joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e330
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10183a20
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x120
push ebx
push esi
push edi
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
xor ebx, ebx
lea edi, [esi + 1]
mov dword [ebp - 0x2c], ebx
cmp ebx, dword [ebp + 0xc]
jge 0x1009e3e5
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x130], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x1c], 5
lea ecx, [ebp - 0x28]
push ecx
push esi
push esi
lea edx, [ebp - 0x130]
push edx
push esi
call sub.WS2_32.dll_select
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 7
cmp eax, esi
jne 0x1009e3de
add ebx, edi
mov dword [ebp - 0x1c], 0xa
jmp 0x1009e37e
mov dword [ebp - 0x1c], 9
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a5fd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [0x101c8674], 0
push ebx
push ebp
push esi
push edi
jne 0x100a6005
mov esi, 1
mov dword [0x101c8674], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x100a6005
cmp al, 6
jb 0x100a6005
mov dword [0x101c8678], esi
cmp dword [0x101cc80c], 0
mov ebp, dword [0x101c8678]
jne 0x100a6062
mov esi, 0x101a4ae0
mov edi, 0x31
test ebp, ebp
jne 0x100a6040
mov eax, dword [esi]
cmp eax, 0x1000
jb 0x100a6040
add eax, 0xfffff000
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
jmp 0x100a6046
push esi
lea edx, [esp + 0x28]
push edx
mov ebx, 0x101c2be8
call fcn.10050df0
add esi, 4
sub edi, 1
jne 0x100a601e
mov dword [0x101cc80c], 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100a6070
Capabilities:
Get common file path

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esp + 0x14], 0
mov ebp, eax
je 0x100a6241
cmp dword [0x1018e4ec], 0xffffffff
jne 0x100a60b3
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1018e4ec
xor ebx, ebx
xor edx, edx
xor ecx, ecx
call fcn.1006bdc0
add esp, 0x20
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
test esi, esi
je 0x100a60c8
push 0x10157108
push esi
jmp 0x100a61d4
cmp byte [0x101cc810], 0
jne 0x100a61ca
push 0x105
push 0x101cc810
call fcn.1005f830
add esp, 8
mov ecx, 0x101cc810
call fcn.10065200
push str.general.log
push 0x101cc810
call ebx
push 0x10157108
push 0x101cc810
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
jne 0x100a61e2
push 0x105
push 0x101cc810
mov byte [0x101cc810], al
call fcn.1005f830
add esp, 8
mov ecx, 0x101cc810
call fcn.10065200
push str.TEMPgeneral.log
push 0x101cc810
call ebx
push 0x10157108
push 0x101cc810
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
jne 0x100a61e2
push 0x101cc810
push 0x105
mov byte [0x101cc810], al
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, 0x101cc810
call fcn.10065200
push str.general.log
push 0x101cc810
call ebx
push 0x10157108
push 0x101cc810
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
jne 0x100a61e2
mov ecx, 0x101cc810
mov byte [0x101cc810], al
call fcn.1007f9e0
mov ecx, 0x101cc810
call fcn.10065200
push str.general.log
push 0x101cc810
call ebx
push 0x10157108
push 0x101cc810
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
je 0x100a6241
push 0x5000
call fcn.10128320
mov edi, eax
add esp, 4
test edi, edi
je 0x100a6241
lea eax, [esp + 0x18]
mov byte [edi], 0
mov ecx, dword [esp + 0x14]
push eax
push ecx
push edi
call fcn.1012b69a
add esp, 0xc
cmp byte [edi], 0
mov eax, edi
je 0x100a6218
inc eax
cmp byte [eax], 0
jne 0x100a6212
sub eax, edi
je 0x100a6223
cmp byte [eax + edi - 1], 0xa
je 0x100a622b
push 0x1015804c
push edi
call ebx
push esi
push edi
call fcn.101294a6
push esi
call fcn.10129ad3
push edi
call fcn.10128243
add esp, 0x10
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100a84c0
Capabilities:
Check os version
Create thread

Disassembly:
push 0x101ba3f4
push str.WEvtDebug
mov ecx, str.SoftwareMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059e30
push 0x1018e5f4
push str.MonitorWinEventLogs
mov ecx, str.SoftwareMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059e30
cmp dword [0x1018e5f4], 0
je 0x100a8575
cmp dword [0x101c8674], 0
jne 0x100a8528
mov dword [0x101c8674], 1
