joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a5a0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x44a60a
push esi
lea edi, [eax + 0x400]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x44a5da
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x44a626
push ecx
push esi
call fcn.0044b720
add esp, 8
mov ebx, eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x44a680
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x44a69e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x44a693
pop esi
ret

Function at 0x44a6f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x44a782
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x44a774
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x44a76c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x44a735
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x10001e04
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
je 0x10001e18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
or ecx, 0xffffffff
mov al, byte [edx]
test al, al
je 0x10001e4a
push esi
movzx eax, al
push 7
xor ecx, eax
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jns 0x10001e2d
inc edx
mov al, byte [edx]
test al, al
jne 0x10001e25
pop esi
not ecx
mov eax, ecx
pop ebp
ret

Function at 0x10001ecf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0xa], 0x642e3233
push eax
mov word [ebp - 6], 0x6c6c
mov byte [ebp - 4], 0
mov word [ebp - 0xf], 0x7265
mov word [ebp - 0xc], 0x6c65
mov byte [ebp - 0x10], 0x4b
mov byte [ebp - 0xd], 0x6e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret

Function at 0x10001f62
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
lea eax, [ebp - 0x1c]
mov word [ebp - 0x18], 0x6574
push eax
or esi, 0xffffffff
mov dword [ebp - 7], 0x746f68
mov dword [ebp - 0x15], 0x686c6f6f
mov dword [ebp - 0x1c], 0x61657243
mov word [ebp - 0x11], 0x6c65
mov dword [ebp - 0xb], 0x7370616e
mov byte [ebp - 0x16], 0x54
mov word [ebp - 0xe], 0x3233
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xf], 0x70
call fcn.10001ecf
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001fc4
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001fcb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0xf], 0x65636f72
xor ebx, ebx
mov dword [ebp - 6], 0x74737269
push eax
mov dword [ebp - 0xb], 0x32337373
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 2], bl
mov byte [ebp - 7], 0x46
call fcn.10001ecf
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002012
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002019
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0x10]
mov word [ebp - 0xa], 0x3373
push eax
xor ebx, ebx
mov word [ebp - 0xd], 0x6563
mov dword [ebp - 6], 0x747865
mov word [ebp - 8], 0x4e32
mov byte [ebp - 0xb], 0x73
mov word [ebp - 0x10], 0x7250
mov byte [ebp - 0xe], 0x6f
call fcn.10001ecf
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002067
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov ebx, eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002966
Capabilities:
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x10010ef8
call fcn.10003eb4
sub esp, 0x10
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push eax
push eax
push 3
push eax
push eax
push 0x80000000
push dword [ebp + 8]
inc ebx
mov dword [ebp - 4], ebx
call fcn.10001f08
mov edi, eax
add esp, 0x1c
cmp edi, 0xffffffff
je 0x10002a68
and dword [ebp - 0x18], 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x10002a68
push esi
call fcn.10003f2a
pop ecx
push 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], eax
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.10003f2a
xor edx, edx
mov edi, eax
mov dword [ebp - 0x10], edx
pop ecx
test esi, esi
je 0x10002a11
mov eax, dword [ebp - 0x14]
sub eax, edi
mov ebx, eax
lea ecx, [edx + edi]
mov eax, edx
cdq
idiv dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov al, byte [edx + eax]
xor al, byte [ebx + ecx]
mov edx, dword [ebp - 0x10]
inc edx
mov byte [ecx], al
mov dword [ebp - 0x10], edx
cmp edx, esi
jb 0x100029ef
xor ebx, ebx
inc ebx
