joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4969a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x11
push 0
push 0
dec ecx
jne 0x4969a8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x496b80
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x100
push esi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x496978]
call fcn.0040641c
add esp, 4
jmp 0x4969fd
mov eax, esi
add eax, eax
mov esi, eax
push esi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x496978]
call fcn.0040641c
add esp, 4
lea eax, [ebp - 4]
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
push 0x10
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x4969e0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov ecx, 4
mov edx, dword [ebp - 0x10]
call fcn.0040824c
xor eax, eax
mov dword [ebx + 0x10], eax
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jb 0x496a65
inc esi
xor edi, edi
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, edi
shl eax, 4
add edx, eax
lea eax, [ebp - 0x20]
mov ecx, 0x10
call fcn.0040824c
xor eax, eax
mov al, byte [ebp - 0x1c]
cmp eax, dword [ebx + 0x14]
jne 0x496a61
inc dword [ebx + 0x10]
inc edi
dec esi
jne 0x496a3a
push 0
lea eax, [ebx + 0xc]
mov ecx, 1
mov edx, dword [0x49686c]
call fcn.0040641c
add esp, 4
mov eax, dword [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
mov ecx, 1
mov edx, dword [0x49686c]
call fcn.0040641c
add esp, 4
xor eax, eax
mov dword [ebx + 0x10], eax
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jb 0x496b11
inc esi
xor edi, edi
mov edx, dword [ebp - 0x10]
add edx, 4
mov eax, edi
shl eax, 4
add edx, eax
lea eax, [ebp - 0x20]
mov ecx, 0x10
call fcn.0040824c
xor eax, eax
mov al, byte [ebp - 0x1c]
cmp eax, dword [ebx + 0x14]
jne 0x496b0d
lea ecx, [ebp - 0x88]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00496c20
lea edx, [ebp - 0x88]
imul eax, dword [ebx + 0x10], 0xd
mov ecx, dword [ebx + 0xc]
lea eax, [ecx + eax*8]
mov ecx, dword [0x496844]
call fcn.00405a7c
imul eax, dword [ebx + 0x10], 0xd
mov edx, dword [ebx + 0xc]
mov eax, dword [edx + eax*8 + 8]
call fcn.00404ef0
test eax, eax
jle 0x496b0d
inc dword [ebx + 0x10]
inc edi
dec esi
jne 0x496aa7
cmp dword [ebx + 0x10], 1
jbe 0x496b1c
dec dword [ebx + 0x10]
jmp 0x496b34
push 0
lea eax, [ebx + 0xc]
mov ecx, 1
mov edx, dword [0x49686c]
call fcn.0040641c
add esp, 4
mov eax, ebx
call fcn.00496bb8
push 0
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x496978]
call fcn.0040641c
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496b87
lea eax, [ebp - 0x88]
mov edx, dword [0x496844]
call fcn.00405860
lea eax, [ebp - 0xc]
mov edx, dword [0x496978]
call fcn.0040653c
ret
Function at 0x496f7c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004050d8
xor eax, eax
push ebp
push 0x497195
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404ef0
test eax, eax
jne 0x496fd7
mov eax, dword [ebp - 8]
call fcn.00404c1c
jmp 0x497165
lea eax, [ebp - 0xc]
mov edx, 0xff
call fcn.00405274
mov eax, dword [ebp - 0xc]
call fcn.004050e8
push eax
push 0xff
call sub.kernel32.dll_GetLogicalDriveStringsA
mov dl, 1
mov eax, dword [0x415a5c]
call fcn.00403d38
mov esi, eax
mov ebx, 1
mov eax, dword [ebp - 0xc]
call fcn.004050e8
mov edi, eax
jmp 0x49703d
mov edx, dword [ebp - 0xc]
test al, al
jne 0x49703c
lea eax, [ebp - 0x1c]
mov edx, edi
call fcn.00404e0c
mov edx, dword [ebp - 0x1c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xc]
call fcn.00405140
lea edi, [eax + ebx]
inc ebx
mov eax, dword [ebp - 0xc]
mov al, byte [eax + ebx - 1]
test al, al
jne 0x497016
mov edx, dword [ebp - 0xc]
cmp byte [edx + ebx], 0
jne 0x497016
lea eax, [ebp - 0x20]
mov edx, edi
call fcn.00404e0c
mov edx, dword [ebp - 0x20]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00405274
lea eax, [ebp - 0x14]
mov edx, 0x100
call fcn.00405274
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jb 0x49714c
inc eax
mov dword [ebp - 0x18], eax
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x24]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x24]
mov ecx, 2
mov edx, 1
call fcn.00405148
push 0x100
mov eax, dword [ebp - 0x14]
call fcn.004050e8
push eax
mov eax, dword [ebp - 0x10]
call fcn.004050e8
push eax
call sub.kernel32.dll_QueryDosDeviceA
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00433658
test al, al
je 0x497142
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004050e8
mov edx, eax
lea eax, [ebp - 0x12c]
call fcn.0040387c
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x2c]
call fcn.00404e78
lea eax, [ebp - 0x2c]
mov edx, 0x4971ac
call fcn.00404ef8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
