joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030e5c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x8000
jg 0x10030f76
je 0x10030f6d
cmp eax, 0x80
jg 0x10030ef3
je 0x10030eea
cmp eax, 8
jg 0x10030ebc
je 0x10030eb3
cmp eax, 0x80000000
je 0x10030eaa
cmp eax, 2
je 0x10030ea1
cmp eax, 4
jne 0x10031059
mov eax, 2
pop ebp
ret 4
mov eax, 1
pop ebp
ret 4
mov eax, 0x1f
pop ebp
ret 4
mov eax, 3
pop ebp
ret 4
cmp eax, 0x10
je 0x10030ee1
cmp eax, 0x20
je 0x10030ed8
cmp eax, 0x40
jne 0x10031059
mov eax, 6
pop ebp
ret 4
mov eax, 5
pop ebp
ret 4
mov eax, 4
pop ebp
ret 4
mov eax, 7
pop ebp
ret 4
cmp eax, 0x800
jg 0x10030f39
je 0x10030f30
cmp eax, 0x100
je 0x10030f27
cmp eax, 0x200
je 0x10030f1e
cmp eax, 0x400
jne 0x10031059
mov eax, 0xa
pop ebp
ret 4
mov eax, 9
pop ebp
ret 4
mov eax, 8
pop ebp
ret 4
mov eax, 0xb
pop ebp
ret 4
cmp eax, 0x1000
je 0x10030f64
cmp eax, 0x2000
je 0x10030f5b
cmp eax, 0x4000
jne 0x10031059
mov eax, 0xe
pop ebp
ret 4
mov eax, 0xd
pop ebp
ret 4
mov eax, 0xc
pop ebp
ret 4
mov eax, 0xf
pop ebp
ret 4
cmp eax, 0x800000
jg 0x10031002
je 0x10030ff9
cmp eax, 0x80000
jg 0x10030fc9
je 0x10030fc0
cmp eax, 0x10000
je 0x10030fb7
cmp eax, 0x20000
je 0x10030fae
cmp eax, 0x40000
jne 0x10031059
mov eax, 0x12
pop ebp
ret 4
mov eax, 0x11
pop ebp
ret 4
mov eax, 0x10
pop ebp
ret 4
mov eax, 0x13
pop ebp
ret 4
cmp eax, 0x100000
je 0x10030ff0
cmp eax, 0x200000
je 0x10030fe7
cmp eax, 0x400000
jne 0x10031059
mov eax, 0x16
pop ebp
ret 4
mov eax, 0x15
pop ebp
ret 4
mov eax, 0x14
pop ebp
ret 4
mov eax, 0x17
pop ebp
ret 4
cmp eax, 0x8000000
jg 0x10031044
je 0x1003103b
cmp eax, 0x1000000
je 0x10031032
cmp eax, 0x2000000
je 0x10031029
cmp eax, 0x4000000
jne 0x10031059
mov eax, 0x1a
pop ebp
ret 4
mov eax, 0x19
pop ebp
ret 4
mov eax, 0x18
pop ebp
ret 4
mov eax, 0x1b
pop ebp
ret 4
cmp eax, 0x10000000
je 0x10031071
cmp eax, 0x20000000
je 0x10031068
cmp eax, 0x40000000
je 0x1003105f
xor eax, eax
pop ebp
ret 4
mov eax, 0x1e
pop ebp
ret 4
mov eax, 0x1d
pop ebp
ret 4
mov eax, 0x1c
pop ebp
ret 4

Function at 0x10039d90
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_ReadFile]
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push 0
push eax
push 0
push 0
push 0
push ebx
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
test eax, eax
je 0x10039e1c
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10039e30
push 0x400
call sub.MSVCRT.dll_malloc
add esp, 4
lea ecx, [esp + 0x18]
mov esi, eax
push 0
push ecx
push 0x400
push esi
push ebx
call ebp
test eax, eax
je 0x10039e0f
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10039e23
push eax
mov edx, esi
mov ecx, edi
call fcn.1003b4c0
push 2
mov edx, 0x1004423c
mov ecx, edi
call fcn.1003b4c0
jmp 0x10039da2
test esi, esi
je 0x10039e1c
push esi
call sub.MSVCRT.dll_free
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
test esi, esi
je 0x10039e30
push esi
call sub.MSVCRT.dll_free
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x1003a700
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x1003a730
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
test eax, eax
jne 0x1003a75a
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
je 0x1003a75a
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40a6a3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40a6d1
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x40a6d8
cmp ebx, dword [eax + 4]
jae 0x40a6d8
xor eax, eax
jmp 0x40a8c8
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40a6e9
xor eax, eax
inc eax
jmp 0x40a8c7
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40a6ff
cmp ecx, edx
jae 0x40a844
cmp dword [eax + 4], 0
je 0x40a708
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40a6f0
cmp dword [ebp + 8], 0
je 0x40a72a
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40a844
cmp eax, esi
jae 0x40a844
mov eax, dword [0x413c88]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40a74f
cmp dword [esi*4 + 0x413c90], edi
je 0x40a848
inc esi
cmp esi, eax
jl 0x40a73d
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x40d198]
test eax, eax
je 0x40a8c4
cmp dword [ebp - 8], 0x1000000
jne 0x40a8c4
test byte [ebp - 0xc], 0xcc
