + 6]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100cb518]
movzx eax, byte [edx + 7]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100cb518]
add edx, 8
sub esi, 8
dec edi
jne 0x100672a0
pop edi
test esi, esi
je 0x1006737a
lea esp, [esp]
movzx eax, byte [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x100cb518]
lea edx, [edx + 1]
dec esi
jne 0x10067360
not ecx
mov eax, ecx
pop esi
ret
Function at 0x100773f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bbcb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0
call fcn.10001db0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1007747c
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jg 0x10077499
jl 0x10077475
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebx + 8]
jae 0x1007749c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.10001dc0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10077540
cmp eax, 1
jne 0x10077475
xor esi, esi
mov edi, edi
lea ecx, [ebp - 0x40]
call fcn.100057c0
cmp esi, eax
jae 0x10077504
xorps xmm0, xmm0
push esi
lea ecx, [ebp - 0x40]
movlpd qword [ebp - 0x34], xmm0
call fcn.100057d0
mov ebx, eax
push 0
lea eax, [ebp - 0x34]
push eax
push dword [ebx + 4]
push dword [ebx]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x10077475
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 8]
mov ebx, dword [ebp - 0x1c]
mov eax, esi
shl eax, 0xa
add eax, dword [ebx + 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
inc esi
jmp 0x100774b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 1
jmp 0x1007751b
lea ecx, [ebp - 0x40]
call fcn.10001dc0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100775e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f4df8
push 0x100b6db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10077652
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10051525
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [ebp - 0x28]
test ecx, ecx
jl 0x100776cd
mov eax, dword [ebp - 0x2c]
jg 0x1007766d
test eax, eax
je 0x100776cd
mov edx, dword [ebx + 8]
cmp eax, edx
jne 0x100776cd
test ecx, ecx
jne 0x100776cd
push ecx
lea eax, [ebp - 0x20]
push eax
push edx
push dword [ebx + 4]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100776ae
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, dword [ebp - 0x2c]
jne 0x100776ae
cmp ecx, dword [ebp - 0x28]
jne 0x100776ae
mov esi, 1
mov dword [ebp - 0x24], esi
jmp 0x100776d4
push dword [ebx + 8]
push 0
push dword [ebx + 4]
call fcn.1003a580
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.10051525
add esp, 0x14
xor eax, eax
jmp 0x100776e2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
call fcn.100776f8
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10077760
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f4e28
push 0x100b6db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100777d6
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10051525
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
call fcn.10077819
mov eax, dword [ebp - 0x1c]
test eax, eax
jg 0x1007781a
jl 0x10077804
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x1007781d
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x20]
test eax, eax
jg 0x10077832
jl 0x1007782b
cmp ecx, 0x2800
ja 0x10077832
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x1007783b
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x2800
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10077860
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
xor edx, edx
test esi, esi
je 0x1007788f
push edi
mov edi, dword [esp + 0xc]
movsx ecx, byte [edx + edi]
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x10118bc8]
inc edx
cmp edx, esi
jb 0x10077873
pop edi
not eax
pop esi
ret 8
Function at 0x1007bb10
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
je 0x1007bb31
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
xor byte [eax + esi], bl
lea ecx, [eax + esi]
inc eax
cmp eax, edx
jb 0x1007bb24
pop esi
pop ebx
ret 0xc

Function at 0x1007c4a0
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f5028
push 0x100b6db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1007f7b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
xor eax, eax
test ecx, ecx
je 0x1007f7c9
mov edx, dword [esp + 4]
mov edi, edi
xor byte [eax + edx], 0x58
inc eax
cmp eax, ecx
jb 0x1007f7c0
mov al, 1
ret 8

Function at 0x1007f7d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
xor eax, eax
test ecx, ecx
je 0x1007f7e9
mov edx, dword [esp + 4]
mov edi, edi
xor byte [eax + edx], 0x58
inc eax
cmp eax, ecx
jb 0x1007f7e0
mov al, 1
ret 8

Function at 0x1007fb90
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f53f8
push 0x100b6db8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0x104
push 0x208
call fcn.1001a154
add esp, 4
mov edi, eax
mov dword [ebp - 4], esi
push 0x208
push esi
push edi
call fcn.1003a580
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push edi
call dword [sym.imp.USER32.dll_CharUpperW]
mov eax, str.SYSTEM
mov ecx, edi
lea esp, [esp]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1007fc26
test dx, dx
je 0x1007fc22
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1007fc26
add ecx, 4
add eax, 4
test dx, dx
jne 0x1007fc00
xor eax, eax
jmp 0x1007fc2b
sbb eax, eax
or eax, 1
mov ecx, 1
test eax, eax
cmovne esi, ecx
mov dword [ebp - 0x1c], esi
test edi, edi
jne 0x1007fc45
push edi
call fcn.10035d9e
add esp, 4
mov dword [ebp - 4], 0xffffffff
call fcn.1007fc67
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007ffa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
push ebx
push esi
lea eax, [esp + 0xc]
xor bl, bl
push eax
mov dword [esp + 0x10], 0x6e72656b
mov dword [esp + 0x14], 0x32336c65
mov byte [esp + 0x18], bl
call dword [0x1010d000]
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], 0x6f577349
mov dword [esp + 0x24], 0x50343677
mov dword [esp + 0x28], 0x65636f72
mov word [esp + 0x2c], 0x7373
mov byte [esp + 0x2e], bl
call dword [0x1010d00c]
mov esi, eax
test esi, esi
je 0x1008001b
lea eax, [esp + 8]
push eax
call dword [0x1010cfb8]
push eax
call esi
test eax, eax
je 0x1008001b
cmp dword [esp + 8], 0
pop esi
setne al
pop ebx
add esp, 0x20
ret
pop esi
mov al, bl
pop ebx
add esp, 0x20
ret

