joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017100
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100400bb
mov eax, dword fs:[0]
push eax
sub esp, 0x198
mov eax, dword [0x10057050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x1005c96c]
lea eax, [ebp - 0x34]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x1001733a
cmp dword [0x1005ca14], 1
jne 0x100171d8
sub esp, 0xc
lea ecx, [ebp - 0x1a0]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nFN_Scan:____File_not_found:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1a0]
call fcn.10005630
mov edx, edi
lea ecx, [ebp - 0x1a0]
call fcn.10005630
lea ecx, [ebp - 0x19c]
call fcn.10004900
test eax, eax
jne 0x100171c6
mov eax, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1a0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005ca24], 1
jne 0x100172bb
lea eax, [ebp - 0x40]
push eax
call fcn.10021a7f
add esp, 4
lea eax, [ebp - 0x40]
push eax
call fcn.10021d6c
sub esp, 8
lea ecx, [ebp - 0xf0]
mov esi, eax
push 0x1004d0d0
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xf0]
call fcn.10005630
push esi
call fcn.10022798
add esp, 4
lea ecx, [ebp - 0xf0]
mov edx, eax
call fcn.10005630
mov edx, str.FN_Scan:____File_not_found:
lea ecx, [ebp - 0xf0]
call fcn.10005630
mov edx, edi
lea ecx, [ebp - 0xf0]
call fcn.10005630
mov edx, str._n__________________
lea ecx, [ebp - 0xf0]
call fcn.10005630
lea ecx, [ebp - 0xec]
call fcn.10004900
test eax, eax
jne 0x100172a3
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0xf0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004d0d0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xf0]
call fcn.100030f0
mov eax, dword [0x1005ca18]
push 0
cmp eax, 1
jne 0x100172ed
push 0
push 0
push 0x10016e60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x100172fd
push 0
push 0
push 0x10016e80
jmp 0x100172d0
cmp eax, 3
jne 0x1001730d
push 0
push 0
push 0x10001f10
jmp 0x100172d0
cmp eax, 4
jne 0x100172e7
push 0
push 0
push 0x1001afe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.FN_Scan
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x100172e5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001c32d
mov esp, ebp
pop ebp
ret
Function at 0x10017360
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f64b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x10057050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005ca14], 1
jne 0x1001741d
sub esp, 0xc
lea ecx, [ebp - 0x178]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nFN_Scan:____Thats_not_my_name__My_name_is:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10005630
mov edx, dword [0x1005c948]
lea ecx, [ebp - 0x178]
call fcn.10005630
lea ecx, [ebp - 0x174]
call fcn.10004900
test eax, eax
jne 0x1001740b
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005ca24], 1
jne 0x10017504
lea eax, [ebp - 0x18]
push eax
call fcn.10021a7f
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.10021d6c
sub esp, 8
lea ecx, [ebp - 0xc8]
mov esi, eax
push 0x1004d0d0
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10005630
push esi
call fcn.10022798
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10005630
mov edx, str.FN_Scan:____Thats_not_my_name__My_name_is:
lea ecx, [ebp - 0xc8]
call fcn.10005630
mov edx, dword [0x1005c948]
lea ecx, [ebp - 0xc8]
call fcn.10005630
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10005630
lea ecx, [ebp - 0xc4]
call fcn.10004900
test eax, eax
jne 0x100174ec
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004d0d0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.100030f0
mov eax, dword [0x1005ca18]
push 0
cmp eax, 1
jne 0x10017536
push 0
push 0
push 0x10016e60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10017546
push 0
push 0
push 0x10016e80
jmp 0x10017519
cmp eax, 3
jne 0x10017556
push 0
push 0
push 0x10001f10
jmp 0x10017519
cmp eax, 4
jne 0x10017530
push 0
push 0
push 0x1001afe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.FN_Scan
push dword [0x1005c948]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1001752e
Function at 0x10017590
