joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100078ea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, 0xf1
push edi
push esi
mov ebx, ecx
push dword [ebp + 8]
call sub.MFC42.DLL_AfxFindResourceHandle
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push dword [ebp + 8]
mov dword [ebp - 8], eax
push eax
call edi
test eax, eax
jne 0x10007924
and dword [ebp - 8], eax
push esi
push dword [ebp + 8]
push eax
call edi
test eax, eax
je 0x1000793f
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000793f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x10007946
xor eax, eax
jmp 0x100079d6
movzx eax, word [esi + 6]
shl eax, 2
push eax
call sub.MFC42.DLL_operatornew
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov dword [ebp - 8], eax
jbe 0x1000797d
mov ecx, eax
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x10007967
movzx eax, word [esi + 6]
push eax
mov ecx, ebx
push dword [ebp - 8]
call sub.MFC42.DLL_CToolBar::SetButtons
push dword [ebp - 8]
mov edi, eax
call sub.MFC42.DLL_operatordelete
test edi, edi
pop ecx
je 0x100079d4
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea edi, [ecx + 7]
push ecx
lea edx, [eax + 7]
push eax
push edi
push edx
mov ecx, ebx
call sub.MFC42.DLL_CToolBar::SetSizes
movzx eax, word [esi + 2]
push dword [ebp + 8]
mov dword [ebx + 0xa0], eax
movzx eax, word [esi + 4]
mov ecx, ebx
mov dword [ebx + 0xa4], eax
call fcn.100079dd
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1000dd2a
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x1001c898
call fcn.1001aac0
sub esp, 0x24
mov eax, dword [ebp + 8]
and dword [ebp - 0x20], 0
push ebx
push esi
mov eax, dword [eax]
push edi
mov dword [ebp - 0x10], esp
movzx ecx, word [eax + 0x14]
lea edi, [ecx + eax + 0x18]
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x20], eax
jge 0x1000de78
mov esi, dword [edi + 0x24]
mov eax, esi
mov ecx, esi
shr eax, 0x1d
shr ecx, 0x1e
mov edx, esi
and eax, 1
and ecx, 1
shr edx, 0x1f
test esi, 0x2000000
je 0x1000ddb6
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push 0x10022590
push eax
mov dword [ebp - 0x24], 0x4b
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x14]
push 0x4000
push dword [eax + 0x10]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x1000de63
ret
lea eax, [ecx + eax*2]
test esi, 0x4000000
lea eax, [edx + eax*2]
mov eax, dword [eax*4 + 0x1015a320]
mov dword [ebp - 0x1c], eax
je 0x1000ddd2
or byte [ebp - 0x1b], 2
mov edi, dword [edi + 0x10]
test edi, edi
mov dword [ebp - 0x18], edi
jne 0x1000de25
lea eax, [ebp - 0x28]
push 0x10022590
push eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0x10
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
test al, 0x40
je 0x1000de0c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
jmp 0x1000de18
test al, 0x80
je 0x1000de1b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x18], eax
mov eax, 0x1000de21
ret
cmp dword [ebp - 0x18], 0
jbe 0x1000de67
lea eax, [ebp - 0x2c]
push 0x10022590
push eax
mov dword [ebp - 4], 4
mov dword [ebp - 0x2c], 0xf
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x1c]
push dword [eax + 0x10]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1000de63
ret
mov edi, dword [ebp - 0x14]
inc dword [ebp - 0x20]
add edi, 0x28
mov dword [ebp - 0x14], edi
jmp 0x1000dd51
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1000e247
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
mov byte [ebp - 0x110], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x110]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000e2bf
lea eax, [ebp - 0x110]
push esi
push eax
push 1
push ebx
push 0x1015abb4
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x53
push eax
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x6c
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x65
mov byte [ebp - 2], 0x78
mov byte [ebp - 1], bl
call fcn.1000e1e0
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x102bb20
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret 8

Function at 0x102bb50
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x102bb80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c8]
push esi
call ecx
xor eax, eax
test esi, esi
setne al
pop esi
pop ebp
ret 0xc

Function at 0x102bc20
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test esi, esi
je 0x102bca3
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi]
push edi
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x25c]
push eax
push ecx
call edx
mov ecx, dword [esi]
test ecx, ecx
je 0x102bc6b
cmp ecx, 0xffffffff
je 0x102bc6b
cmp dword [ebp + 0x1c], ebx
je 0x102bc57
test eax, eax
jne 0x102bcab
cmp ecx, 0xffffffff
je 0x102bc6b
mov eax, dword [edi + 0x1c8]
push ecx
call eax
mov dword [esi], 0xffffffff
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
push ecx
push 0
push edx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x102bc9a
cmp eax, 0xffffffff
je 0x102bc9a
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x18
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x18