pop ecx
call fcn.0043362c
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00405274
mov eax, esi
call fcn.00403d68
jmp 0x497165
inc ebx
dec dword [ebp - 0x18]
jne 0x497092
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00405274
mov eax, esi
call fcn.00403d68
mov eax, dword [ebp - 8]
call fcn.00404c1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49719c
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.00404c40
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404c40
lea eax, [ebp - 4]
call fcn.00404c1c
ret
Function at 0x4a1dd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004050d8
xor eax, eax
push ebp
push 0x4a1e1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004a1828
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1e24
lea eax, [ebp - 4]
call fcn.00404c1c
ret

Function at 0x4a216c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004050d8
xor eax, eax
push ebp
push 0x4a222d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4a220b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403404
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, 0x100
call fcn.00403404
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.0040b3ec
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x40
or word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a2217
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2234
lea eax, [ebp - 4]
call fcn.00404c1c
ret
Function at 0x406875
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7de94c], 0
jne 0x4068b3
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406889
mov dword [ecx*4 + 0x7de948], eax
inc ecx
cmp ecx, 0x100
jl 0x406884
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4068e0
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x7de948]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4068c1
not eax
pop ebp
ret 0xc
Function at 0x1004480
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1004d30
call fcn.01004674
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10063c0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1004295
cmp eax, esi
jne 0x1004288
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1004298
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100426f
xor esi, esi
inc esi
mov eax, dword [0x10063bc]
cmp eax, esi
jne 0x10042ab
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10042e6
mov eax, dword [0x10063bc]
test eax, eax
jne 0x10042e0
mov dword [0x10063bc], esi
push 0x1001140
push 0x1001134
call fcn.010041ec
pop ecx
pop ecx
test eax, eax
je 0x10042e6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10043b0
mov dword [0x1006080], esi
mov eax, dword [0x10063bc]
cmp eax, esi
jne 0x100430a
push 0x1001130
push 0x1001128
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10063bc], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1004317
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10063c4], ebx
je 0x1004338
push 0x10063c4
call fcn.010045e9
pop ecx
test eax, eax
je 0x1004338
push ebx
push 2
push ebx
call dword [0x10063c4]
push dword [0x1006068]
push dword [0x100606c]
push dword [0x1006064]
call fcn.01001976
add esp, 0xc
mov dword [0x100607c], eax
cmp dword [0x1006070], ebx
jne 0x1004396
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1006080], ebx
jne 0x10043a4
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100607c]
call fcn.010046b9
ret
call fcn.010047c1
jmp 0x100424d
Function at 0x1004995
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x1004a78
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
push ebx
push eax
call esi
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x10049f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push 0x10015f8
push eax
call dword [sym.imp.msvcrt.dll_fwprintf]
add esp, 0xc
jmp 0x1004a77
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
jne 0x1004a26
push dword [ebp - 4]
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 8
add eax, 0x40
push 0x1001590
push eax
call dword [sym.imp.msvcrt.dll_fwprintf]
add esp, 0x10
jmp 0x1004a63
push ebx
push ebx
push dword [ebp - 4]
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [ebp - 8]
call esi
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1004a63
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1004a43
push ebx
lea ecx, [ebp - 4]
push ecx
sub eax, edx
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, ebx
je 0x1004a76
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x21608
call fcn.00401b30
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x215fc], ecx
mov dword [ebp - 0x21608], edx
