joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419a37
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
or esi, esi
jne 0x419a51
xor eax, eax
jmp 0x419ba7
xor edi, 0xffffffff
jmp 0x419b6c
mov eax, esi
inc esi
movzx edx, byte [eax]
mov ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x55ed00]
mov ecx, edi
shr ecx, 8
mov edi, edx
xor edi, ecx
mov eax, esi
inc esi
movzx edx, byte [eax]
mov ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x55ed00]
mov ecx, edi
shr ecx, 8
mov edi, edx
xor edi, ecx
mov eax, esi
inc esi
movzx edx, byte [eax]
mov ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x55ed00]
mov ecx, edi
shr ecx, 8
mov edi, edx
xor edi, ecx
mov eax, esi
inc esi
movzx edx, byte [eax]
mov ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x55ed00]
mov ecx, edi
shr ecx, 8
mov edi, edx
xor edi, ecx
mov eax, esi
inc esi
movzx edx, byte [eax]
mov ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x55ed00]
mov ecx, edi
shr ecx, 8
mov edi, edx
xor edi, ecx
mov eax, esi
inc esi
movzx edx, byte [eax]
mov ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x55ed00]
mov ecx, edi
shr ecx, 8
mov edi, edx
xor edi, ecx
mov eax, esi
inc esi
movzx edx, byte [eax]
mov ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x55ed00]
mov ecx, edi
shr ecx, 8
mov edi, edx
xor edi, ecx
mov eax, esi
inc esi
movzx edx, byte [eax]
mov ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x55ed00]
mov ecx, edi
shr ecx, 8
mov edi, edx
xor edi, ecx
sub ebx, 8
cmp ebx, 8
jae 0x419a59
or ebx, ebx
je 0x419ba2
mov eax, esi
inc esi
movzx edx, byte [eax]
mov ecx, edi
xor ecx, edx
mov edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0x55ed00]
mov ecx, edi
shr ecx, 8
mov edi, edx
xor edi, ecx
mov eax, ebx
dec eax
mov ebx, eax
jne 0x419b79
mov eax, edi
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10001070
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push 0
push 0x100010b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000109c
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1000da98]
pop esi
ret

Function at 0x100011c2
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x1000b340
call fcn.10002570
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10001237
call fcn.10001dcf
test eax, eax
jne 0x100011e6
xor eax, eax
jmp 0x100012ff
call fcn.1000197b
test eax, eax
jne 0x100011f6
call fcn.10001de4
jmp 0x100011df
call fcn.1000252f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1000ec34], eax
call fcn.10001dec
call fcn.10002151
test eax, eax
js 0x1000122b
push 0
call fcn.10001a83
pop ecx
test eax, eax
jne 0x1000122b
inc dword [0x1000ce20]
jmp 0x100012fc
call fcn.100020ff
call fcn.100019f0
jmp 0x100011ef
test eax, eax
jne 0x1000129d
mov eax, dword [0x1000ce20]
test eax, eax
jle 0x100011df
dec eax
mov dword [0x1000ce20], eax
and dword [ebp - 4], 0
cmp dword [0x1000d170], 0
jne 0x1000125c
call fcn.10001c53
call fcn.10001b14
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x10001277
call fcn.100020ff
call fcn.100019f0
call fcn.10001de4
mov dword [ebp - 4], 0xfffffffe
call fcn.10001288
jmp 0x100012fc
cmp eax, 2
jne 0x100012ef
push 0x3b4
push 1
call fcn.10002499
pop ecx
pop ecx
mov esi, eax
test esi, esi
je 0x100011df
push esi
push dword [0x1000c008]
call dword [sym.imp.KERNEL32.dll_FlsSetValue]
test eax, eax
je 0x100012e3
push 0
push esi
call fcn.100018cf
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x100012fc
push esi
call fcn.1000237e
pop ecx
jmp 0x100011df
cmp eax, 3
jne 0x100012fc
push 0
call fcn.1000189a
pop ecx
xor eax, eax
inc eax
call fcn.100025b5
ret 0xc