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0xc]
call fcn.10001f08
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x10002a61
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push 0
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call fcn.10003f33
push edi
call fcn.10003f33
pop ecx
pop ecx
jmp 0x10002a6a
push edi
call fcn.10003f33
pop ecx
xor bl, bl
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001c6f
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10001c6f
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003456
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [ebp + 0x14]
push esi
mov dword [0x1001895c], eax
mov esi, 0x400
mov eax, dword [ebp + 0x10]
mov dword [0x10018960], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [0x10018964], eax
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.10006170
lea eax, [ebp - 0x824]
push eax
call fcn.10003153
push esi
lea eax, [ebp - 0x424]
push 0
push eax
call fcn.10006170
lea eax, [ebp - 0x424]
push eax
call fcn.10003153
add esp, 0x20
mov dword [ebp - 4], 0x336b65
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0x62753733
mov dword [ebp - 0xb], 0x69657465
mov dword [ebp - 0x14], 0x6b746d34
push 0x23
push eax
push ecx
lea eax, [ebp - 0x424]
mov word [ebp - 0x1e], 0x3063
mov ecx, esp
mov word [ebp - 0x21], 0x306f
push eax
mov dword [ebp - 0x10], 0x766b6c77
mov word [ebp - 6], 0x3439
mov word [ebp - 0x24], 0x7a65
mov dword [ebp - 0x18], 0x64657578
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x22], 0x75
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0xc], 0x34
call fcn.10001109
push ecx
lea eax, [ebp - 0x824]
mov ecx, esp
push eax
call fcn.10001109
call fcn.10002966
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4011d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x9c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 4], eax
push ebx
push esi
push edi
test eax, eax
je 0x40138c
xor ebx, ebx
lea esi, [esp + 0x24]
xor eax, eax
mov edx, eax
lea ecx, [ebx + eax]
and edx, 7
inc eax
xor cl, byte [edx + 0x41aa38]
mov byte [esi], cl
inc esi
cmp eax, 0x10
jl 0x401202
inc ebx
cmp ebx, 8
jl 0x401200
push 1
call fcn.004064b0
mov edi, eax
add esp, 4
test edi, edi
je 0x40138c
xor esi, esi
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + section..text]
mov edx, esi
mov ebx, esi
mov byte [esi + edi], al
inc ecx
inc esi
cmp ecx, 1
jae 0x40128d
and edx, 7
mov al, byte [edx + 0x41aa38]
xor al, byte [ecx + section..text]
inc ecx
test al, 0xc0
jne 0x40128d
test bl, 1
je 0x401288
cmp ecx, 1
jae 0x40128d
mov eax, esi
and eax, 7
mov al, byte [eax + 0x41aa38]
xor al, byte [ecx + section..text]
inc ecx
test al, 0xc0
jne 0x40128d
cmp ecx, 1
jb 0x401240
mov eax, esi
neg eax
and eax, 0xf
push ebp
push 1
mov dword [esp + 0x14], eax
lea ebp, [esi + eax]
push ebp
call fcn.004044b0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4012d1
push edi
call fcn.004064a0
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0040150e
add esp, 0x9c
ret
push esi
push edi
push ebx
call fcn.00402ff0
push dword [esp + 0x1c]
lea eax, [esi + ebx]
push 0x90
push eax
call fcn.00402570
push edi
call fcn.004064a0
add esp, 0x1c
test ebp, ebp
je 0x40133e
lea edi, [ebp - 1]
mov esi, ebx
shr edi, 4
inc edi
movups xmm0, xmmword [esi]
lea edx, [esp + 0x28]
lea ecx, [esp + 0x18]
movups xmmword [esp + 0x18], xmm0
call fcn.00401050
lea esi, [esi + 0x10]
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi - 0x10], xmm0
sub edi, 1
jne 0x401301
mov esi, ebp
nop dword [eax]
cmp byte [ebx + esi - 1], 0x90
jne 0x401340
sub esi, 1
jne 0x401330
jmp 0x401340
mov esi, ebp
push esi
call fcn.004064b0
mov edi, eax
add esp, 4
test edi, edi
jne 0x401365
push ebp
push eax
push ebx
call fcn.00402570
push ebx
call fcn.004064a0
add esp, 0x10
jmp 0x4012b6
push esi
push ebx
push edi
call fcn.00402ff0
mov eax, dword [esp + 0x20]
push ebp
push 0
push ebx
mov dword [eax], esi
call fcn.00402570
push ebx
call fcn.004064a0
add esp, 0x1c
mov eax, edi
jmp 0x4012b8
mov ecx, dword [esp + 0xa4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040150e
add esp, 0x9c
ret