xor ecx, ecx
mov dword [ebp - 0x21600], eax
mov dword [ebp - 0x215f8], edi
lea ebx, [edi + 0x2c]
nop
mov eax, ecx
mov byte [ebp + ecx - 0x10afc], cl
cdq
idiv ebx
mov al, byte [edx + esi]
mov byte [ebp + ecx - 0x215f4], al
inc ecx
cmp ecx, 0x10af6
jl 0x401040
xor esi, esi
mov dword [ebp - 0x21604], 0x10af6
jmp 0x401070
mov bl, byte [ebp + esi - 0x10afc]
movzx ecx, byte [ebp + esi - 0x215f4]
add ecx, edi
movzx eax, bl
add eax, ecx
mov ecx, 0x10af6
cdq
idiv ecx
mov edi, edx
mov al, byte [ebp + edi - 0x10afc]
mov byte [ebp + edi - 0x10afc], bl
mov byte [ebp + esi - 0x10afc], al
inc esi
cmp esi, ecx
jl 0x401070
mov edi, dword [ebp - 0x21608]
xor ecx, ecx
test edi, edi
jle 0x40115b
mov esi, dword [ebp - 0x215fc]
mov ebx, dword [ebp - 0x21600]
sub esi, ebx
jmp 0x4010d0
mov eax, dword [ebp - 0x215f8]
lea ebx, [ebx + 1]
inc eax
cdq
idiv dword [ebp - 0x21604]
mov eax, edx
mov dword [ebp - 0x215f8], eax
movzx eax, byte [ebp + eax - 0x10afc]
add eax, ecx
mov ecx, 0x10af6
cdq
idiv ecx
mov eax, dword [ebp - 0x215f8]
mov dword [ebp - 0x215fc], edx
movzx eax, byte [ebp + eax - 0x10afc]
mov cl, byte [ebp + edx - 0x10afc]
mov byte [ebp + edx - 0x10afc], al
mov eax, dword [ebp - 0x215f8]
mov byte [ebp + eax - 0x10afc], cl
movzx eax, byte [ebp + edx - 0x10afc]
movzx ecx, cl
add eax, ecx
mov ecx, 0x10af6
cdq
idiv ecx
mov ecx, dword [ebp - 0x215fc]
movzx eax, byte [ebp + edx - 0x10afc]
xor al, byte [esi + ebx - 1]
mov byte [ebx - 1], al
dec edi
jne 0x4010d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004012ee
mov esp, ebp
pop ebp
ret
Function at 0x401170
Capabilities:
Delete file
Execute command
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [str.J3wIjAChthL8LA4jDgNYHchSpO6an44s5dPduP]
mov eax, dword [0x402148]
push ebx
mov ebx, dword [ebp + 0xc]
movdqu xmmword [ebp - 0x30], xmm0
push esi
movdqu xmm0, xmmword [0x402130]
push 0x40214c
push dword [ebx + 4]
movdqu xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], eax
movq xmm0, qword [0x402140]
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.MSVCR120.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x4011eb
push eax
push eax
push str.Not_Open_File_To_size___
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012ee
mov esp, ebp
pop ebp
ret
push edi
push 2
push 0
push esi
call dword [sym.imp.MSVCR120.dll_fseek]
push esi
call dword [sym.imp.MSVCR120.dll_ftell]
push esi
mov edi, eax
call dword [sym.imp.MSVCR120.dll_fclose]
mov esi, dword [sym.imp.MSVCR120.dll_malloc]
push edi
call esi
push edi
mov dword [ebp - 0x38], eax
call esi
push 0x40214c
push dword [ebx + 4]
mov dword [ebp - 0x34], eax
call dword [sym.imp.MSVCR120.dll_fopen]
mov esi, eax
add esp, 0x24
test esi, esi
jne 0x401251
push eax
push eax
push str.Not_Open_File_To_Read___
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012ee
mov esp, ebp
pop ebp
ret
push esi
push edi
push 1
push dword [ebp - 0x38]
call dword [sym.imp.MSVCR120.dll_fread]
push esi
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 0x14
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, edi
push ecx
mov ecx, dword [ebp - 0x38]
push eax
call section..text
push 0x402188
push dword [ebx + 4]
call dword [sym.imp.MSVCR120.dll_fopen]
add esp, 0x14
test eax, eax
jne 0x4012b9
push eax
push eax
push str.Not_Open_File_To_Write___
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004012ee
mov esp, ebp
pop ebp
ret
push esi
push edi
push 1
push dword [ebp - 0x34]
call dword [sym.imp.MSVCR120.dll_fwrite]
push esi
call dword [sym.imp.MSVCR120.dll_fclose]
push str.pause
call dword [sym.imp.MSVCR120.dll_system]
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.004012ee
mov esp, ebp
pop ebp
ret
Function at 0x19350
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x2c230
cmp dword [0x31200], 0
jne 0x1937e
cmp dword [ebp + 8], 0
je 0x1937e
movzx eax, word [ebp + 0xc]
mov dword [0x31204], eax
mov ecx, dword [ebp + 8]
mov dword [0x31200], ecx
push 0x5c
mov edx, dword [ebp + 0x10]
push edx
call fcn.00027cd0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1939a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
jmp 0x193a3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x2c200
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x10
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x19d20
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00024cb0
test eax, eax
jne 0x19d66
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x18], 0xc0000010
xor dl, dl
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [ebp - 4]
jmp 0x19dc6
mov eax, dword [ebp + 0xc]
push eax