je 0x40a7cd
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40a8c4
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40a8c4
cmp word [eax + 0x18], 0x10b
jne 0x40a8c4
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40a8c4
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40a7cd
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40a7cd
test byte [ecx + 0x27], 0x80
jne 0x40a844
push 1
push 0x413cd0
call dword [0x40d194]
test eax, eax
jne 0x40a6e1
mov ecx, dword [0x413c88]
test ecx, ecx
mov edx, ecx
jle 0x40a801
lea eax, [ecx*4 + 0x413c8c]
cmp dword [eax], edi
je 0x40a801
dec edx
sub eax, 4
test edx, edx
jg 0x40a7f5
test edx, edx
jne 0x40a832
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40a80e
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40a826
lea eax, [edx*4 + 0x413c90]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x40a814
cmp ecx, 0x10
jge 0x40a832
inc ecx
mov dword [0x413c88], ecx
push 0
push 0x413cd0
call dword [0x40d194]
jmp 0x40a6e1
xor eax, eax
jmp 0x40a8c7
test esi, esi
jle 0x40a6e1
mov ebx, dword [0x40d194]
push 1
push 0x413cd0
call ebx
test eax, eax
jne 0x40a6e1
cmp dword [esi*4 + 0x413c90], edi
je 0x40a89e
mov eax, dword [0x413c88]
lea esi, [eax - 1]
test esi, esi
jl 0x40a88c
cmp dword [esi*4 + 0x413c90], edi
je 0x40a888
dec esi
jns 0x40a87c
test esi, esi
jge 0x40a89c
cmp eax, 0x10
jge 0x40a897
inc eax
mov dword [0x413c88], eax
lea esi, [eax - 1]
jmp 0x40a89e
je 0x40a8b6
xor ecx, ecx
test esi, esi
jl 0x40a8b6
lea eax, [ecx*4 + 0x413c90]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x40a8a4
push 0
push 0x413cd0
call ebx
jmp 0x40a6e1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0xf5b098
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf5b0a2
pushal
call 0xf5b0a8
pop ebp
sub ebp, 0x10
sub ebp, 0xb5b098
jmp 0xf5b0be
mov eax, 0xb5b098
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d6
mov edx, 0x7f4e8c6e
xor byte [eax], dl
inc eax
dec ecx
jne 0xf5b0d5
jmp 0xf5b0e8
in eax, 0xa3
in eax, 0xe7
push edx
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
out dx, eax
scasd eax, dword es:[edi]
xchg esi, eax
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
insd dword es:[edi], dx
mov dword [0x6e6e68d6], eax
outsb dx, byte [esi]
aam 0x46
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
cdq
mov word [ebp - 0x5a], gs
in eax, 0xef
bound ebp, qword [esi + 0x6e]
outsb dx, byte [esi]
insd dword es:[edi], dx
stosd dword es:[edi], eax
jecxz 0xf5b11b
dec edx
xchg edx, eax
out 0x6a, eax
dec edx
push es
bound edx, qword [edx]
dec edi
outsb dx, byte [esi]
push es
loop 0xf5b178
cli
outsb dx, byte [esi]
outsd dx, dword [esi]
inc edx
dec edx
push es
mov al, 0x5d
xchg edi, eax
clc
xchg byte [ebx + 0x6e], ch
outsb dx, byte [esi]
outsb dx, byte [esi]
xchg dword [eax + 0x6e], eax
outsb dx, byte [esi]
outsb dx, byte [esi]
cmp edi, dword [edx]
xor esp, ebp
jmp 0xf5b19e
out 0x62, eax
dec edx
xchg byte [ebx + 0x6e], ch
outsb dx, byte [esi]
outsb dx, byte [esi]
xchg dword [ebx], ebp
insb byte es:[edi], dx
outsb dx, byte [esi]
outsb dx, byte [esi]
jecxz 0xf5b191
dec edx
xchg edx, eax
out 0x42, eax
dec edx
cmp dh, byte [ebx]
xchg ecx, eax
sbb esp, dword [edx - 0x6f]
xchg ecx, eax
sbb esp, dword [esi - 0x7a]
sbb al, 0x6e
outsb dx, byte [esi]
outsb dx, byte [esi]
in eax, 0xd3
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
pop ebp
cmpsd dword [esi], dword es:[edi]
out dx, eax
pushfd
push edi
add dword [ecx - 0x26], 0xffffffef
pushfd
push edi
add dword [ecx - 0x26], 0x5d
mov esp, 0x266b86ed
popal
ljmp 0xe661
Function at 0x402fd1
Capabilities:
Copy file
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
cmp dword [esi + 4], 0xffffffff
mov dword [esi], 0x401014
je 0x402fec
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x402fff
push dword [esi + 0x10]
call fcn.00403a4a
pop ecx
mov dword [esi + 0x10], edi
cmp dword [esi + 0x14], edi
je 0x403010
push dword [esi + 0x14]
call fcn.00403a4a
pop ecx
mov dword [esi + 0x14], edi
cmp dword [esi + 0xc], edi
je 0x403034
push edi
push dword [esi + 8]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi + 0xc]
call fcn.00403a4a
pop ecx
cmp dword [esi + 8], edi