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f64b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x10057050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005ca14], 1
jne 0x1001764d
sub esp, 0xc
lea ecx, [ebp - 0x178]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nFN_Scan:____Thats_not_my_name__My_name_is:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10005630
mov edx, dword [0x1005c97c]
lea ecx, [ebp - 0x178]
call fcn.10005630
lea ecx, [ebp - 0x174]
call fcn.10004900
test eax, eax
jne 0x1001763b
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005ca24], 1
jne 0x10017734
lea eax, [ebp - 0x18]
push eax
call fcn.10021a7f
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.10021d6c
sub esp, 8
lea ecx, [ebp - 0xc8]
mov esi, eax
push 0x1004d0d0
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10005630
push esi
call fcn.10022798
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10005630
mov edx, str.FN_Scan:____Thats_not_my_name__My_name_is:
lea ecx, [ebp - 0xc8]
call fcn.10005630
mov edx, dword [0x1005c97c]
lea ecx, [ebp - 0xc8]
call fcn.10005630
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10005630
lea ecx, [ebp - 0xc4]
call fcn.10004900
test eax, eax
jne 0x1001771c
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004d0d0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.100030f0
mov eax, dword [0x1005ca18]
push 0
cmp eax, 1
jne 0x10017766
push 0
push 0
push 0x10016e60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10017776
push 0
push 0
push 0x10016e80
jmp 0x10017749
cmp eax, 3
jne 0x10017786
push 0
push 0
push 0x10001f10
jmp 0x10017749
cmp eax, 4
jne 0x10017760
push 0
push 0
push 0x1001afe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.FN_Scan
push dword [0x1005c97c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1001775e
Function at 0x10017800
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f64b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
push esi
mov eax, dword [0x10057050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005ca14], 1
jne 0x100178bd
sub esp, 0xc
lea ecx, [ebp - 0x178]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nFN_Scan:____Thats_not_my_window_Name__My_window_name_is:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.10005630
mov edx, dword [0x1005c978]
lea ecx, [ebp - 0x178]
call fcn.10005630
lea ecx, [ebp - 0x174]
call fcn.10004900
test eax, eax
jne 0x100178ab
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x178]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 0xffffffff
call fcn.100030f0
cmp dword [0x1005ca24], 1
jne 0x100179a4
lea eax, [ebp - 0x18]
push eax
call fcn.10021a7f
add esp, 4
lea eax, [ebp - 0x18]
push eax
call fcn.10021d6c
sub esp, 8
lea ecx, [ebp - 0xc8]
mov esi, eax
push 0x1004d0d0
call fcn.10004170
mov edx, str._nLocal_Time:
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.10005630
push esi
call fcn.10022798
add esp, 4
lea ecx, [ebp - 0xc8]
mov edx, eax
call fcn.10005630
mov edx, str.FN_Scan:____Thats_not_my_Window_name__My_Window_Name_is:
lea ecx, [ebp - 0xc8]
call fcn.10005630
mov edx, dword [0x1005c978]
lea ecx, [ebp - 0xc8]
call fcn.10005630
mov edx, str._n__________________
lea ecx, [ebp - 0xc8]
call fcn.10005630
lea ecx, [ebp - 0xc4]
call fcn.10004900
test eax, eax
jne 0x1001798c
mov eax, dword [ebp - 0xc8]
lea ecx, [ebp - 0xc8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
push 2
push 0x1004d0d0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc8]
call fcn.100030f0
mov eax, dword [0x1005ca18]
push 0
cmp eax, 1
jne 0x100179d6
push 0
push 0
push 0x100177c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x100179e6
push 0
push 0
push 0x100177e0
jmp 0x100179b9
cmp eax, 3
jne 0x100179f6
push 0
push 0
push 0x10001f10
jmp 0x100179b9
cmp eax, 4
jne 0x100179d0
push 0
push 0
push 0x1001afe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.FN_Scan
push dword [0x1005c978]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x100179ce
Function at 0x10017a30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100400fd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10057050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, eax