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x100a8528
cmp al, 6
jb 0x100a8528
mov dword [0x101c8678], 1
jmp 0x100a8531
cmp dword [0x101c8678], 0
je 0x100a8570
push 0
push 0
push 0x10099ed0
call fcn.10127f7d
push 0
mov eax, 0x101ba1e8
call fcn.100a6070
push 0
xor ecx, ecx
call fcn.100a6250
add esp, 0x14
call fcn.100a5fd0
call fcn.100a7a60
call fcn.100a7bb0
call fcn.100a7ce0
jmp fcn.100a7e10
jmp fcn.1006b740
ret
Function at 0x100ac220
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
xor esi, esi
cmp dword [0x101ba630], esi
jbe 0x100ac24e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0xc]
push eax
push 1
push 0x1016df00
push ebx
call edi
inc esi
cmp esi, dword [0x101ba630]
jb 0x100ac233
pop edi
pop esi
pop ecx
ret

Function at 0x100ac260
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x404], eax
cmp dword [0x101ba630], 0
push ebx
push esi
mov ebx, ecx
mov esi, edx
je 0x100ac288
call fcn.100ac220
cmp dword [esp + 0x414], 0
push edi
push esi
je 0x100ac2a0
push str.__s_:__u_
lea eax, [esp + 0x18]
push eax
jmp 0x100ac2aa
push str.__s_:__u
lea ecx, [esp + 0x18]
push ecx
call fcn.10127dc0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x10
cmp byte [esp + 0xc], 0
je 0x100ac2df
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100ac2c6
sub eax, edx
push 0
lea edx, [esp + 0xc]
push edx
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call esi
push 0
lea ecx, [esp + 0xc]
push ecx
push 2
push 0x10155f64
push ebx
call esi
mov ecx, dword [esp + 0x40c]
pop esi
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x408
ret

Function at 0x100ac310
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
push ebp
mov ebp, dword [esp + 0x414]
push esi
mov esi, edx
mov al, byte [esi]
mov ebx, ecx
cmp al, 0x7d
je 0x100ac33c
cmp al, 0x5d
jne 0x100ac342
dec dword [0x101ba630]
cmp dword [0x101ba630], 0
je 0x100ac350
call fcn.100ac220
mov al, byte [esi]
cmp al, 0x7b
je 0x100ac35a
cmp al, 0x5b
jne 0x100ac360
inc dword [0x101ba630]
cmp al, 0x7b
je 0x100ac3d0
cmp al, 0x7d
je 0x100ac3d0
cmp al, 0x5b
je 0x100ac3d0
cmp al, 0x5d
je 0x100ac3d0
cmp byte [edi], 0
je 0x100ac3bf
test al, al
je 0x100ac3a7
push esi
push edi
test ebp, ebp
je 0x100ac393
lea eax, [esp + 0x18]
push str.__s_:___s__
push eax
call fcn.10127dc0
add esp, 0x10
jmp 0x100ac3fd
lea ecx, [esp + 0x18]
push str.__s_:___s_
push ecx
call fcn.10127dc0
add esp, 0x10
jmp 0x100ac3fd
push edi
test ebp, ebp
je 0x100ac3b3
push str.__s__
jmp 0x100ac3f0
push 0x10157d74
lea eax, [esp + 0x18]
push eax
jmp 0x100ac3f5
push esi
test ebp, ebp
je 0x100ac3eb
push 0x10175dc0
lea ecx, [esp + 0x18]
push ecx
jmp 0x100ac3f5
cmp byte [edi], 0
je 0x100ac3bf
push esi
push edi
lea eax, [esp + 0x18]
push str.__s_:__s
push eax
call fcn.10127dc0
add esp, 0x10
jmp 0x100ac3fd
push 0x1014d8cc
lea edx, [esp + 0x18]
push edx
call fcn.10127dc0
add esp, 0xc
cmp byte [esp + 0x10], 0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x100ac42a
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100ac411
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x1c]
push edx
push ebx
call esi
push 0
lea eax, [esp + 0x10]
push eax
push 2
push 0x10155f64
push ebx
call esi
mov ecx, dword [esp + 0x410]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x408
ret
Function at 0x100b7c30
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x100b7c5d
push esi
push edi
jmp 0x100b7c40
movzx esi, byte [edx]
movzx esi, byte [esi + 0x1014dc58]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x100b7c40
pop edi
pop esi
ret

Function at 0x100b7cc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x100b7cdd
mov esi, 0x80
cmp esi, dword [edi]
jne 0x100b7cea
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x101ba688]
test eax, eax
je 0x100b7cf5
call eax
lea ecx, [esi*8]
push ecx
call fcn.100b4640
mov ebp, eax
mov eax, dword [0x101ba68c]
add esp, 4
mov dword [esp + 0x10], ebp
test eax, eax
je 0x100b7d16
call eax
test ebp, ebp
je 0x100b7ce1
mov edx, dword [edi + 0xc]
push edx
call fcn.100b4950
add esp, 4
push ebp
mov dword [edi + 0xc], ebp
