joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17b320
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00016c44
mov eax, dword [ebp - 8]
call fcn.00016c44
xor eax, eax
push ebp
push 0x17b50b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00016c5c
mov eax, dword [ebp - 8]
test eax, eax
je 0x17b376
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x17b376
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.000163bc
test eax, eax
je 0x17b37f
sub eax, 4
mov eax, dword [eax]
dec eax
jl 0x17b4f0
mov edx, 7
mov eax, ebx
call fcn.0017ce20
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00016ce8
mov edi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x17b3d4
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x17b3d4
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.000163bc
test eax, eax
je 0x17b3dd
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x17b3eb
mov eax, dword [ebp - 4]
call fcn.00016ce8
mov esi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_LookupAccountNameW
cmp dword [ebp - 0x10], 1
jae 0x17b419
mov edx, 8
mov eax, ebx
call fcn.0017ce20
jmp 0x17b4f0
xor edx, edx
push ebp
push 0x17b4e9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
call fcn.000142b0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
add eax, eax
call fcn.000142b0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push edi
push esi
call sub.advapi32.dll_LookupAccountNameW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x17b477
mov edx, 8
mov eax, ebx
call fcn.0017ce20
call fcn.00015adc
jmp 0x17b4f0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.0013f38c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x17b4a1
mov edx, 8
mov eax, ebx
call fcn.0017ce20
call fcn.00015adc
jmp 0x17b4f0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
call fcn.00017fec
mov edx, 9
mov eax, ebx
call fcn.0017ce20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17b4f0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00019f24
pop ecx
mov eax, dword [ebp - 0x20]
push eax
call fcn.00019f24
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x17b4e8
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_LocalFree_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17b512
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x17b51c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x17b524
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x17b76f
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0xa
mov eax, dword [ebp - 8]
call fcn.0017ce20
mov eax, dword [ebp - 8]
cmp byte [eax + 0xc0], 0
je 0x17b56b
mov edx, 0xc
mov eax, dword [ebp - 8]
call fcn.0017ce20
jmp 0x17b74c
mov dl, 1
mov eax, dword [0x16eeb4]
call fcn.0016f7d4
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x17b720
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
push ebp
push 0x17b6ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0016f834
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
call fcn.00016e78
push dword [ebp - 0x10]
push 0x17b78c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 8]
call fcn.00024084
push dword [ebp - 0x14]
push 0x17b78c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 0xa]
call fcn.00024084
push dword [ebp - 0x18]
push 0x17b78c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 0xc]
call fcn.00024084
push dword [ebp - 0x1c]
push 0x17b78c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 0xe]
call fcn.00024084
push dword [ebp - 0x20]
push 0x17b78c
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 0x10]
call fcn.00024084
push dword [ebp - 0x24]
push 0x17b78c
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 0x12]
call fcn.00024084
push dword [ebp - 0x28]
push 0x17b78c
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 0x14]
call fcn.00024084
push dword [ebp - 0x2c]
push 0x17b78c
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 0x16]
call fcn.00024084
push dword [ebp - 0x30]
push 0x17b78c
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 0x18]
call fcn.00024084
push dword [ebp - 0x34]
push 0x17b78c
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
call fcn.00024084
push dword [ebp - 0x38]
push 0x17b78c
lea eax, [ebp - 0x3c]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x30]
call fcn.00016e78
push dword [ebp - 0x3c]
push 0x17b78c
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x34]
call fcn.00016e78
push dword [ebp - 0x40]
push 0x17b78c
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 0x3a]
call fcn.00024084
push dword [ebp - 0x44]
lea eax, [ebp - 4]
mov edx, 0x1b
call fcn.00017214
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x17b705
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17b727
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0xc], edx
call fcn.00014f10
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17b776
lea eax, [ebp - 0x44]
mov edx, 0xe
call fcn.00016c54
lea eax, [ebp - 4]
call fcn.00016c4c
ret
Function at 0x182934
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x182b52
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [0x225bd4]
mov eax, dword [eax]
mov edx, 9
call fcn.00126ba8
test al, al
je 0x182b14
xor edx, edx
push ebp
push 0x182b0d
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0x14]
mov eax, dword [0x22609c]
mov eax, dword [eax]
mov edx, dword [0x1820fc]
call fcn.000ec4f0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x225cfc]
mov eax, dword [eax]
mov ecx, 0x182b70
xor edx, edx
call fcn.0016ec3c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, 0x3a0