mov dword [ebp - 0x28], 0
push 0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.10014a30
mov dword [ebp - 4], 0
lea eax, [esi + 1]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push eax
cmovae ecx, dword [ebp - 0x28]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [0x1005c978]
mov edi, edx
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x10017ac0
mov ebx, dword [ebp - 0x28]
sub edi, ecx
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x18]
cmovae ecx, ebx
cmp esi, edi
jne 0x10017b83
sub esi, 4
jb 0x10017af7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10017afc
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10017ae6
cmp esi, 0xfffffffc
je 0x10017b30
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10017b29
cmp esi, 0xfffffffd
je 0x10017b30
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10017b29
cmp esi, 0xfffffffe
je 0x10017b30
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10017b29
cmp esi, 0xffffffff
je 0x10017b30
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10017b30
sbb eax, eax
or eax, 1
jmp 0x10017b32
xor eax, eax
test eax, eax
jne 0x10017b83
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x10017b65
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x10017b5b
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017b88
push ecx
push ebx
call fcn.1001c685
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001c32d
mov esp, ebp
pop ebp
ret
call fcn.10017800
call fcn.10020d58
int3
Function at 0x10017e70
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x1005cb20
call fcn.1001e1c0
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x10017e9b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10017ea6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10017eb1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x10017ebc
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10017ec7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10017ed2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x10017edd
bts eax, 1
test cl, 2
je 0x10017ee6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
xor edx, edx
lea ecx, [edx + 1]
nop dword [eax]
test bl, 1
je 0x10017f7f
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10017f70
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x1005cb20], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10017e90
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017fb0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10057050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x100519c4
push eax
or ebx, 0xffffffff
call fcn.10024651
add esp, 8
mov dword [ebp - 0x408], eax
test eax, eax
jne 0x10017ff6
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c32d
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop dword [eax + eax]
push eax
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.1002213c
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x1001804d
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1005cb20]
sub edx, 1
jne 0x10018025
mov eax, dword [ebp - 0x408]
cmp edi, 0x400
je 0x10018000
push dword [ebp - 0x408]
call fcn.1002129b
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.1001c32d
mov esp, ebp
pop ebp
ret 4
Function at 0x10019e10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
mov esi, ecx
push esi
push 0
call edi
test eax, eax
je 0x10019edd
push ebx
push esi
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [ebp - 4]
push ecx
push eax
call ebx
push dword [ebp - 4]
push 1
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x1005ca18]
cmp eax, 1
jne 0x10019e89
push 0
push 0
push 0
push 0x10019de0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10019e9b
push 0
push 0
push 0
push 0x10019db0
jmp 0x10019e6c
cmp eax, 3
jne 0x10019ead
push 0
push 0
push 0
push 0x10001f10
jmp 0x10019e6c
push esi
push 0
call edi
lea ecx, [ebp - 4]
push ecx
push eax
call ebx
push dword [ebp - 4]
mov eax, dword [sym.imp.KERNEL32.dll_OpenProcess]
push 1
push 0x100001
call eax
push 0
push eax