Function at 0x102fe60
Capabilities:
Get disk information via ioctl

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x26c]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push ebx
push eax
call ecx
mov esi, eax
test esi, esi
je 0x102febc
cmp esi, 0xffffffff
je 0x102febc
mov eax, dword [ebp + 0x10]
mov ecx, dword [edi + 0x268]
push ebx
lea edx, [ebp + 0xc]
push edx
push 0xc
push eax
push ebx
push ebx
push 0x2d1080
push esi
call ecx
test eax, eax
je 0x102feb3
mov ebx, 1
mov edx, dword [edi + 0x1c8]
push esi
call edx
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x10303b0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10303f8
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10303f7
mov ecx, 1
cmp edi, ecx
jbe 0x10303f4
movzx eax, byte [ebp + 0x10]
cdq
push ebx
mov ebx, 0xff
idiv ebx
lea eax, [esi + 1]
or esi, 0xffffffff
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
inc ecx
xor byte [eax], bl
inc eax
cmp ecx, edi
jb 0x10303e1
mov esi, dword [ebp + 8]
pop ebx
xor byte [esi], 0xac
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1030410
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1030453
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1030453
xor byte [esi], 0xac
lea ecx, [eax - 1]
test ecx, ecx
jbe 0x1030453
movzx eax, byte [ebp + 0x10]
push edi
cdq
mov edi, 0xff
idiv edi
pop edi
lea eax, [ecx + esi]
or esi, 0xffffffff
push ebx
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
dec ecx
xor byte [eax], bl
dec eax
test ecx, ecx
ja 0x1030443
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x1030ae0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push edi
push 0x15
push 8
xor edi, edi
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1030b44
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [esi + 4], ecx
lea ecx, [ebp + 8]
push ecx
push edi
push esi
push 0x1030970
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
push edi
push edi
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x1030b38
cmp edi, 0xffffffff
jne 0x1030b46
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x10314c0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x10314d2
xor eax, eax
pop ebp
ret 0x10
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
cmp esi, 8
jb 0x1031594
mov edi, esi
shr edi, 3
push ebx
lea esp, [esp]
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
inc ecx
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
inc ecx
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
inc ecx
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
inc ecx
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
inc ecx
sub esi, 8
sub edi, 1
jne 0x10314f0
pop ebx
test esi, esi
je 0x10315b7
jmp 0x10315a0
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edx + edi*4]
inc ecx
sub esi, 1
jne 0x10315a0
pop edi
not eax
pop esi
pop ebp
ret 0x10
Function at 0x1031840
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 8
jge 0x1031856
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10
mov eax, esi
cdq
and edx, 3
add eax, edx
push ebx
sar eax, 2
xor ebx, ebx
xor ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jle 0x103187a
mov dl, byte [edi]
cmp dl, byte [ecx + edi]
jne 0x10318a6
inc ecx
cmp ecx, eax
jl 0x1031870
xor eax, eax
test esi, esi
jle 0x103188d
mov cl, byte [edi]
cmp cl, byte [eax + edi]
je 0x1031888
inc ebx
inc eax
cmp eax, esi
jl 0x1031882
mov eax, esi
cdq
and edx, 0xf
add eax, edx
sar eax, 4
cmp ebx, eax
jge 0x10318a6
pop edi
pop ebx
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10
test esi, esi
jle 0x10318e1
mov dword [ebp + 0x10], esi
mov esi, dword [ebp + 0x14]
mov edx, dword [esi + 4]
movzx ebx, byte [edi]
mov eax, dword [esi]
mov ecx, edx
shr ecx, 0x18
shld edx, eax, 8
movzx ecx, cl
xor ecx, ebx
shl eax, 8
mov ebx, eax
mov eax, dword [ebp + 8]
xor ebx, dword [eax + ecx*8]
xor edx, dword [eax + ecx*8 + 4]
inc edi
sub dword [ebp + 0x10], 1
mov dword [esi], ebx
mov dword [esi + 4], edx
jne 0x10318b0
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x10318f0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
xor eax, eax
xor edx, edx
test ecx, ecx
jle 0x1031935
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
lea esp, [esp]
movzx ebx, byte [esi]
mov ecx, edx
shr ecx, 0x18
shld edx, eax, 8
movzx ecx, cl
xor ecx, ebx
xor edx, dword [edi + ecx*8 + 4]
shl eax, 8
xor eax, dword [edi + ecx*8]
inc esi
sub dword [ebp + 0x10], 1
jne 0x1031910
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1031d30
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov eax, 0xffff
test edx, edx
jbe 0x1031d72
push esi
mov esi, dword [ebp + 8]
push edi
jmp 0x1031d50
movzx edi, byte [ecx + esi]
xor edi, eax
shr ax, 8
and edi, 0xff
xor ax, word [edi*2 + 0x119f540]
inc ecx
movzx eax, ax
cmp ecx, edx
jb 0x1031d50
pop edi
pop esi
pop ebp
ret 8