call dword [0x1018e8c0]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push ebp
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call fcn.1012e060
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x100b7dff
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x100b7d93
nop
movzx ebx, byte [esi]
movzx ebx, byte [ebx + 0x1014dc58]
lea ebp, [eax*8]
xor ebx, ebp
dec edx
xor eax, ebx
inc esi
test edx, edx
jg 0x100b7d70
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
xor edx, edx
div ebx
lea eax, [ebp + edx*8]
test eax, eax
je 0x100b7dda
mov esi, dword [eax]
test esi, esi
je 0x100b7db0
mov edx, dword [eax + 4]
jmp 0x100b7db2
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x100b7dda
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x100b7dd2
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x100b7df3
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x100b7df3
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x100b7de9
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x100b7d63
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x100c9490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x34]
push edi
mov edi, eax
push esi
lea eax, [esp + 0x24]
mov ecx, edi
mov dword [esp + 0x14], ebx
call fcn.100c4560
mov ax, word [esp + 0x3c]
add esp, 4
test ax, ax
je 0x100c9535
movzx ecx, word [esi + 0x12]
add ecx, dword [esi + 0x38]
movzx eax, ax
add eax, edi
lea edx, [eax + 3]
cmp edx, ecx
jbe 0x100c94f8
push 0x1017bf08
push 0xda00
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.100b6110
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx esi, byte [eax]
movzx ecx, byte [eax + 1]
movzx edx, byte [eax + 2]
movzx eax, byte [eax + 3]
shl esi, 8
or esi, ecx
mov ecx, dword [ebx + 0x24]
shl esi, 8
or esi, edx
movzx edx, word [esp + 0x36]
shl esi, 8
or esi, eax
mov eax, dword [esp + 0x30]
sub ecx, 4
sub eax, edx
lea eax, [eax + ecx - 1]
xor edx, edx
div ecx
xor ecx, ecx
cmp eax, ecx
jne 0x100c954a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
xor ecx, ecx
dec eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
cmp esi, 2
jb 0x100c9636
cmp esi, dword [ebx + 0x2c]
ja 0x100c9636
cmp eax, ecx
je 0x100c958e
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push esi
mov edi, ebx
call fcn.100c7860
add esp, 0xc
test eax, eax
jne 0x100c9537
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x100c959d
call fcn.100c5190
mov ebx, dword [esp + 0x10]
mov edi, eax
test edi, edi
je 0x100c95c7
mov eax, dword [edi + 0x44]
cmp word [eax + 0x1a], 1
je 0x100c95c7
push 0x1017bf08
push 0xda22
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.100b6110
add esp, 0x10
mov ebx, 0xb
jmp 0x100c95d5
push esi
push ebx
mov eax, edi
call fcn.100c9140
add esp, 8
mov ebx, eax
test edi, edi
je 0x100c9612
mov eax, dword [edi + 0x44]
test eax, eax
je 0x100c9612
test byte [eax + 0x18], 0x40
mov esi, dword [eax + 0x10]
je 0x100c95f2
mov ecx, eax
call fcn.100bf290
jmp 0x100c95f7
call fcn.100bb860
cmp dword [esi + 0x78], 0
jne 0x100c9612
mov ecx, dword [esi + 0xcc]
cmp dword [ecx + 0xc], 0
jne 0x100c9612
push esi
call fcn.100bdc00
add esp, 4
test ebx, ebx
jne 0x100c962d
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x1c], ebx
jne 0x100c9540
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1017bf08
push 0xda0e
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.100b6110
add esp, 0x10
pop edi
pop esi
mov eax, 0xb
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d27f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x50]
push ebp
mov ebp, dword [eax]
mov cl, byte [ebp + 4]
mov edx, dword [ebp + 0xc]
mov byte [esp + 0x3f], cl
mov ecx, dword [esp + 0x50]
mov al, byte [ecx]
push esi
push edi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], edx
cmp al, 0x80
jae 0x100d2831
movzx eax, al
mov dword [esp + 0x18], eax
mov eax, 1
jmp 0x100d283d
lea esi, [esp + 0x18]
call fcn.100b76a0
movzx eax, al
mov edi, dword [esp + 0x18]
movzx ebx, al
mov dword [esp + 0x1c], 0
add ebp, 0x14
nop
mov ecx, dword [esp + 0x58]
mov al, byte [ecx + ebx]
add ecx, ebx
cmp al, 0x80
jae 0x100d286b
movzx eax, al