mov eax, dword [sym.imp.KERNEL32.dll_TerminateProcess]
call eax
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001abf0
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x1005ca18]
cmp eax, 1
je 0x1001ac3c
cmp eax, 4
je 0x1001ac3c
push 0
cmp eax, 2
jne 0x1001ac2c
push 0
push 0
push 0x1001ab90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x1001ac26
push 0
push 0
push 0x10001f10
jmp 0x1001ac0f
push 0
push 0
push 0
push 0x1001abc0
jmp 0x1001ac0f
Function at 0x1001b0a0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100402e0
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x10057050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1005ca14], 1
jne 0x1001b150
sub esp, 0xc
lea ecx, [ebp - 0xbc]
push str.OpenGuard.txt
call fcn.10004170
mov edx, str._nAKS_Scan:
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xbc]
call fcn.10005630
mov edx, str.Thread_attack_
lea ecx, [ebp - 0xbc]
call fcn.10005630
lea ecx, [ebp - 0xb8]
call fcn.10004900
test eax, eax
jne 0x1001b145
mov eax, dword [ebp - 0xbc]
lea ecx, [ebp - 0xbc]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001d70
lea ecx, [ebp - 0xbc]
call fcn.100030f0
mov eax, dword [0x1005ca18]
cmp eax, 1
je 0x1001b19c
cmp eax, 4
je 0x1001b19c
push 0
cmp eax, 2
jne 0x1001b18c
push 0
push 0
push 0x1001b000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x1001b186
push 0
push 0
push 0x10001f10
jmp 0x1001b16f
push 0
push 0
push 0
push 0x1001b050
jmp 0x1001b16f

Function at 0x1001b470
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10007be0
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov eax, dword [0x1005cabc]
cdq
sub eax, edx
mov dword [0x1005d748], 1
sar eax, 1
push eax
mov dword [0x1005d728], 1
call ebx
mov eax, 0x10624dd3
inc esi
imul dword [0x1005caa8]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jne 0x1001b492
push 0
push 0
push 0
push 0x10007be0
push 0
push 0
call edi
jmp 0x1001b490

Function at 0x1002ec8c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002eb02

Function at 0x1003727b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10036ef8
Function at 0x401000
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff60
mov eax, dword [0x412008]
xor eax, esp
mov dword [esp + 0x9c], eax
push 0x98
lea eax, [esp + 8]
push 0
push eax
call fcn.00406b00
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
or eax, eax
jne 0x401053
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004033e4
add esp, 0xa0
ret
mov eax, dword [esp + 4]
cmp eax, 6
jne 0x4010e1
mov eax, dword [esp + 8]
or eax, eax
jne 0x40108c
cmp byte [esp + 0x9a], 1
setne al
mov ecx, dword [esp + 0x9c]
xor ecx, esp
lea eax, [eax + eax + 4]
call fcn.004033e4
sub esp, 0xffffff60
ret
cmp eax, 1
jne 0x4010b7
xor eax, eax
cmp byte [esp + 0x9a], 1
mov ecx, dword [esp + 0x9c]
setne al
xor ecx, esp
lea eax, [eax + eax + 5]
call fcn.004033e4
add esp, 0xa0
ret
cmp eax, 2
jne 0x401131
xor eax, eax
cmp byte [esp + 0x9a], 1
mov ecx, dword [esp + 0x9c]
setne al
sub eax, 0xfffffff8
xor ecx, esp
call fcn.004033e4
sub esp, 0xffffff60
ret
cmp eax, 5
jne 0x401131
mov eax, dword [esp + 8]
cmp eax, 2
jne 0x401109
mov ecx, dword [esp + 0x9c]
mov eax, 3
xor ecx, esp
call fcn.004033e4
add esp, 0xa0
ret
cmp eax, 1
jne 0x401128
mov ecx, dword [esp + 0x9c]
xor ecx, esp
mov eax, 2
call fcn.004033e4
sub esp, 0xffffff60
ret
or eax, eax
jne 0x401131
mov eax, 1
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004033e4
add esp, 0xa0
ret

Function at 0x401170
Capabilities:
Get disk information

Disassembly:
sub esp, 0x810
mov eax, dword [0x412008]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0x415]
push ebx
push eax
mov byte [esp + 0x41c], bl
call fcn.00406b00
push 0x3ff
lea ecx, [esp + 0x21]
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x28], bl
call fcn.00406b00
add esp, 0x18
push 0x400
lea ebx, [esp + 0x14]
push ebx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x428]
push eax
push 0x410470
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [esp + 0x810]
neg eax
sbb eax, eax
and eax, dword [esp + 4]
pop ebx
xor ecx, esp
call fcn.004033e4
add esp, 0x810
ret