call fcn.000195e0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx]
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx*4 + 0x19d78], 0
je 0x19da4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx*4 + 0x19d78]
call eax
mov dword [ebp - 4], eax
jmp 0x19dc3
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x18], 0xc0000010
xor dl, dl
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x24d00
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
push 0x2db40
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0x10
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea edx, [ebp - 0x1c]
push edx
push 0xf000f
mov eax, dword [ebp - 0x28]
add eax, 0x19d4c
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateDirectoryObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x24d80
push 0x2c240
push 0x177e
mov ecx, dword [ebp - 4]
push ecx
call fcn.00019350
jmp 0x24d98
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x19d4c]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwMakeTemporaryObject]
xor ecx, ecx
jne 0x24d12
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x24db0
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x30fa8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
push 0x2db70
push 0x100
lea ecx, [ebp - 0x208]
push ecx
call fcn.00019730
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x224]
lea eax, [edx + ecx*4 + 0x19c74]
push eax
push 0
push 0
push 7
lea ecx, [ebp - 0x210]
push ecx
push 0x340
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x24e51
push 0x2c240
push 0x1795
mov eax, dword [ebp - 4]
push eax
call fcn.00019350
jmp 0x24f08
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x224]
mov eax, dword [edx + ecx*4 + 0x19c74]
mov ecx, dword [eax + 0x1c]
or ecx, 0x10
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x224]
mov edx, dword [eax + edx*4 + 0x19c74]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x224]
mov edx, dword [ecx + eax*4 + 0x19c74]
mov eax, dword [edx + 0x28]
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
mov dword [ecx], 0
mov edx, dword [ebp - 0x214]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x24f00
push 0x2c270
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x24f00
push 0x2c240
push 0x17a5
mov edx, dword [ebp - 4]
push edx
call fcn.00019350
xor eax, eax
jne 0x24dd2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0002bd11
mov esp, ebp
pop ebp
ret 8
Function at 0x26e30
Capabilities:
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0
jmp 0x26e54
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x26e7f
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp - 8]
and eax, 0xff
mov ecx, dword [ebp - 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x30ba8]
mov dword [ebp - 8], ecx
jmp 0x26e4b
mov eax, dword [ebp - 8]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
Function at 0x322a2
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.00032269
pop ebp
jmp fcn.00032010
Function at 0xccc058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xccc1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xccc07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xccc06a
add dl, dl
jne 0xccc089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xccc0dc
xor eax, eax
add dl, dl
jne 0xccc096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xccc17d
add dl, dl
jne 0xccc0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xccc0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xccc0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xccc0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xccc0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xccc075
mov eax, 1
add dl, dl
jne 0xccc0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xccc0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xccc0e1
sub eax, ebx
mov ebx, 1
jne 0xccc128
mov ecx, 1
add dl, dl
jne 0xccc10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xccc119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xccc105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xccc075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xccc13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xccc14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xccc136
cmp eax, 0x7d00
jae 0xccc16d
cmp eax, 0x500
jb 0xccc168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xccc075
cmp eax, 0x7f
ja 0xccc170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xccc075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xccc19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xccc075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10