mov dword [esp + 0x20], eax
mov ecx, 1
jmp 0x100d287b
lea esi, [esp + 0x20]
call fcn.100b76a0
movzx ecx, al
mov eax, dword [esp + 0x20]
movzx edx, cl
add ebx, edx
mov edx, dword [esp + 0x54]
lea ecx, [eax + edi + 2]
cmp ecx, edx
jbe 0x100d28a5
cmp eax, 0xc
jb 0x100d2898
lea ecx, [eax - 0xc]
shr ecx, 1
jmp 0x100d289f
movzx ecx, byte [eax + 0x1014e3f0]
add ecx, edi
cmp ecx, edx
ja 0x100d291b
mov edx, dword [esp + 0x58]
lea ecx, [edi + edx]
lea esi, [esp + 0x28]
call fcn.100d24a0
mov esi, dword [esp + 0x5c]
add edi, eax
mov eax, dword [ebp]
push eax
mov eax, dword [esi + 8]
add eax, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
call fcn.100cec20
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x100d28fc
inc dword [esp + 0x14]
add dword [esp + 0x1c], 0x28
add ebp, 4
cmp ebx, dword [esp + 0x18]
jae 0x100d2923
movzx ecx, word [esi + 4]
cmp dword [esp + 0x14], ecx
jl 0x100d2850
jmp 0x100d2923
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 0x10]
mov edx, dword [esp + 0x14]
cmp byte [edx + ecx], 0
je 0x100d2956
neg eax
mov dword [esp + 0x10], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
mov esi, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
mov cl, byte [esi + 6]
test cl, 1
je 0x100d293f
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
test cl, 2
jne 0x100d2956
cmp ebx, dword [esp + 0x18]
jae 0x100d2956
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x100e7ce0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov eax, ebp
test ebp, ebp
jne 0x100e7cf7
xor ebx, ebx
jmp 0x100e7d0f
cmp byte [ebp], 0
je 0x100e7d06
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x100e7d00
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x14]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x100e7dd0
jmp 0x100e7d34
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x100e7d3c
xor esi, 1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100e7d61
mov edx, dword [esp + 0x1c]
mov edx, dword [edx + 0x10]
mov ecx, esi
shl ecx, 4
mov ecx, dword [ecx + edx]
push ecx
push eax
call fcn.100b6ae0
add esp, 8
test eax, eax
jne 0x100e7dbd
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x10]
shl esi, 4
mov ecx, dword [esi + eax + 0xc]
add ecx, 8
cmp dword [ecx + 0xc], 0
je 0x100e7da7
xor eax, eax
mov edi, ebx
mov edx, ebp
test ebx, ebx
jle 0x100e7da1
movzx esi, byte [edx]
movzx esi, byte [esi + 0x1014dc58]
lea ebp, [eax*8]
xor esi, ebp
dec edi
xor eax, esi
inc edx
test edi, edi
jg 0x100e7d82
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x100e7da9
xor edx, edx
push ebp
call fcn.100b7e10
add esp, 4
test eax, eax
je 0x100e7dda
mov edi, dword [eax + 8]
test edi, edi
jne 0x100e7dd0
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x100e7d30
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x100e7dbd

Function at 0x100e7ed0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, edi
test edi, edi
jne 0x100e7ee6
xor ebx, ebx
jmp 0x100e7eff
cmp byte [edi], 0
je 0x100e7ef6
jmp 0x100e7ef0
inc eax
cmp byte [eax], 0
jne 0x100e7ef0
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 0x14]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
test edx, edx
jle 0x100e7fc0
mov ecx, dword [ecx + 0x10]
push esi
mov dword [esp + 0x14], ecx
jmp 0x100e7f24
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x100e7f2c
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x100e7f51
mov eax, dword [eax]
push eax
push ecx
call fcn.100b6ae0
add esp, 8
test eax, eax
jne 0x100e7f9f
cmp dword [esi + 0x24], 0
lea ecx, [esi + 0x18]
je 0x100e7f89
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x100e7f83
movzx edi, byte [edx]
movzx edi, byte [edi + 0x1014dc58]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x100e7f64
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x100e7f8b
xor edx, edx
push edi
call fcn.100b7e10
add esp, 4
test eax, eax
je 0x100e7fbc
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x100e7fb2
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x100e7f20
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x100e7f9f