je 0x403045
push dword [esi + 8]
call fcn.00403a4a
pop ecx
mov dword [esi + 8], edi
pop edi
pop esi
ret
Function at 0x4032e3
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x403ad8
call fcn.00403848
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x404380
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x403328
cmp eax, esi
jne 0x40331b
xor esi, esi
inc esi
mov edi, esi
jmp 0x40332b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4032ff
xor esi, esi
inc esi
cmp dword [0x404384], esi
jne 0x40333d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x403377
cmp dword [0x404384], ebx
jne 0x403371
mov dword [0x404384], esi
push 0x4010f4
push 0x4010e8
call fcn.0040345c
pop ecx
pop ecx
test eax, eax
je 0x403377
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40344c
mov dword [0x404014], esi
cmp dword [0x404384], esi
jne 0x40339a
push 0x4010e4
push 0x4010dc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x404384], 2
test edi, edi
jne 0x4033a7
xor eax, eax
mov ecx, 0x404380
xchg dword [ecx], eax
cmp dword [0x404388], 0
je 0x4033d3
push 0x404388
call fcn.004036a0
pop ecx
test eax, eax
je 0x4033d3
push ebx
push 2
push ebx
mov esi, dword [0x404388]
mov ecx, esi
call dword [0x4050f4]
call esi
push dword [0x404020]
push dword [0x40401c]
push dword [0x404018]
call fcn.00401560
add esp, 0xc
mov dword [0x404010], eax
cmp dword [0x404028], 0
jne 0x403431
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x404014], 0
jne 0x403445
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x404010]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00494000
jmp 0x4032e3

Function at 0x403584
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x403af8
call fcn.00403848
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4035e4
cmp eax, 0xffffffff
je 0x4035e4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4035dd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4035dd
cmp edx, 0x10000000
jae 0x4035dd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4035da
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403650
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40368e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x403686
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x403690
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x403676
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10006490
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x100064ab
bts eax, 7
shr ecx, 1
test cl, 1
je 0x100064b6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x100064c1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x100064cc
bts eax, 4
shr ecx, 1
test cl, 1
je 0x100064d7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x100064e2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x100064ed
bts eax, 1
test cl, 2
je 0x100064f6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10006592
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10006583
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x100064a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100065c0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10132018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x10124ebc
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp - 8], 0
call fcn.100d9fd1
add esp, 0xc
test eax, eax
je 0x10006610
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10082d8f
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.100da018
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
test ebx, ebx
jne 0x10006646
call fcn.100da09a
add esp, 4
xor al, al
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10082d8f
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.100da304
add esp, 0x10
test eax, eax
je 0x1000669b
push esi
nop dword [eax + eax]
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 0xc]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10006662
push dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
push 0x400
push 1
push ebx
call fcn.100da304
add esp, 0x10
test eax, eax
jne 0x10006660
pop esi
push ebx
call fcn.100da43f
push dword [ebp - 8]
call fcn.100da09a
mov ecx, dword [ebp - 4]
