joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41839a
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [esp + 4]
push esi
push 0x64
mov ecx, 0x436d08
pop esi
mov dl, byte [ecx]
xor dl, al
xor dl, byte [esp + 0xc]
inc ecx
dec esi
mov al, dl
jne 0x4183a7
pop esi
ret

Function at 0x41841b
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0
je 0x4184e5
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x118]
push 0x434ae4
push 0x104
push eax
call fcn.0041f1a4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004180be
add esp, 0x18
push 5
pop edi
lea esi, [ebp - 0x14]
mov ebx, edi
movzx eax, byte [esi]
push 0x2f
push eax
call fcn.0041839a
mov byte [esi], al
pop ecx
inc esi
dec ebx
pop ecx
jne 0x418465
lea esi, [ebp - 0xf]
mov ebx, edi
movzx eax, byte [esi]
push 0x45
push eax
call fcn.0041839a
mov byte [esi], al
pop ecx
inc esi
dec ebx
pop ecx
jne 0x41847d
lea esi, [ebp - 0xa]
mov ebx, edi
movzx eax, byte [esi]
push 0x6f
push eax
call fcn.0041839a
mov byte [esi], al
pop ecx
inc esi
dec ebx
pop ecx
jne 0x418495
lea esi, [ebp - 5]
movzx eax, byte [esi]
push 0xdb
push eax
call fcn.0041839a
mov byte [esi], al
pop ecx
inc esi
dec edi
pop ecx
jne 0x4184ab
push 0x14
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
mov dl, byte [eax + 0x436d6c]
xor byte [ebp + eax - 0x14], dl
inc eax
dec ecx
jne 0x4184c9
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.004183d0
pop ecx
pop ecx
leave
ret

Function at 0x41856f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x4e258c]
cmp eax, dword [0x4e2f8a]
jb 0x418602
push ebx
push esi
mov esi, 0x10000
call fcn.004217d3
push 0x2e
cdq
pop ecx
idiv ecx
mov ebx, edx
cmp esi, 0x3eb
ja 0x4185c7
movzx eax, word [0x4d890c]
cmp esi, eax
je 0x4185c7
mov eax, esi
imul eax, eax, 0x153
cmp dword [eax + 0x485788], 0
je 0x4185c7
cmp byte [eax + 0x4857b5], 0
je 0x4185e8
call fcn.00417bee
cmp ax, 2
jb 0x4185e3
call fcn.004217d3
cdq
mov ecx, 0x3ec
idiv ecx
mov esi, edx
jmp 0x41859a
mov esi, 0xffff
cmp esi, 0x10000
je 0x4185f9
push esi
push ebx
call fcn.00416a14
pop ecx
pop ecx
call edi
pop esi
mov dword [0x4e258c], eax
pop ebx
pop edi
ret
Function at 0x418604
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
sub esp, 0x54
mov eax, 0x433d78
call fcn.0041f03c
sub esp, 0x114
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4e2590]
cmp eax, dword [0x4e2f92]
jb 0x4187e8
push ebx
push esi
push edi
push 0x10
mov esi, 0x485768
push esi
call fcn.00416ff8
movzx eax, word [0x4d890c]
imul eax, eax, 0x153
pop ecx
sub eax, esi
pop ecx
mov ecx, esi
lea edx, [eax + 0x485794]
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x418659
mov ebx, dword [0x4e2f7c]
mov eax, dword [0x507592]
xor eax, ebx
push 0x3f
mov dword [ebp + 0x50], eax
lea eax, [ebp + 1]
push 0
push eax
mov byte [ebp], 0
call fcn.0041e4c0
lea eax, [ebp]
push 0x3e9
push eax
call fcn.00417c26
lea eax, [ebp]
add esp, 0x14
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41869b
sub eax, edi
mov dword [ebp + 0x48], eax
mov eax, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4186ac
sub eax, edi
mov edi, 0x4e2f68
mov dword [ebp + 0x44], eax
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4186c2
sub eax, ecx
lea ecx, [ebp - 0x120]
mov dword [ebp + 0x4c], eax
call fcn.0040104b
and dword [ebp - 4], 0
mov dword [ebp + 0x40], ebx
xor ebx, ebx
inc ebx
push ebx
push 0x20
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040155c
push ebx
push 8
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp + 0x54], bl