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x100edf80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x100edfa0
mov al, byte [ebp + 0x1014e5c0]
mov byte [esp + 0x10], al
test edi, edi
je 0x100ee025
cmp byte [edi], 0
mov eax, edi
je 0x100edfbb
inc eax
cmp byte [eax], 0
jne 0x100edfb5
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x1a4
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x100ee00d
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x100ee003
mov edi, edi
movzx edi, byte [edx]
movzx edi, byte [edi + 0x1014dc58]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x100edfe0
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x100ee00f
xor edx, edx
push edi
call fcn.100b7e10
add esp, 4
test eax, eax
je 0x100ee021
mov eax, dword [eax + 8]
jmp 0x100ee02c
xor eax, eax
jmp 0x100ee02c
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 8]
test eax, eax
je 0x100ee03c
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x100ee05d
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x100edfa0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x1011ff20
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, 1
test edi, edi
je 0x1011fff9
test ebp, ebp
je 0x1011fff9
cmp byte [edi], 0
je 0x1011fff9
push esi
push 0x10169e28
push edi
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
jne 0x1011ff72
push 0x10158250
push edi
call fcn.1012982a
mov esi, eax
add esp, 8
test esi, esi
je 0x1011ffff
push 2
push 0
push esi
call fcn.1012b1f9
push esi
call fcn.1012b0ca
add esp, 0x10
test eax, eax
je 0x1011ffdd
push 2
push 0xffffffffffffffff
push esi
call fcn.1012b1f9
push esi
push 1
lea eax, [esp + 0x23]
push 1
push eax
call fcn.1012a83e
add esp, 0x1c
push 2
test eax, eax
jne 0x1011ffd2
push 0xfffffffffffffffe
push esi
call fcn.1012b1f9
add esp, 0xc
test eax, eax
jne 0x1011ffcc
push esi
push 1
lea ecx, [esp + 0x17]
push 1
push ecx
call fcn.1012a83e
add esp, 0x10
push 2
push 0xffffffffffffffff
jmp 0x1011ffd4
push 0
push esi
call fcn.1012b1f9
add esp, 0xc
push ebp
push 0x1014d8cc
push esi
call fcn.1012a85b
push esi
call fcn.10129ad3
add esp, 0x10
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x101208a0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x101851e8
push 0x10132540
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10189710]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 0x2c], edi
xor eax, eax
mov dword [ebp - 4], eax
cmp edi, eax
je 0x10120a14
mov byte [edi], al
cmp dword [ebp + 8], eax
je 0x1012090d
mov byte [ebp - 0x28], al
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov byte [ebp - 0x1f], al
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
lea ecx, [ebp - 0x28]
mov ebx, str.CSUUID
call fcn.10059a70
mov dword [ebp - 0x30], 0x104
push str.CSUUID
lea eax, [ebp - 0x30]
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
cmp byte [edi], 0
jne 0x10120a14
push 0
push 0
push 0x10120750
call fcn.10127f7d
add esp, 0xc
cmp eax, 0xffffffff
je 0x10120990
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, eax
call esi
sub eax, ebx
cmp eax, 0x1770
jae 0x10120990
mov dword [ebp - 0x30], 0x104
push str.CSUUID
lea eax, [ebp - 0x30]
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
call fcn.10059d80
cmp byte [edi], 0
jne 0x10120a14
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10120954
push str.FFFFEFEF_FFFF_FFFF_FFFF_FFFFFFFFFFFF
push edi
call fcn.10135887
add esp, 8
test eax, eax
jne 0x101209b5
mov ecx, 9
mov esi, str.FFFFFFFF_FFFF_FFFF_FFFF_FFFFFFFFFFFF
mov edi, dword [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x2c]
push str.None
push edi
call fcn.10135887
add esp, 8
test eax, eax
jne 0x101209da
mov ecx, 9
mov esi, str.FFFFFFFF_FFFF_FFFF_FFFF_FFFFFFFFFFFF
mov edi, dword [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x2c]
cmp byte [edi], 0
je 0x101209ea
mov esi, edi
call fcn.101206c0
test eax, eax
je 0x10120a14
mov ecx, 9
mov esi, str.FFFFFFFF_FFFF_FFFF_FFFF_FFFFFFFFFFFF
mov edi, dword [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x10120a14
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10127db1
mov esp, ebp
pop ebp
ret