Function at 0x401890
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x4018c5
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x4018c2
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x4018ce
add edx, 0x28
cmp edx, esi
jne 0x4018b0
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x4018cb
Function at 0x401d0d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401d4c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401d4c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401d4c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401d4c
cmp dword [ecx + 0x74], 0xe
jbe 0x401d4c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40b86d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b90a
push ebx
push esi
call fcn.0040b836
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b7cc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b8b7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b909
push edi
push eax
call fcn.00408690
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b8d7
call fcn.00407cb0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b908
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b7cc
add esp, 0x20
test eax, eax
jne 0x40b8f6
push edi
call fcn.00407cb0
jmp 0x40b8fe
push ebx
call fcn.00407cb0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40feeb
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x40ff05
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x40ff1c
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x40ff74
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.0040bfa6
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x40ff74
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x40ff74
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40ff74
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x40ff6e
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x40ff70
xor bl, bl
mov al, bl
jmp 0x40ff76
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x413cd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x413cfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x413cfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x417b30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x417b52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417b59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417b48
mov eax, 1
add ebx, ebx
jne 0x417b6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417b60
jne 0x417b7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417b60
xor ecx, ecx
sub eax, 3
jb 0x417b90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417c02
mov ebp, eax
add ebx, ebx
jne 0x417b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417ba8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417bcc
inc ecx
add ebx, ebx
jne 0x417bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417bad
jne 0x417bc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417bad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417bec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417bdd
jmp 0x417b4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417bec
add edi, ecx
jmp 0x417b4e
pop esi
mov edi, esi
mov ecx, 0xe4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417c0a
cmp byte [edi], 9
jne 0x417c0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x417c0f
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417c87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x177c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417c3c
mov ecx, edi
jns 0x417c6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1784c]
or eax, eax
je 0x417c81
mov dword [ebx], eax
add ebx, 4
jmp 0x417c59
call dword [esi + 0x17848]
mov ebp, dword [esi + 0x17850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417cbb
sub esp, 0xffffff80
jmp 0x402dca
Function at 0x10008ee0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37c8
call fcn.10080d50
mov eax, dword [0x100b800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [ecx]
lea eax, [ebp - 0x108]
xor esi, esi
push str..PhysicalDrive_d
push eax
call fcn.100097b0
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push esi
push 3
push esi
push 3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10009103
push 0x2710
lea eax, [ebp - 0x37b8]
mov dword [ebp - 0x37bc], esi
push esi
push eax
mov dword [ebp - 0x37c0], esi
mov dword [ebp - 0x37c8], esi
mov dword [ebp - 0x37c4], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x37bc]
push esi
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0xc
lea eax, [ebp - 0x37c8]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100090f6
mov edx, dword [ebp - 0x37ac]
lea eax, [ebp - 0x8d8]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10008d50
mov edx, dword [ebp - 0x37a8]
lea eax, [ebp - 0xcc0]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10008d50
mov edx, dword [ebp - 0x37a4]
lea eax, [ebp - 0x10a8]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10008d50
mov edx, dword [ebp - 0x37a0]
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0x37b8]
call fcn.10008d50
add esp, 0x20
cmp byte [0x100baef8], 0
jne 0x100090b9
movsx eax, byte [ebp - 0x4f0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
jne 0x10009032
movsx eax, byte [ebp - 0x4dd]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x100090b9
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x8d8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100baaf7], al
test al, al
jne 0x10009040
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0xcc0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100ba2f7], al
test al, al
jne 0x10009060
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x4f0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100baef7], al
test al, al
jne 0x10009080
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x10a8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100ba6f7], al
test al, al
jne 0x100090a0
mov esi, 1
push 0x2710
lea eax, [ebp - 0x37b8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x37bc]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0
push 0
push 0x700a0
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x100090fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1007f9b9
mov esp, ebp
pop ebp
ret
Function at 0x1000a230
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x100b800c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1000a2b1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [esi]
push 0
push dword [ebp - 0xd0]
mov dword [ebp - 0xcc], eax
push 4
push esi
call edi
xor eax, eax
nop word [eax + eax]
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x1000a280
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 0xcc]
push 0
push dword [ebp - 0xd0]
mov dword [esi], eax
push 4
push esi
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1007f9b9
mov esp, ebp
pop ebp
ret 4

Function at 0x1000a2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x100b800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000a317
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x1000a2f4
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f9b9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1007f9b9
mov esp, ebp
pop ebp
ret 4

Function at 0x1000a330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080dfd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x100b800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x100b98e8], 0x10
mov eax, 0x100b98d4
cmovae eax, dword [0x100b98d4]
cmp byte [eax], 0
je 0x1000a44a
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x1000a44a
cmp dword [0x100b9514], 0x10
mov eax, 0x100b9500
cmovae eax, dword [0x100b9500]
cmp byte [eax], 0
je 0x1000a44a
mov esi, 0x100bfd38
mov edx, ecx
sub esi, ecx
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x1000a3a6
mov edx, 0x100bbd08
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1000a3c0
mov ecx, dword [0x100c05f8]
mov edx, 0x100b98d4
cmp dword [0x100b98e8], 0x10
push 0x100bfd38
cmovae edx, dword [0x100b98d4]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
test eax, eax
jne 0x1000a44a
mov ecx, 0x98
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x100a5bc8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x1000a41d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x1000a400
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov eax, dword [0x100bb714]
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [0x100bb714]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4