call fcn.00016c5c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x225cfc]
mov eax, dword [eax]
mov ecx, 0x182bb4
xor edx, edx
call fcn.0016ec3c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, 0x3a4
call fcn.00016c5c
mov eax, dword [ebp - 0x14]
add eax, 0x3a8
mov edx, ebx
call fcn.00016c5c
mov eax, dword [ebp - 0x14]
add eax, 0x3ac
mov edx, dword [ebp - 4]
call fcn.00016c5c
lea eax, [ebp - 0x20]
push eax
mov eax, dword [0x225cfc]
mov eax, dword [eax]
mov ecx, 0x182bf0
xor edx, edx
call fcn.0016ec3c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
add eax, 0x3b0
call fcn.00016c5c
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x225cfc]
mov eax, dword [eax]
mov ecx, 0x182c44
xor edx, edx
call fcn.0016ec3c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
add eax, 0x3b4
call fcn.00016c5c
xor eax, eax
push ebp
push 0x182ab2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x601e8]
call fcn.00068330
mov dword [ebp - 0x10], eax
mov eax, dword [0x2261ec]
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x28]
mov ecx, 0x182c94
call fcn.00017130
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00068548
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x182abc
mov eax, dword [ebp - 0x10]
call fcn.0006843c
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x3b8], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x110]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x3bc]
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x182b14
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x10], edx
call fcn.00014f10
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x14], edx
call fcn.00014f10
ret
cmp byte [ebp - 9], 0
je 0x182b37
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00016ce8
push eax
push 0x182cf8
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x182b59
lea eax, [ebp - 0x28]
mov edx, 5
call fcn.00016c54
ret
Function at 0x18d4cc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x1d268]
call fcn.00017a08
xor eax, eax
push ebp
push 0x18d616
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x224f4c], 0
jne 0x18d520
mov ecx, dword [0x225a58]
mov dl, 1
mov eax, dword [0x1e730]
call fcn.0002a280
call fcn.000159e8
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
mov eax, ebx
call fcn.00016a8c
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x18d624
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00019df8
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x18d567
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x18d5bc
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x18d5b5
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00016ec4
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.00016e5c
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.000237a8
test eax, eax
jne 0x18d5b5
mov ebx, 0x15
jmp 0x18d5c1
mov ebx, 0x10
jmp 0x18d5c1
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x224f4c]
call fcn.0018d338
mov eax, dword [ebp - 4]
call fcn.0018d338
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00019e10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x18d61d
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00016c54
lea eax, [ebp - 0xc]
mov edx, dword [0x1d268]
call fcn.00017ae0
ret
Function at 0x19185c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x191874
add esp, 0xfffffff0
call fcn.00015444
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x19198e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.000142b0
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x191978
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.0018d338
xor eax, eax
push ebp
push 0x191965
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.0018d338
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00016ec4
jmp 0x191936
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.0001750c
mov eax, dword [ebx + 4]
call fcn.00016fcc
dec eax
jle 0x19194a
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x191924
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x19196c
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x191995
lea eax, [ebp - 4]
call fcn.000168c0
ret
Function at 0x1a15f0
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x1a176b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x44]
lea eax, [ebp - 4]
mov ecx, 0x1a178c
call fcn.00017130
xor edx, edx
push ebp
push 0x1a1732
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x3e71c]
call fcn.0004a704
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x1a169b
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80
mov eax, dword [ebp - 4]
call fcn.00024a80
mov eax, dword [0x2261ec]
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x14]
mov ecx, 0x1a17ac
call fcn.00017130
mov eax, dword [ebp - 0x14]
push eax
call fcn.0002f548
mov ecx, eax
mov eax, dword [ebp - 0x10]
pop edx
mov ebx, dword [eax]
call dword [ebx + 0x6c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1a16c4
xor eax, eax
push ebp
push 0x1a16f1
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0002f548
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1a1717
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1a1739
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x10], edx
call fcn.00014f10
ret

Function at 0x1a5b0c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x1a5c18
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.0001487c
lea eax, [ebp - 0x60]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 4]