Function at 0x10004d47
Capabilities:
Enumerate pe sections

Disassembly:
cmp eax, ebx
je 0x1000534c
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.10004b53
add byte [ebp - 0x48f0ae6f], ch
inc edi
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.10004b53
and ch, 0xd0
and al, 0x66
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x10004dad
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
invalid

Function at 0x10004da3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
push ebx
push esi
push edi
call fcn.10004b31
ret
add ecx, dword [ecx - 0x3e7c07bb]
sub byte [edx + 0x75], cl
jmp 0x10004d36
Function at 0x10002ce0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 1
push 0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x10002d21
push 8
push 1
push eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
neg eax
sbb eax, eax
and eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10002d30
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
jne 0x10002d42
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10002d3b
push 8
call dword [sym.imp.MSVCR120.dll_malloc]
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [eax], esi
mov dword [eax + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003120
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], ebx
mov eax, dword [ebx + 4]
test eax, eax
je 0x10003144
push eax
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov dword [ebx + 4], 0
cmp dword [ebp + 8], 0
lea eax, [ebx + 8]
mov dword [ebp - 8], eax
mov dword [eax], 0
je 0x100032a8
cmp dword [ebp + 0xc], 0
jbe 0x100032a8
mov eax, dword [ebp + 0x10]
push edi
xor edi, edi
sub eax, edi
je 0x10003178
dec eax
jne 0x1000317d
mov edi, 0x8004
jmp 0x1000317d
mov edi, 0x8003
xor eax, eax
test edi, edi
setne al
cmp eax, 1
jne 0x100032a0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push eax
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call esi
test eax, eax
jne 0x100031c6
push 8
push 1
push eax
push eax
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
call esi
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp + 0x10]
jmp 0x100031c9
mov esi, dword [ebp - 4]
xor ebx, ebx
test esi, esi
setne bl
cmp ebx, 1
jne 0x10003290
mov edx, edi
mov ecx, esi
call fcn.10002d30
xor ebx, ebx
mov edi, eax
test edi, edi
setne bl
cmp ebx, 1
jne 0x1000326d
test edi, edi
je 0x1000326b
mov eax, dword [edi + 4]
test eax, eax
je 0x1000326b
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ebx, eax
cmp ebx, 1
jne 0x1000326d
mov eax, dword [edi + 4]
test eax, eax
je 0x1000326b
cmp dword [ebp - 8], 0
je 0x1000326b
push 0
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push ecx
push 0
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ebx, eax
cmp ebx, 1
jne 0x1000326d
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
push eax
mov dword [ebx], eax
call dword [sym.imp.MSVCR120.dll_malloc]
mov ecx, dword [ebp - 0xc]
mov edx, eax
push ebx
mov dword [ecx + 4], eax
mov ecx, edi
call fcn.10002d80
mov ebx, 1
add esp, 8
cmp eax, ebx
cmovne ebx, eax
jmp 0x1000326d
xor ebx, ebx
test edi, edi
je 0x10003290
mov eax, dword [edi + 4]
test eax, eax
je 0x10003286
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [edi + 4], 0
push edi
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
test esi, esi
je 0x1000329d
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10003940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
invalid
sbb al, 0xfb
invalid
Function at 0x10003ba0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10003bc7
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10003bd0
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10003bda
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10003bbc
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10003b46
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x10003ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ebp + 0x4afffffc], esi
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
invalid
invalid
invalid
cld
invalid

Function at 0x10003d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [esi - 0x3a]
test dword [edx + 0x6dfffffc], edi

Function at 0x10003d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1000349d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10003452
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
invalid
test dword [edx], ebx
cld
invalid