call fcn.0040155c
mov al, byte [ebp + 0x44]
push ebx
mov byte [ebp + 0x54], al
push 8
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040155c
movzx eax, byte [ebp + 0x44]
push eax
push esi
lea ecx, [ebp - 0x120]
call fcn.0040160f
mov eax, dword [ebp + 0x50]
push ebx
mov dword [ebp + 0x50], eax
push 0x20
lea eax, [ebp + 0x50]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040155c
mov al, byte [ebp + 0x48]
push ebx
mov byte [ebp + 0x54], al
push 8
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040155c
movzx eax, byte [ebp + 0x48]
push eax
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040160f
mov al, byte [ebp + 0x4c]
push ebx
mov byte [ebp + 0x54], al
push 8
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040155c
movzx eax, byte [ebp + 0x4c]
push eax
push edi
lea ecx, [ebp - 0x120]
call fcn.0040160f
mov ecx, dword [0x4e2550]
mov edx, dword [ecx]
xor eax, eax
push eax
push dword [0x462184]
push dword [0x462180]
push eax
push eax
push 8
push ebx
lea eax, [ebp - 0x120]
push eax
push 0x460efc
call dword [edx + 0x64]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
mov dword [0x4e2590], eax
call fcn.00401110
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
add ebp, 0x58
leave
ret
Function at 0x4187f7
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x4e2554], 0
je 0x418853
cmp dword [0x4e2560], 0
je 0x418853
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4e2594]
cmp eax, dword [0x4e2f9a]
jb 0x418852
push dword [0x4e25b0]
call fcn.004184e7
pop ecx
call fcn.00417a2d
inc dword [0x4e25b0]
mov eax, dword [0x4e25b0]
cmp eax, dword [0x4e2564]
jl 0x41884b
and dword [0x4e25b0], 0
call esi
mov dword [0x4e2594], eax
pop esi
ret

Function at 0x418cf6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x433c5b
call fcn.0041f03c
sub esp, 0x118
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4e2598]
cmp eax, dword [0x4e2f8e]
jb 0x418e53
push esi
push edi
lea ecx, [ebp - 0x124]
call fcn.0040104b
mov eax, dword [0x4e2584]
xor edi, edi
inc edi
push edi
mov dword [ebp - 0x10], eax
push 0x20
lea eax, [ebp - 0x10]
xor esi, esi
inc dword [0x4e2584]
push eax
lea ecx, [ebp - 0x124]
mov dword [ebp - 4], esi
call fcn.0040155c
mov ecx, dword [0x4e2550]
mov eax, dword [ecx]
push esi
push dword [0x462184]
lea edx, [ebp - 0x124]
push dword [0x462180]
push esi
push esi
push 0xa
push edi
push edx
push 0x460ef8
call dword [eax + 0x64]
mov ecx, dword [0x4e2550]
mov eax, dword [ecx]
push esi
push dword [0x462184]
lea edx, [ebp - 0x124]
push dword [0x462180]
push esi
push esi
push 0xa
push edi
push edx
push 0x460f00
call dword [eax + 0x64]
mov ecx, dword [0x4e2550]
mov eax, dword [ecx]
push esi
push dword [0x462184]
lea edx, [ebp - 0x124]
push dword [0x462180]
push esi
push esi
push 0xa
push edi
push edx
push 0x460f64
call dword [eax + 0x64]
mov ecx, dword [0x4e2550]
mov eax, dword [ecx]
push esi
push dword [0x462184]
lea edx, [ebp - 0x124]
push dword [0x462180]
push esi
push esi
push 0xa
push edi
push edx
push 0x460f54
call dword [eax + 0x64]
mov ecx, dword [0x4e2550]
mov eax, dword [ecx]
push esi
push dword [0x462184]
lea edx, [ebp - 0x124]
push dword [0x462180]
push esi
push esi
push 0xa
push edi
push edx
push 0x460f50
call dword [eax + 0x64]
movzx eax, word [0x4e270d]
push 0x434b04
push edi
push edi
push eax
call fcn.00418b07
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
mov dword [0x4e2598], eax
call fcn.00401110
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x418e5f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4e259c]