mov eax, esi
call fcn.00024d34
push 0x1a5c34
push esi
push 0x1a5c44
push edi
lea eax, [ebp - 8]
mov edx, 4
call fcn.00017214
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], 0
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x5c], 0xffffffff
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 4]
call fcn.00016ce8
push eax
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
mov eax, esi
call fcn.00016ce8
push eax
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x60]
cmp eax, 0xffffffff
je 0x1a5be7
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
cmp eax, 0xffffffff
je 0x1a5bf5
push eax
call sub.kernel32.dll_CloseHandle_1
cmp byte [ebp - 9], 0
je 0x1a5bfd
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1a5c1f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1b9160
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
dec ecx
js 0x1b91b1
lea eax, [ebp - 0x30]
cmp word [eax + 0x20], 3
je 0x1b9198
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x1b9188
jmp 0x1b91b1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x1b9199
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1ce8f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x1cea12
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x1ce9ef
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, esi
call fcn.0004a7a8
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, ebx
call fcn.000186b0
cdq
cmp edx, dword [esp + 4]
jne 0x1ce953
cmp eax, dword [esp]
pop edx
pop eax
ja 0x1ce963
jmp 0x1ce957
pop edx
pop eax
jg 0x1ce963
mov eax, ebx
call fcn.000186b0
mov dword [ebp - 0x10], eax
jmp 0x1ce977
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov edi, eax
mov eax, esi
call fcn.0004a7a8
sub edi, eax
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x1a9f0]
call fcn.00018878
add esp, 4
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov eax, esi
call fcn.0004a9fc
mov edx, dword [ebp - 0x10]
dec edx
test edx, edx
jl 0x1ce9b7
inc edx
xor eax, eax
movzx ecx, byte [ebx + eax]
mov esi, dword [ebp - 4]
xor byte [esi + eax], cl
inc eax
dec edx
jne 0x1ce9a9
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0004aa34
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1ce9f6
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x1a9f0]
call fcn.00018878
add esp, 4
ret
Function at 0x1cfa70
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, eax
xor eax, eax
push ebp
push 0x1cfbf1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1cfbd6
push dword [edi + 0x24]
push 0x1cfc10
push 0x1cfc6c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov dword [ebp - 0x18], 0x71b5a724
mov dword [ebp - 0x14], 0xc040cea6
mov dword [ebp - 0x10], 0xc589e91e
mov dword [ebp - 0xc], 0x171032de
mov eax, esi
mov ecx, 0x1cfcd0
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x18]
call fcn.00129454
test al, al
jne 0x1cfb4d
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1cfbd6
push 0
push 0x677
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1cfbd6
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 0x28], 0x511febd
mov dword [ebp - 0x24], 0x91c7b66d
mov dword [ebp - 0x20], 0x39a6d33a
mov dword [ebp - 0x1c], 0xeaa1f789
mov eax, dword [ebp + 8]
xor edx, edx
call fcn.00016c5c
lea edx, [ebp - 0x38]
mov eax, dword [esi]
call fcn.0012931c
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x38]
call fcn.00129454
test al, al
jne 0x1cfbd4
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1cfbd6
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1cfbf8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret
Function at 0x1cfd18
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x1cfed8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, esi
xor edx, edx
call fcn.00016c5c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x10
call fcn.0001487c
lea edx, [ebp - 8]
mov eax, edi
call fcn.001d1da8
test al, al
je 0x1cfebd
push dword [edi + 0x24]
push 0x1cfef8
push 0x1cff3c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00017214
mov dword [ebp - 0x1c], 0x662b1833
mov dword [ebp - 0x18], 0x1ca75c52
mov dword [ebp - 0x14], 0xd531c89f
mov dword [ebp - 0x10], 0x4358d5b6
mov eax, esi
mov ecx, 0x1cff70
mov edx, dword [ebp - 8]
call fcn.00017130
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0012931c
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x1c]
call fcn.00129454
test al, al
jne 0x1cfdf9
mov edx, 0xe
mov eax, edi
call fcn.001d2018
jmp 0x1cfebd
push 0
push 0x3ce
mov ecx, dword [esi]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.001d1f50
test al, al
je 0x1cfebd
push 4
push 0
mov eax, dword [esi]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00016ce8
push eax
call sub.kernel32.dll_MoveFileExW
mov dword [ebp - 0x2c], 0x2221b656
mov dword [ebp - 0x28], 0x2948d8bd
mov dword [ebp - 0x24], 0x19bd2dea
mov dword [ebp - 0x20], 0xb148814
mov eax, ebx
and al, 3
cmp al, 1
jne 0x1cfe68
mov eax, dword [ebp + 8]
mov edx, 0x1cffa0
call fcn.00016c5c
mov eax, ebx
and al, 3
cmp al, 2
jne 0x1cfe7d
mov eax, dword [ebp + 8]
mov edx, 0x1d0000
call fcn.00016c5c
and bl, 3
cmp bl, 3
jne 0x1cfe92
mov eax, dword [ebp + 8]
mov edx, 0x1d0068
call fcn.00016c5c
lea edx, [ebp - 0x3c]
mov eax, dword [esi]
call fcn.0012931c
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x3c]
call fcn.00129454
test al, al
jne 0x1cfeb9
mov edx, 0xf
mov eax, edi
call fcn.001d2018
jmp 0x1cfebd
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1cfedf
lea eax, [ebp - 8]
mov edx, 2
call fcn.00016c54
ret