Function at 0x10004410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dh, al
test dword [ecx + 0x11fffffc], esp
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.1000349d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10003452
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.1000348d
test eax, 0x685b1707
add al, 1
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.1000348d
and eax, 0x80c361d7
loopne 0x100044ab
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
inc ebp
loop 0x100044d0
Function at 0x10005970
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push esi
push 2
push ebx
push Ordinal_4
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.100051c0
mov esi, eax
cmp esi, 2
jne 0x100059ba
sub esp, 0x14
lea ecx, [ebp - 0xc]
push ebx
push Ordinal_4
call fcn.10005140
mov esi, eax
push edi
test esi, esi
jne 0x10005a14
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100059cb
lea esi, [edi + 0xd]
jmp 0x10005a14
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100059d0
mov ebx, dword [ebp - 0xc]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0
push 0x1000b710
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x10005a17
sub esp, 0x14
lea ecx, [ebp - 0xc]
push edi
push Ordinal_4
call fcn.10005140
mov esi, eax
mov ebx, dword [ebp - 0xc]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], edi
je 0x10005a7d
test esi, esi
jne 0x10005aa9
sub esp, 0x14
lea ecx, [ebp - 0xc]
push str.DefaultIcon
push ebx
call fcn.10005140
mov esi, eax
test esi, esi
jne 0x10005aa6
mov edx, dword [ebp + 0x10]
mov ecx, edx
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005a50
mov edi, dword [ebp - 0xc]
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x1000b710
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x10005aa9
sub esp, 0x14
lea ecx, [ebp - 0xc]
push str.ShellOpenCommand
push ebx
call fcn.10005140
mov esi, eax
test esi, esi
jne 0x10005aa6
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x10005b31
lea esi, [eax + 0xd]
mov edi, dword [ebp - 0xc]
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push Ordinal_4
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.100051c0
test eax, eax
jne 0x10005ae4
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.10005340
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10005af2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
xor eax, eax
test esi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sete al
mov dword [ebp + 0x10], eax
test edi, edi
je 0x10005b20
push edi
call esi
mov eax, dword [ebp + 0x10]
pop edi
test ebx, ebx
je 0x10005b2b
push ebx
call esi
mov eax, dword [ebp + 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005b36
mov edi, dword [ebp - 0xc]
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x1000b710
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x10005aa9
Function at 0x10005cc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10005d17
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x11c], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.10009040
mov esp, ebp
pop ebp
ret

Function at 0x10005d30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x10005d95
cmp dword [ebp - 0x118], 0
jne 0x10005d95
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret

Function at 0x10005db0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x10005e15
cmp dword [ebp - 0x118], 1
jne 0x10005e15
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret

Function at 0x10005e30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x10005e95
cmp dword [ebp - 0x118], 2
jne 0x10005e95
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret

Function at 0x10005eb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10005f07
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x11c], 5
sete al
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret
Function at 0x10005f30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10005f87
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x11c], 6
sete al
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret

Function at 0x10005fb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
movdqu xmmword [ebp - 0x20], xmm0
movdqu xmmword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x24]
cmp ax, 9
je 0x10005fe9
cmp ax, 6
je 0x10005fe9
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10006000
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x228
mov dword [ebp - 0x234], eax
xor ebx, ebx
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x230], 0x22c
push ebx
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x100060cc
push edi
mov edi, dword [sym.imp.MSVCR120.dll__wcsicmp]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x234]
call edi
add esp, 8
test eax, eax
je 0x1000609b
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10006071
jmp 0x100060cb
push dword [ebp - 0x228]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100060cb
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
mov ecx, 1
push edi
cmovne ebx, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10009040
mov esp, ebp
pop ebp
ret
Function at 0x100060f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x228
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x22c]
push 0
push eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0x22c
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
je 0x100061a1
push edi
mov edi, dword [sym.imp.MSVCR120.dll__wcsicmp]
lea ecx, [ecx]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x238]
call edi
add esp, 8
test eax, eax
je 0x10006196
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x10006170
jmp 0x100061a0
mov dword [ebp - 0x234], 1
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop esi
pop ebx
call fcn.10009040
mov esp, ebp
pop ebp
ret

Function at 0x100061c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x28
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x1000621d
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push esi
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov al, 1
pop esi
call fcn.10009040
mov esp, ebp
pop ebp
ret

Function at 0x10006250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x100062ad
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009040
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push esi
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
mov al, 1
pop esi
call fcn.10009040
mov esp, ebp
pop ebp
ret