Function at 0x10348d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
lea eax, [eax + ecx + 0x18]
mov edi, eax
sub edi, edx
cmp edi, esi
jae 0x1034928
movzx ecx, word [ecx + 6]
lea edi, [ecx + ecx*4]
add edi, edi
add edi, edi
add edi, edi
sub edi, edx
add edi, eax
cmp edi, esi
jae 0x1034928
xor esi, esi
test ecx, ecx
jbe 0x1034928
mov edi, dword [ebp + 8]
nop
mov edx, dword [eax + 0xc]
cmp edi, edx
jb 0x1034920
mov ebx, dword [eax + 8]
add ebx, edx
cmp edi, ebx
jb 0x103492a
inc esi
add eax, 0x28
cmp esi, ecx
jb 0x1034910
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x1037260
Capabilities:
Compute adler32 checksum

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1037399
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1037399
push edi
mov edi, dword [ebp + 8]
movzx ecx, di
shr edi, 0x10
test ebx, ebx
jbe 0x103738b
nop
mov eax, ebx
cmp ebx, 0x15b0
jb 0x103729f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
mov dword [ebp + 0x10], ebx
jl 0x103734e
mov edx, eax
shr edx, 4
mov ebx, edx
neg ebx
shl ebx, 4
add eax, ebx
jmp 0x10372c0
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x10372c0
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x103735f
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x1037352
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x1037290
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
pop ebp
ret 0xc
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc
Function at 0x1037410
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
ja 0x1037430
jb 0x1037428
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x40
jae 0x1037433
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x14
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
push esi
cmp word [ecx], ax
jne 0x10375f0
mov eax, dword [ecx + 0x3c]
xor edx, edx
lea esi, [eax + 0xf8]
cmp edx, edi
ja 0x10375f0
jb 0x1037462
cmp esi, ebx
ja 0x10375f0
movzx edx, word [eax + ecx + 4]
mov esi, 0x8664
cmp dx, si
je 0x1037486
mov esi, 0x200
cmp dx, si
je 0x1037486
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
jmp 0x103748f
mov edx, dword [ebp + 0x18]
mov dword [edx], 1
xor edx, edx
lea esi, [eax + 0xf8]
cmp edx, edi
ja 0x103758e
jb 0x10374a9
cmp esi, ebx
ja 0x103758e
cmp dword [eax + ecx], 0x4550
jne 0x103758e
movzx edx, word [eax + ecx + 0x14]
mov esi, dword [ebp + 0x14]
lea ebx, [eax + edx + 0x18]
mov edx, dword [esi]
mov dword [esi + 4], 0
mov edi, edx
cmp edx, 0x1000
jb 0x10374da
mov edi, 0x1000
mov dword [esi + 8], edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], edx
movzx edx, word [eax + ecx + 6]
test edx, edx
jbe 0x1037582
lea eax, [ebx + ecx + 0x10]
mov ebx, 0x18
sub ebx, ecx
nop
xor ecx, ecx
dec edx
lea edi, [ebx + eax]
cmp ecx, dword [ebp + 0x10]
ja 0x1037582
jb 0x1037512
cmp edi, dword [ebp + 0xc]
ja 0x1037582
test byte [eax + 0x14], 0x20
je 0x1037520
cmp dword [eax], 0x100
jae 0x1037533
add eax, 0x28
test edx, edx
ja 0x1037500
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret 0x14
test dword [eax + 0x14], 0x80000000
jne 0x1037582
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax]
cmp ecx, 0x1000
jb 0x1037551
mov ecx, 0x1000
mov dword [esi + 8], ecx
cmp dword [eax], 0x1200
jb 0x1037577
mov edx, dword [eax + 4]
add edx, ecx
mov dword [esi + 0x14], edx
mov eax, dword [eax]
sub eax, ecx
mov dword [esi + 0x18], eax
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret 0x14
mov ecx, dword [eax + 4]
mov dword [esi + 0x14], ecx
mov edx, dword [eax]
mov dword [esi + 0x18], edx
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret 0x14
movzx esi, word [ecx + 8]
mov edx, dword [ebp + 0x14]
shl esi, 4
mov dword [edx + 4], esi
movzx eax, word [ecx + 4]
movzx ecx, word [ecx + 2]
dec eax
shl eax, 9
add eax, ecx
mov ecx, dword [edx]
cmp eax, ecx
jbe 0x10375b1
mov eax, ecx
mov ecx, eax
sub ecx, esi
cmp ecx, 0x200
jb 0x10375f0
mov esi, 0x1000
cmp ecx, 0x1000
ja 0x10375cc
mov esi, ecx
cmp ecx, 0x1200
mov ecx, dword [edx + 4]
mov dword [edx + 8], esi
jbe 0x10375dc
add ecx, esi
pop esi
sub eax, ecx
pop edi
mov dword [edx + 0x18], eax
mov dword [edx + 0x14], ecx
mov eax, 1
pop ebx
pop ebp
ret 0x14
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x14
Function at 0x103ff00
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x11
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ecx, dword [ebp + 0xc]
test eax, eax
je 0x103ff5a
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [eax + 8], edx
lea edx, [ebp + 0xc]
push edx
push 0
push eax
push 0x103feb0
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x14]
push 0
push 0
mov dword [eax], esi
mov dword [eax + 0xc], ecx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x103ff55
push eax
mov eax, dword [esi + 0x1c8]
call eax
pop esi
pop ebp
ret 0x10
mov edx, dword [ebp + 8]
push ecx
push edx
call fcn.0103fe10
test eax, eax
je 0x103ff56
mov eax, dword [ebp + 0x14]
push eax
call dword [ebp + 0x10]
pop ebp
ret 0x10