Function at 0x10080a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
call fcn.1007ffa0
test al, al
je 0x10080a12
mov al, 1
add esp, 0x40
ret
lea eax, [esp]
push eax
mov dword [esp + 4], 0x6e72656b
mov dword [esp + 8], 0x32336c65
mov byte [esp + 0xc], 0
call dword [0x1010d000]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x14], 0x53746547
mov dword [esp + 0x18], 0x65747379
mov dword [esp + 0x1c], 0x666e496d
mov word [esp + 0x20], 0x6f
call dword [0x1010d00c]
lea ecx, [esp + 0x1c]
push ecx
call eax
xor eax, eax
cmp word [esp + 0x1c], 9
sete al
add esp, 0x40
ret

Function at 0x10084f90
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x100bbf1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 4
mov ebp, ecx
call fcn.10035e2f
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 0
test eax, eax
je 0x10084fd3
mov ecx, eax
call fcn.10080ce0
mov ebx, eax
jmp 0x10084fd5
xor ebx, ebx
push 0x408
mov dword [esp + 0x28], 0xffffffff
call fcn.10035e2f
mov edi, eax
add esp, 4
test edi, edi
je 0x10085002
push 0x408
push 0
push edi
call fcn.1003a580
add esp, 0xc
jmp 0x10085004
xor edi, edi
push 0x400
mov dword [esp + 0x18], 0
call fcn.1001a154
add esp, 4
mov dword [esp + 0x18], eax
push 0x408
push 0
push edi
call fcn.1003a580
add esp, 0xc
lea esi, [ebp + 0x520]
push 0x4f0
push dword [esp + 0x34]
push esi
call fcn.10037e80
xor eax, eax
add esp, 0xc
cmp dword [esi], 0x186e4
push dword [esp + 0x2c]
sete al
mov ecx, ebp
mov dword [ebp + 0xa40], eax
call fcn.100857c0
call fcn.100854e0
push 0x200
lea eax, [edi + 8]
push eax
lea eax, [ebp + 0x568]
push eax
call fcn.1007eb40
lea eax, [edi + 8]
push eax
call dword [0x1010d15c]
cmp dword [esi], 0x186fd
jne 0x1008509b
cmp eax, 2
jle 0x100850a7
mov word [eax + edi + 6], 0xa0d
jmp 0x100850a7
cmp eax, 2
jle 0x100850a7
mov word [eax + edi + 7], 0xa0d
lea esi, [edi + 8]
push esi
call dword [0x1010d15c]
mov dword [edi], eax
mov ecx, dword [ebp + 0xa14]
test ecx, ecx
je 0x100850cd
push 0
lea edx, [esp + 0x18]
push edx
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.10035dcd
add esp, 4
test ebx, ebx
je 0x100850e2
push ecx
mov ecx, ebx
call fcn.100014c0
push dword [esp + 0x18]
call fcn.10035d9e
mov ecx, dword [esp + 0x20]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x1008af40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100bc23e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push 0x10118b08
lea ecx, [esp + 0xc]
call fcn.1008e810
mov dword [esp + 0x18], 0
push dword [0x10118afc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1008afd6
push 0x58
call fcn.10035e2f
add esp, 4
mov dword [esp + 4], eax
mov byte [esp + 0x18], 1
test eax, eax
je 0x1008afa7
push 0xffffffffffffffff
push 0
push 0
mov ecx, eax
call fcn.1008e870
mov esi, eax
jmp 0x1008afa9
xor esi, esi
push esi
mov byte [esp + 0x1c], 0
push dword [0x10118afc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
mov ecx, 0x10118b00
call fcn.10007f70
mov dword [eax], esi
push dword [0x10118afc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [esp + 8]
mov esi, eax
call fcn.1008e7f0
mov ecx, dword [esp + 0x10]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret

Function at 0x1008b000
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100bc250
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
lea ecx, [esp + 8]
lea eax, [edi + 0x28]
push eax
call fcn.1008e810
mov dword [esp + 0x1c], 0
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1008b046
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov esi, dword [esp + 0x24]
push esi
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push eax
lea ecx, [edi + 0x20]
call fcn.10007f70
lea ecx, [esp + 8]
mov dword [eax], esi
call fcn.1008e7f0
mov ecx, dword [esp + 0x14]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x18
ret 4