cmp eax, dword [0x4e2f96]
jb 0x418e9a
lea eax, [ebp - 0x40]
push 0x3c
push eax
call fcn.00416ff8
lea eax, [ebp - 0x40]
push eax
call fcn.0041899a
add esp, 0xc
call esi
mov dword [0x4e259c], eax
pop esi
leave
ret
Function at 0x418f11
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x433c7b
call fcn.0041f03c
sub esp, 0x228
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
je 0x418f85
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x4e25bc]
cmp eax, dword [ebp + 0xc]
jbe 0x418fcb
call edi
lea ecx, [ebp - 0x120]
mov dword [0x4e25bc], eax
call fcn.0040104b
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
push esi
push dword [0x4621c0]
lea edx, [ebp - 0x120]
push dword [0x4621bc]
mov dword [ebp - 4], esi
push esi
push esi
push 8
push 1
push edx
push 0x460f68
call dword [eax + 0x64]
lea ecx, [ebp - 0x120]
jmp 0x418fc2
lea ecx, [ebp - 0x234]
call fcn.0040104b
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push esi
push dword [0x4621c0]
xor eax, eax
push dword [0x4621bc]
inc eax
push esi
push esi
push 8
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x234]
push eax
push 0x460f68
call dword [edx + 0x64]
lea ecx, [ebp - 0x234]
or dword [ebp - 4], 0xffffffff
call fcn.00401110
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41ca2f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
mov edi, 0x4e2d40
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41ca45
sub eax, edx
mov ebx, eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41ca56
sub eax, ecx
push 0x400
mov dword [ebp - 4], eax
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0041e4c0
mov eax, dword [0x4e2d20]
mov dword [ebp - 0x400], eax
mov ax, word [0x4e2d1e]
push 0x78
mov word [ebp - 0x3fc], ax
pop eax
mov word [ebp - 0x3fa], ax
movzx ax, bl
movzx esi, bl
push esi
mov word [ebp - 0x3f9], ax
lea eax, [ebp - 0x3f7]
push edi
push eax
mov dword [ebp - 0x404], 0x504d4153
call fcn.0041f1d0
add esp, 0x18
add esi, 0xd
cmp dword [ebp + 0xc], 0
jne 0x41caf2
movzx ax, byte [ebp - 4]
movzx edi, byte [ebp - 4]
mov word [ebp + esi - 0x404], ax
inc esi
push edi
push dword [ebp + 8]
inc esi
lea eax, [ebp + esi - 0x404]
push eax
call fcn.0041f1d0
add esp, 0xc
add esi, edi
push 0x10
push 0x4e2d1c
push 0
push esi
lea eax, [ebp - 0x404]
push eax
push dword [0x4e2d18]
call sub.WS2_32.dll_sendto
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41cb13
Capabilities:
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a4
lea eax, [ebp - 0x9a4]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x41cb35
xor eax, eax
leave
ret
push ebx
xor ebx, ebx
push ebx
push 2
push 2
call sub.WS2_32.dll_socket
mov dword [0x4e2d18], eax
cmp eax, 0xffffffff
jne 0x41cb56
call sub.WS2_32.dll_WSACleanup
xor eax, eax
pop ebx
leave
ret
xor eax, eax
mov edi, 0x4e2d1c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
pop eax
mov word [0x4e2d1c], ax
movzx eax, word [0x4e2ce0]
push eax
call sub.WS2_32.dll_htons
mov esi, 0x4e2be0
push esi
mov word [0x4e2d1e], ax
call sub.WS2_32.dll_gethostbyname
cmp eax, ebx
je 0x41cba5
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
push 0x4e2d20
call fcn.0041e0c0
add esp, 0xc
jmp 0x41cbb0
push esi
call sub.WS2_32.dll_inet_addr
mov dword [0x4e2d20], eax
push 2
pop eax
push ebx
mov word [0x4e2d2c], ax
call sub.WS2_32.dll_htons
push dword [0x4e2ce0]
mov word [0x4e2d2e], ax
push esi
push str.RCON_mode_initialized___s:_d_._Type_login__password__to_set_the_password.
call fcn.00416d2c
mov esi, 0x400
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
mov dword [ebp - 4], 0x10
call fcn.0041e4c0
add esp, 0x18
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
lea eax, [ebp - 0x414]
push eax
push dword [0x4e2d18]
call sub.WS2_32.dll_recvfrom
test eax, eax
jle 0x41cc8e
cmp byte [ebp - 0x40a], 0x78
jne 0x41cc8e
push esi
lea eax, [ebp - 0x814]
push ebx
push eax
call fcn.0041e4c0
movsx ax, byte [ebp - 0x409]
movzx edi, ax
mov ecx, esi
add esp, 0xc
lea eax, [ebp - 0x407]
cmp di, cx
ja 0x41cc8e
cmp byte [ebp - 0x407], bl
je 0x41cc61
mov cl, byte [eax]
cmp cl, 1
jl 0x41cc5c
cmp cl, 0x1f
jg 0x41cc5c
mov byte [eax], 0x20
inc eax
cmp byte [eax], bl
jne 0x41cc4d
movzx edi, di
push edi
lea eax, [ebp - 0x407]
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.0041f1d0
lea eax, [ebp - 0x814]
push eax
mov byte [ebp + edi - 0x814], bl
call fcn.00416d2c
add esp, 0x10
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41cbf3

Function at 0x41d904
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x4e2bc4], eax
xor eax, eax
push eax
push eax
push eax
push 0x41d757
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x425301
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x462950]
jne 0x42530b
repz ret
jmp fcn.0042f55f

Function at 0x42efdd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00425382
and dword [ebp - 4], 0
cmp dword [0x50b8a4], 0
mov ebx, eax
jne 0x42f08e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42f13f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x439330
push edi
call esi
test eax, eax
je 0x42f13f
push eax
call fcn.00425310
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x50b8a4], eax
call esi
push eax
call fcn.00425310
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x50b8a8], eax
call esi
push eax
call fcn.00425310
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x50b8ac], eax
call esi
push eax
call fcn.00425310
pop ecx
mov dword [0x50b8b4], eax
test eax, eax
je 0x42f08e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00425310
pop ecx
mov dword [0x50b8b0], eax
mov eax, dword [0x50b8b0]
cmp eax, ebx
je 0x42f0e6
cmp dword [0x50b8b4], ebx
je 0x42f0e6
push eax
call fcn.0042538b
push dword [0x50b8b4]
mov esi, eax
call fcn.0042538b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42f0e6
test edi, edi
je 0x42f0e6
call esi
test eax, eax
je 0x42f0dd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42f0dd
test byte [ebp - 0xc], 1
jne 0x42f0e6
or dword [ebp + 0x10], 0x200000
jmp 0x42f11f
mov eax, dword [0x50b8a8]
cmp eax, ebx
je 0x42f11f
push eax
call fcn.0042538b
pop ecx
test eax, eax
je 0x42f11f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42f11f
mov eax, dword [0x50b8ac]
cmp eax, ebx
je 0x42f11f
push eax
call fcn.0042538b
pop ecx
test eax, eax
je 0x42f11f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x50b8a4]
call fcn.0042538b
pop ecx
test eax, eax
je 0x42f13f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42f141
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b0c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push str.Closing_Byster...
call fcn.1000ac10
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x100a29f0]
je 0x1000b102
mov eax, dword [0x1009d030]
cmp dword [eax + 0x50], 0
je 0x1000b0fd
mov ecx, dword [0x1009d030]
mov edx, dword [ecx + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
nop
jmp 0x1000b22e
call fcn.1001a070
call fcn.1001cc30
mov eax, dword [0x1009d030]
cmp dword [eax + 0x194], 0
je 0x1000b120
call fcn.1003cb70
nop
mov ecx, dword [0x1009d030]
mov dword [ecx + 0x194], 0
call fcn.10013f10
call fcn.100188b0
mov edx, dword [0x1009d030]
mov eax, dword [edx + 0x50]
push eax
push str.ControlEvent___p
call fcn.1000aca0
add esp, 8
mov ecx, dword [0x1009d030]
cmp dword [ecx + 0x50], 0
jne 0x1000b182
push 0x10071a3c
call fcn.1000ac10
add esp, 4
push 0
mov edx, dword [0x1009d030]
mov eax, dword [edx + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov ecx, dword [0x1009d030]
mov edx, dword [ecx + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push str.WaitForSingleObject_ControlEvent
call fcn.1000ac10
add esp, 4
push 0xbb8
mov eax, dword [0x1009d030]
mov ecx, dword [eax + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
push str.WaitForSingleObject_result___08X
call fcn.1000aca0
add esp, 8
mov eax, dword [0x1009d030]
cmp dword [eax + 0x6c], 0
jne 0x1000b1db
mov dword [ebp - 8], 1
jmp 0x1000b1e2
mov dword [ebp - 8], 0
mov cl, byte [ebp - 8]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x1000b211
mov eax, dword [0x1009d030]
add eax, 0x5c
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
call fcn.100062a0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov edx, dword [0x1009d030]
mov eax, dword [edx + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1009d030]
mov dword [ecx + 0x50], 0
mov esp, ebp
pop ebp
ret
Function at 0x1000e7f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], str.Sirus_Launcher.exe
mov eax, dword [ebp + 8]
add eax, 0x24
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0xc]
cmp dl, byte [eax]
jne 0x1000e843
cmp byte [ebp - 1], 0
je 0x1000e83a
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 1]
mov byte [ebp - 2], dl
mov eax, dword [ebp - 0xc]
cmp dl, byte [eax + 1]
jne 0x1000e843
add dword [ebp - 8], 2
add dword [ebp - 0xc], 2
cmp byte [ebp - 2], 0
jne 0x1000e806
mov dword [ebp - 0x14], 0
jmp 0x1000e84b
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x1000e859
jmp 0x1000e89d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1000e875
jmp 0x1000e89d
push 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1000e892
push str.Just_in_case__the_Sirus_launcher_was_closed._We_do_not_recommend_playing_with_Byster_with_the_launcher_enabled.
call fcn.1000b8c0
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov esp, ebp
pop ebp
ret
Function at 0x10012ec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 1
jne 0x10012f0e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x1000ffc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10012f0e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadId]
mov dword [0x100a29f0], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10013300
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x1001331e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 4
jae 0x1001333f
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
imul ecx, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], ecx
jmp 0x10013315
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10015aa0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100a0f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
mov dword [edx], 0
mov eax, dword [ebp - 0x34]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 8], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xb], 0x5c
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x5c
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0
mov dword [ebp - 0x3c], 0
cmp dword [ebp - 0x30], 0
je 0x10015c4f
mov ecx, dword [ebp - 0x30]
and ecx, 1
je 0x10015c39
mov edx, dword [ebp - 0x3c]
add edx, 0x41
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0xc], dl
push 0
push 0
push 3
push 0
push 3
push 0
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x10015b71
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileA_error__X_n
call fcn.10012f20
add esp, 8
jmp 0x10015c39
mov edx, dword [ebp - 0x38]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.100158a0
add esp, 8
mov byte [ebp - 0x25], 1
cmp dword [ebp - 0x14], 0
jne 0x10015b94
mov dword [ebp - 0x40], 1
jmp 0x10015b9b
mov dword [ebp - 0x40], 0
mov cl, byte [ebp - 0x40]
mov byte [ebp - 0x26], cl
movzx edx, byte [ebp - 0x26]
test edx, edx
jne 0x10015c0d
mov dword [ebp - 0x2c], 0
jmp 0x10015bbb
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov ecx, dword [edx + 4]
sub ecx, dword [eax]
mov eax, ecx
cdq
mov ecx, 0x18
idiv ecx
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
cmp dword [ebp - 0x2c], edx
jae 0x10015c0b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
imul ecx, dword [ebp - 0x2c], 0x18
mov edx, dword [ebp - 0x54]
add ecx, dword [edx]
mov dword [ebp - 0x58], ecx
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x58]
call fcn.10006d60
test eax, eax
jne 0x10015c09
mov byte [ebp - 0x25], 0
jmp 0x10015c0b
jmp 0x10015bb2
jmp 0x10015c11
mov byte [ebp - 0x25], 0
movzx ecx, byte [ebp - 0x25]
test ecx, ecx
je 0x10015c26
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp + 8]
call fcn.10015310
nop
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x24]
call fcn.10006780
nop
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x30]
shr edx, 1
mov dword [ebp - 0x30], edx
jmp 0x10015b11
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003a6b5
mov esp, ebp
pop ebp
ret