Function at 0x10402e0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
xor dword [ebp + 8], 0x2d871bcc
xor eax, eax
lea ecx, [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov byte [ebp - 4], al
dec ecx
mov eax, 1
mov dl, al
sub dl, 0x5c
xor dl, byte [eax + ecx]
inc eax
xor byte [ebp + eax + 7], dl
cmp eax, 4
jb 0x1040303
xor byte [ebp + 8], 0xac
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp + 8]
push ecx
call fcn.0102cf90
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x1040350
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 4], al
mov eax, dword [ebp + 8]
push 4
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0102ccc0
mov edx, dword [ebp - 8]
mov al, dl
xor al, 0xac
mov dword [ebp + 8], edx
lea ecx, [ebp + 8]
mov byte [ebp + 8], al
dec ecx
mov eax, 3
mov dl, al
sub dl, 0x5c
xor dl, byte [eax + ecx]
xor byte [ebp + eax + 8], dl
sub eax, 1
jne 0x1040385
mov eax, dword [ebp + 8]
xor eax, 0x2d871bcc
mov esp, ebp
pop ebp
ret 4

Function at 0x10403b0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 4], eax
test esi, esi
jbe 0x10403eb
push edi
mov edi, dword [ebp + 8]
lea esp, [esp]
mov dl, byte [ecx + edi]
mov eax, ecx
and eax, 3
xor dl, cl
add byte [ebp + eax - 4], dl
lea eax, [ebp + eax - 4]
inc ecx
cmp ecx, esi
jb 0x10403d0
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1040f20
Capabilities:
Get mac address on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2804
call fcn.011972f0
push esi
push 0x2800
lea eax, [ebp - 0x2804]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x2804]
push edx
xor esi, esi
mov dword [ebp - 4], 0x2800
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x1040fa5
lea eax, [ebp - 0x2804]
lea esp, [esp]
test esi, esi
jne 0x1040f9f
movzx esi, byte [eax + 0x196]
movzx ecx, byte [eax + 0x197]
movzx edx, byte [eax + 0x198]
shl esi, 8
add esi, ecx
movzx ecx, byte [eax + 0x199]
shl esi, 8
add esi, edx
shl esi, 8
add esi, ecx
mov eax, dword [eax]
test eax, eax
jne 0x1040f70
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10410b0
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
push 0x11c
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_VerSetConditionMask]
add esp, 0xc
push 3
mov ecx, 2
xor edx, edx
push ecx
push edx
push edx
mov dword [ebp - 0x11c], 0x11c
mov dword [ebp - 0x118], 5
mov dword [ebp - 0x114], 1
mov word [ebp - 8], cx
mov word [ebp - 6], dx
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_VerifyVersionInfoW]
pop esi
test eax, eax
je 0x104115b
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x8aec], 5
jne 0x104115b
cmp dword [ecx + 0x8af0], 2
jne 0x104115b
cmp word [ecx + 0x8b7c], 1
jae 0x104115b
xor eax, eax
mov esp, ebp
pop ebp
ret 4