add esp, 8
not dword [edi]
xor ecx, ebp
mov al, 1
pop ebx
pop edi
call fcn.10082d8f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100066d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
mov dword [esi], vtable.CAntiHack.0
test eax, eax
je 0x100066fc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x60], 0
test byte [ebp + 8], 1
je 0x1000670d
push 0x64
push esi
call fcn.100830b7
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100068a0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x100067e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 1
push 0x100067e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 2
push 0x100067e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 3
push 0x100067e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 4
push 0x100067e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
test eax, eax
je 0x10006933
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10006980
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x10132018]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x5045454
push eax
push 0
push 0
push 0x10124ecc
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [esp + 8]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [esp + 0x3a]
movzx eax, word [esp + 0x38]
shl ecx, 0x10
or ecx, eax
movzx eax, word [esp + 0x16]
xor ecx, 0xb542d8e1
push ecx
movzx ecx, word [esp + 0x1c]
shl ecx, 0x10
or ecx, eax
mov eax, dword [esp + 0x16]
xor eax, 0x5d78a569
xor ecx, 0xf45bc123
push ecx
push eax
mov eax, dword [esp + 0x10]
xor eax, 0x12b586fe
push eax
lea eax, [esi + 4]
push str._08X__08X__08X__08X
push eax
call fcn.10006ac0
mov ecx, dword [esp + 0x54]
add esp, 0x18
pop esi
xor ecx, esp
call fcn.10082d8f
mov esp, ebp
pop ebp
ret

Function at 0x10006b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
test ebx, ebx
jle 0x10006bc8
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
nop word [eax + eax]
lea esi, [ecx + eax]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
inc ecx
mov al, byte [edx + 0x10124f64]
xor al, byte [edi + esi]
mov byte [esi], al
mov eax, dword [ebp + 8]
cmp ecx, ebx
jl 0x10006ba0
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10007ac0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10132018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10132f44]
push esi
mov esi, dword [0x10132f48]
push edi
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10127bf8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 8
andps xmm0, xmmword [0x10127eb0]
mulsd xmm0, qword [0x10127b78]
push esi
addsd xmm0, qword [0x10127c48]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [0x10132f44]
mov esi, dword [0x10132f4c]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10127bf8]
push eax
push 0x40
push 8
push esi
andps xmm0, xmmword [0x10127eb0]
mulsd xmm0, qword [0x10127b78]
addsd xmm0, qword [0x10127c48]
movsd qword [ebp - 0x10], xmm0
call edi
movsd xmm0, qword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [0x10132f44]
mov esi, dword [0x10132f50]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10127bf8]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x10127eb0]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x10127bc0]
addss xmm0, dword [0x10127d40]
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call edi
mov eax, dword [0x10132f44]
mov esi, dword [0x10132f54]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10127bf8]
push eax
andps xmm0, xmmword [0x10127eb0]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x10127bc0]
addss xmm0, dword [0x10127d40]
movss dword [ebp - 0xc], xmm0
push 0x40
push 4
push esi
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call edi
mov eax, dword [0x10132f44]
mov esi, dword [0x10132f58]
movsd xmm0, qword [eax]
lea eax, [ebp - 8]
subsd xmm0, qword [0x10127bf8]
push eax
push 0x40
push 4
push esi
andps xmm0, xmmword [0x10127eb0]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x10127bc0]
addss xmm0, dword [0x10127d38]
movss dword [ebp - 0xc], xmm0
call edi
movss xmm0, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10082d8f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret