joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6102fcd0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
sub esp, 0x178
mov edx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
mov eax, dword [edx]
mov dword [ebp - 0x160], esp
cmp eax, 0xffffffff
je 0x6102fd00
test al, 0x10
je 0x6102fd00
mov ecx, 1
test ecx, ecx
je 0x6102fd0d
cmp byte [edx + 0x218], 0
je 0x6102fd20
mov eax, esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
lea ebx, [edx + 0x24c]
mov dword [esp], ebx
call sym.cygwin1.dll__strlen
mov dword [ebp - 0x15c], eax
add eax, 0x12
and eax, 0xfffffff0
call sym.cygwin1.dll__alloca
mov dword [esp + 4], ebx
lea edi, [esp + 8]
mov dword [esp], edi
call sym.cygwin1.dll__strcpy
cmp esi, 1
ja 0x6102febb
xor ebx, ebx
mov eax, 0x6102fcc0
mov dword [ebp - 0x164], ebx
mov ecx, dword [ebp - 0x15c]
test ecx, ecx
je 0x6102fea8
mov ecx, dword [ebp - 0x15c]
movzx edx, byte [edi + ecx - 1]
cmp dl, 0x2f
je 0x6102fea8
cmp dl, 0x5c
je 0x6102fea8
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x15c]
lea eax, [ecx + edi]
lea esi, [esi]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov dword [esp], edi
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov edx, 2
cmp eax, 0xffffffff
mov dword [ebp - 0x168], edx
mov ebx, eax
je 0x6102fdea
cmp esi, 1
jbe 0x6102fe42
mov eax, 1
mov dword [ebp - 0x168], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_FindClose
sub esp, 4
cmp esi, 1
ja 0x6102fe09
mov edx, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x168]
mov esp, dword [ebp - 0x160]
lea eax, [ecx + edx]
jmp 0x6102fd0f
mov ecx, dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov byte [edi + ecx + 2], 0
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
mov ebx, eax
test eax, eax
je 0x6102fe35
dec dword [ebp - 0x168]
mov dword [esp], ebx
call sub.KERNEL32.dll_FindClose
sub esp, 4
jmp 0x6102fdef
test byte [ebp - 0x158], 0x10
je 0x6102fe51
inc dword [ebp - 0x164]
cmp byte [ebp - 0x12c], 0x2e
je 0x6102fe78
mov dword [esp], ebx
lea edx, [ebp - 0x158]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
jne 0x6102fe42
jmp 0x6102fddf
cmp byte [ebp - 0x12b], 0
je 0x6102fea0
mov eax, dword [ebp - 0x12c]
and eax, 0xffff00
cmp eax, 0x2e00
jne 0x6102fe5a
lea esi, [esi]
lea edi, [edi]
dec dword [ebp - 0x168]
jmp 0x6102fe5a
inc eax
mov dword [esp + 4], eax
mov edx, dword [ebp - 0x15c]
lea eax, [edx + edi]
jmp 0x6102fda0
mov dword [ebp - 0x164], esi
mov eax, 0x6102fcc3
jmp 0x6102fd65
Function at 0x6102ff50
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x9c
mov ebx, eax
mov dword [ebp - 0x5c], edx
mov dword [esp], ebx
mov eax, dword [ebx]
call dword [eax + 0xc0]
lea edx, [ebp - 0x58]
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileInformationByHandle
mov dword [ebp - 0x6c], eax
sub esp, 8
test eax, eax
je 0x6102ff99
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x6102ff93
inc eax
jne 0x6102ff99
inc esi
cmp esi, 1
jle 0x6102ff63
mov edi, dword [0x610f08a0]
test edi, edi
jne 0x61030045
mov esi, dword [ebp - 0x6c]
test esi, esi
je 0x61030010
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x48]
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x50]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x5c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
mov eax, ebx
call fcn.61030630
sub esp, 0x2c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cld
mov eax, dword [ebp - 0x6c]
mov ecx, 0xd
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
mov dword [esp], ebx
mov eax, dword [ebx]
call dword [eax + 0xc0]
lea edx, [ebp - 0x38]
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 0x34], eax
sub esp, 8
jmp 0x6102ffae
mov dword [esp], ebx
mov eax, dword [ebx]
call dword [eax + 0xc0]
mov edi, dword [ebp - 0x6c]
lea edx, [ebx + 0x288]
mov eax, dword [eax]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], 0x6102ff20
mov dword [esp + 8], 0x6102fee0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6102ffa7

Function at 0x61031ae0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x288]
mov dword [ebx + 0x398], eax
mov dword [esp + 4], eax
mov dword [esp], 0x6a
call sub.KERNEL32.dll_GetLogicalDriveStringsA
shr eax, 2
sub esp, 8
mov dword [ebx + 0x394], eax
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x61036bc0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x38]
push edi
push esi
push ebx
sub esp, 0x6c
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalMemoryStatus
mov esi, dword [ebp - 0x30]
sub esp, 4
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], 0x61036a80
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x2c]
mov dword [esp + 8], esi
sub edx, esi
mov eax, edx
mov dword [esp + 0x1c], edx
sub ebx, esi
shr eax, 0xa
mov dword [esp + 0x34], eax
mov ecx, edi
mov eax, ebx
mov dword [esp + 0x14], ebx
shr eax, 0xa
shr ecx, 0xa
mov dword [esp + 0x30], eax
mov eax, esi
shr eax, 0xa
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov eax, ebx
sub eax, edx
mov dword [esp + 0x18], eax
mov eax, esi
sub eax, edi
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], ecx
mov dword [esp], eax
call fcn.6108c610
lea esp, [ebp - 0xc]
cdq
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6103b440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x14]
mov dword [esi], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov ebx, eax
test eax, eax
je 0x6103b4f0
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x6103b4a1
mov eax, ebx
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esi]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6103b400
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x6103b3a0
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6103b492
call sub.KERNEL32.dll_GetLastError
mov dword [esi], eax
cmp eax, 0x456
je 0x6103b505
cmp eax, 0x457
jne 0x6103b489
mov dword [esi], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov ebx, eax
test eax, eax
jne 0x6103b489
call sub.KERNEL32.dll_GetLastError
mov dword [esi], eax
jmp 0x6103b489
Function at 0x6103b5e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x14]
mov dword [esi], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov ebx, eax
test eax, eax
je 0x6103b690
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x6103b642
mov eax, ebx
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esi]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6103b5a0
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x6103b560
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6103b633
call sub.KERNEL32.dll_GetLastError
mov dword [esi], eax
cmp eax, 0x456
je 0x6103b6a5
cmp eax, 0x457
jne 0x6103b629
mov dword [esi], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov ebx, eax
test eax, eax
jne 0x6103b629
call sub.KERNEL32.dll_GetLastError
mov dword [esi], eax
jmp 0x6103b629
Function at 0x61040540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov dword [ebp - 0xc], ebx
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x10]
test ebx, ebx
mov dword [ebp - 4], edi
je 0x610407a8
movzx eax, word [edx]
cmp ax, 2
je 0x61040780
dec ax
je 0x61040590
call sym.cygwin1.dll___errno
mov dword [eax], 0x6a
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], 0
lea eax, [ebp - 0x378]
add edx, 2
mov ecx, 0x21
call fcn.610620e0
mov eax, dword [ebp - 0x150]
test eax, eax
jne 0x61040767
cmp dword [ebp - 0x378], 0xffffffff
je 0x61040757
test byte [ebp - 0x155], 0x40
jne 0x610405db
call sym.cygwin1.dll___errno
mov dword [eax], 9
jmp 0x6104057f
mov eax, dword [0x61148914]
lea edx, [ebp - 0x12c]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0x610ef77c
mov dword [esp + 8], eax
mov dword [esp + 4], 0x80000000
mov dword [esp], edx
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x414], eax
sub esp, 0x1c
inc eax
je 0x61040743
cld
xor eax, eax
xor edi, edi
mov dword [ebp - 0x418], eax
mov ecx, 0x20
xor eax, eax
mov dword [ebp - 0x410], edi
lea edi, [ebp - 0x3f8]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0x410]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x3f8]
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
jne 0x610406a2
mov edx, dword [ebp - 0x414]
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x418]
sub esp, 4
jmp 0x61040581
mov dword [esp + 0xc], ebx
lea eax, [ebx + 0xc]
mov ecx, 2
mov dword [esp + 0x18], eax
lea eax, [ebx + 8]
mov dword [esp + 0x14], eax
lea eax, [ebx + 4]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x406]
mov dword [esp + 8], eax
lea eax, [ebp - 0x3ee]
mov word [ebp - 0x408], cx
mov dword [esp + 4], 0x610404ca
mov dword [esp], eax
call fcn.610d32e0
movzx eax, word [ebp - 0x406]
mov edx, 0x100007f
xchg ah, al
mov word [ebp - 0x406], ax
mov word [ebp - 0x40a], ax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x404], edx
mov dword [esi + 4], 0x100007f
mov dword [esi], eax
mov eax, dword [ebp - 0x400]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x3fc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x10
mov eax, 1
mov dword [ebp - 0x418], eax
jmp 0x61040686
mov edx, 0x5b
mov eax, 0x61040500
call fcn.61022e70
jmp 0x6104057f
call sym.cygwin1.dll___errno
mov dword [eax], 2
jmp 0x6104057f
call sym.cygwin1.dll___errno
mov edx, dword [ebp - 0x150]
mov dword [eax], edx
jmp 0x6104057f
mov eax, dword [edx]
mov dword [esi], eax
mov eax, dword [edx + 4]
mov dword [esi + 4], eax
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov eax, dword [edx + 0xc]
mov edx, dword [ebp + 0x14]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, 1
jmp 0x61040581
lea ebx, [ebp - 0x28]
jmp 0x61040563
Function at 0x6104c440
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ebx
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp edx, 0xffffffff
je 0x6104c46d
mov eax, dword [ebx + 4]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov ebx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_TlsAlloc
mov dword [ebx + 4], eax
xor edx, edx
jmp 0x6104c454
Function at 0x6104c6f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x14]
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x18], 0
test edx, edx
mov dword [ebp - 0x14], edx
je 0x6104c7c7
jmp 0x6104c720
lea ecx, [eax + 4]
mov edi, dword [eax]
mov eax, dword [0x61148914]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 4]
test eax, eax
jne 0x6104c73b
mov ecx, dword [ebp - 0x14]
mov eax, edi
sub eax, ecx
mov ebx, dword [ebp - 0x14]
mov esi, eax
cmp ebx, edi
jae 0x6104c7ae
lea esi, [esi]
lea edi, [edi]
mov dword [ebp - 0x10], 0
lea eax, [esi + ebx]
cmp eax, edi
jbe 0x6104c762
mov esi, edi
sub esi, ebx
mov dword [esp + 0xc], esi
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov eax, dword [edx]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteProcessMemory
mov dword [ebp - 0x20], eax
mov edx, dword [0x610f08a0]
sub esp, 0x14
test edx, edx
jne 0x6104c890
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6104c878
mov edx, dword [ebp - 0x10]
cmp esi, edx
jne 0x6104c803
add ebx, edx
cmp ebx, edi
jb 0x6104c750
inc dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ecx]
add eax, 4
test ecx, ecx
mov dword [ebp - 0x14], ecx
jne 0x6104c720
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x6104c7dd
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x6104c636
mov dword [esp + 8], 0x6104c600
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6104c7d0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x6104c640
mov dword [esp + 8], 0x6104c600
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x8000
mov dword [esp], 0x610f089c
call fcn.6108fd50
mov dword [esp + 4], 1
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
call sym.cygwin1.dll___errno
mov dword [eax], 0xb
xor eax, eax
jmp 0x6104c7d5
mov edx, 0x69
mov eax, 0x6104c680
call fcn.61022e70
mov edx, dword [ebp - 0x10]
jmp 0x6104c803
mov dword [esp + 0x1c], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
mov eax, dword [edx]
mov dword [esp + 0xc], 0x6104c6c0
mov dword [esp + 8], 0x6104c600
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6104c796
Function at 0x6104cad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [0x610f08a0]
movzx eax, byte [ebp + 0x10]
mov edi, dword [ebp + 8]
test edx, edx
mov esi, dword [ebp + 0xc]
jne 0x6104cce8
mov eax, dword [edi]
mov dword [ebp - 0x18], esi
mov dword [esp + 0xc], 0x493e0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 2
call sub.KERNEL32.dll_WaitForMultipleObjects
sub esp, 0x10
mov ebx, eax
test eax, eax
jne 0x6104cb66
mov ebx, dword [0x610f08a0]
test ebx, ebx
jne 0x6104cb40
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x6104c924
mov dword [esp + 8], 0x6104c8e0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6104cb2f
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
test eax, eax
je 0x6104cb25
cmp ebx, 0xffffffff
je 0x6104ccde
cmp ebx, 0x102
je 0x6104cc69
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeProcess
mov edx, dword [ebp - 0x1c]
sub esp, 8
cmp edx, 0xc000013a
je 0x6104cc27
mov eax, dword [0x61148914]
mov ebx, dword [edi + 8]
movzx eax, byte [eax + 0xf]
mov ecx, ebx
shr al, 1
and eax, 1
test al, al
je 0x6104cbca
neg ecx
mov dword [esp + 0x18], edx
mov eax, dword [edi]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x6104c940
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x6104c8e0
mov dword [esp + 4], 0x8000
mov dword [esp], 0x610f089c
call fcn.6108fd50
mov dword [esp + 0xc], 0x6104c97c
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], 0x6104c8e0
mov dword [esp + 4], 0x8000
mov dword [esp + 0x10], eax
mov dword [esp], 0x610f089c
call fcn.6108fd50
call sym.cygwin1.dll___errno
mov dword [eax], 0xb
mov esi, dword [0x610f08a0]
test esi, esi
jne 0x6104cc43
xor eax, eax
jmp 0x6104cb34
mov dword [esp + 0xc], 0x6104c9a0
mov dword [esp + 8], 0x6104c8e0
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6104cc3c
mov dword [esp + 0xc], 0x6104c9e0
mov dword [esp + 8], 0x6104c8e0
mov dword [esp + 4], 0x8000
mov dword [esp], 0x610f089c
call fcn.6108fd50
call sym.cygwin1.dll___errno
mov dword [eax], 0xb
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x6104ccb8
mov dword [esp + 4], 1
mov eax, dword [edi]
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
jmp 0x6104cc3c
mov dword [esp + 0xc], 0x6104ca20
mov dword [esp + 8], 0x6104c8e0
mov dword [esp + 4], 0x10
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6104cca1
mov dword [esp + 0xc], 0x6104ca60
jmp 0x6104cc71
mov dword [esp + 0xc], 0x6104caa0
movzx eax, al
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], 0x6104c8e0
mov dword [esp + 4], 0x40
mov dword [esp + 0x10], eax
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6104caf1
Function at 0x61051c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov edx, dword [section.noname29]
test edx, edx
je 0x61051ca4
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x10], 0
mov eax, 0x61051bf0
mov dword [0x610e91b0], eax
lea eax, [ebp - 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x61051bf0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
mov dword [0x61141994], eax
sub esp, 0x18
jmp 0x61051ca0
Function at 0x6105b870
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
call fcn.61089f00
mov edx, ebx
mov eax, esi
call fcn.61055380
test eax, eax
mov edx, 0xffffffff
jne 0x6105b8c0
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.610ff1b8
sub esp, 8
test eax, eax
jne 0x6105b900
mov ebx, dword [0x610f08a0]
test ebx, ebx
jne 0x6105b8d0
xor ecx, ecx
xor edx, edx
mov dword [sym.cygwin1.dll_h_errno], ecx
mov ebx, dword [ebp - 8]
mov eax, edx
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x6105b85c
mov dword [esp + 8], 0x6105b830
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6105b8b6
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_GetComputerNameA
sub esp, 8
test eax, eax
jne 0x6105b8ac
mov edx, 0x3d3
mov eax, 0x6105b807
call fcn.6105a160
mov edx, 0xffffffff
jmp 0x6105b8c0

Function at 0x6105f300
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x240
mov eax, dword [0x61148914]
movzx eax, byte [eax + 0xc]
and eax, 1
test al, al
je 0x6105f400
mov dword [esp + 4], 0x104
lea ebx, [ebp - 0x118]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetSystemDirectoryA
sub esp, 8
xor edx, edx
test eax, eax
je 0x6105f396
mov dword [esp + 4], 0x6105f2b4
mov dword [esp], ebx
lea esi, [ebp - 0x228]
call sym.cygwin1.dll__strcat
mov dword [esp], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
call sym.cygwin1.dll__strcat
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.61068d20
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x6105f3d0
mov dword [esp + 4], 0x6105f2c2
mov dword [esp], esi
call fcn.610d3f00
mov ebx, eax
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x6105f3a0
mov edx, ebx
lea esp, [ebp - 8]
mov eax, edx
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6105f2c5
mov dword [esp + 8], 0x6105f290
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6105f394
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x6105f2dd
mov dword [esp + 8], 0x6105f290
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x6105f379
mov dword [esp + 4], 0x104
lea ebx, [ebp - 0x118]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
sub esp, 8
xor edx, edx
test eax, eax
je 0x6105f396
mov dword [esp + 4], 0x6105f2f3
jmp 0x6105f346
Function at 0x61061650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x61146a60], 2
mov dword [ebp - 8], esi
mov ecx, dword [ebp + 8]
mov esi, eax
mov dword [ebp - 4], edi
mov edi, edx
je 0x610616a0
cld
and eax, 0xff
dec ecx
js 0x61061688
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x61061684
xor al, byte [eax + 0x610ef1e4]
cmp al, byte [edi - 1]
jne 0x6106168f
test al, al
jne 0x61061672
mov eax, 1
jmp 0x61061691
xor eax, eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.cygwin1.dll__strncmp
test eax, eax
sete al
invalid
invalid

Function at 0x610645c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov esi, dword [eax + 0x3f64]
mov dword [ebp - 0x10], edx
add eax, 0x3e60
mov edx, dword [ebp + 0x14]
lea edi, [esi + 1]
mov dword [ebp - 0x14], edx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.cygwin1.dll__memcpy
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x610eefe4]
mov byte [esi + ebx], al
movzx eax, byte [edx + 2]
test al, al
je 0x61064680
cmp al, 0x2f
je 0x61064670
cmp al, 0x5c
je 0x61064670
mov byte [edi + ebx], 0x2f
lea esi, [edi + 1]
mov eax, dword [ebp - 0x10]
movzx edx, byte [eax + 2]
cmp dl, 0x2f
je 0x61064662
cmp dl, 0x5c
mov eax, 2
je 0x61064662
mov ecx, dword [ebp - 0x10]
add eax, ecx
mov dword [esp + 4], eax
lea eax, [esi + ebx]
mov dword [esp], eax
call sym.cygwin1.dll__strcpy
mov dword [ebp + 0xc], ebx
mov edx, dword [ebp - 0x14]
mov dword [ebp + 8], ebx
mov dword [ebp + 0x10], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.610632d0
mov eax, 3
jmp 0x61064636
mov eax, dword [ebp - 0x10]
cmp byte [eax + 3], 0
jne 0x61064619
lea esi, [esi]
mov byte [edi + ebx], 0
jmp 0x6106464a