joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ffa30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa4000]
push edi
jmp 0x4ffa4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ffa51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ffa40
mov eax, 1
add ebx, ebx
jne 0x4ffa63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ffa74
jne 0x4ffa93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ffa93
dec eax
add ebx, ebx
jne 0x4ffa80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ffa58
add ebx, ebx
jne 0x4ffa8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ffae5
xor ecx, ecx
sub eax, 3
jb 0x4ffaab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ffb1a
sar eax, 1
mov ebp, eax
jmp 0x4ffab6
add ebx, ebx
jne 0x4ffab6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ffa84
inc ecx
add ebx, ebx
jne 0x4ffac4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ffa84
add ebx, ebx
jne 0x4ffad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ffac6
jne 0x4ffae2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ffac6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ffb04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ffaf6
jmp 0x4ffa46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ffb04
add edi, ecx
jmp 0x4ffa46
pop esi
mov edi, esi
mov ecx, 0x3b6d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ffb22
cmp byte [edi], 0x17
jne 0x4ffb22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ffb27
lea edi, [esi + 0xf9000]
mov eax, dword [edi]
or eax, eax
je 0x4ffb96
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11bff8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11c08c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ffb54
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11c094]
or eax, eax
je 0x4ffb90
mov dword [ebx], eax
add ebx, 4
jmp 0x4ffb71
call dword [esi + 0x11c090]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4ffbc7
cmp al, 0xef
ja 0x4ffbba
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4ffb9c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4ffba9
mov ebp, dword [esi + 0x11c098]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ffbfb
sub esp, 0xffffff80
jmp 0x435126
Function at 0x401fc9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x40201d
push dword [ebp + 0x14]
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100081d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
push edi
call fcn.100055b0
push eax
call fcn.100078c0
add esp, 4
xor ecx, ecx
nop dword [eax]
mov eax, ecx
test cl, 1
je 0x100081fa
xor eax, 2
shr eax, 1
test al, 1
je 0x10008203
xor eax, 2
shr eax, 1
test al, 1
je 0x1000820c
xor eax, 2
shr eax, 1
test al, 1
je 0x10008215
xor eax, 2
shr eax, 1
test al, 1
je 0x1000821e
xor eax, 2
shr eax, 1
test al, 1
je 0x10008227
xor eax, 2
shr eax, 1
test al, 1
je 0x10008230
xor eax, 2
shr eax, 1
test al, 1
je 0x10008239
xor eax, 2
shr eax, 1
mov dword [ecx*4 + 0x100899b0], eax
inc ecx
cmp ecx, 0x100
jb 0x100081f0
mov esi, 0x10c
or ebx, 0xffffffff
cmp edi, esi
jbe 0x10008288
mov eax, dword [ebp - 4]
movsx eax, byte [esi + eax]
push eax
call fcn.100055b0
push eax
call fcn.100078c0
mov eax, dword [ebp - 4]
add esp, 4
movzx ecx, bl
shr ebx, 8
movzx eax, byte [esi + eax]
inc esi
xor ecx, eax
xor ebx, dword [ecx*4 + 0x100899b0]
cmp esi, edi
jb 0x10008257
pop edi
not ebx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009b10
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100885a4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10090b78]
cmp eax, dword [ecx + 4]
jle 0x10009b68
push 0x10090b78
call fcn.1002b7de
add esp, 4
cmp dword [0x10090b78], 0xffffffff
jne 0x10009b68
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x10090b78
mov dword [0x10090b74], eax
call fcn.1002b79f
add esp, 4
mov edx, dword [0x10090b74]
push esi
lea esi, [edx + 0x1000]
cmp edx, esi
je 0x10009b93
nop dword [eax]
lea ecx, [edx + 0x1c]
call fcn.10009b00
test eax, eax
je 0x10009b97
add edx, 0x20
cmp edx, esi
jne 0x10009b80
xor eax, eax
pop esi
ret
mov eax, edx
pop esi
ret

Function at 0x10009ba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov edi, ecx
call fcn.10009b10
mov ebx, eax
xor esi, esi
mov dword [ebp - 4], ebx
nop word [eax + eax]
lea ecx, [esi + edi]
call fcn.100098c0
add esi, eax
cmp esi, 5
jl 0x10009bc0
test esi, esi
jle 0x10009bf1
mov ecx, ebx
mov edx, esi
mov ebx, edi
sub ebx, ecx
nop dword [eax + eax]
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10009be0
mov ebx, dword [ebp - 4]
lea ecx, [esi + ebx]
lea eax, [edi - 5]
mov byte [ecx], 0xe9
sub esi, ecx
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 1], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
mov eax, dword [ebp - 0xc]
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a4b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 1]
push eax
call fcn.10044620
add esp, 0xc
xorps xmm0, xmm0
movq qword [esi + 0x44], xmm0
mov ecx, esi
movups xmmword [esi + 0x4c], xmm0
push dword [ebp + 0xc]
movups xmmword [esi + 0x5c], xmm0
mov byte [esi], 0
push dword [ebp + 8]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
call fcn.1000e230
mov ecx, esi
call fcn.1000e2e0
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1000ab50
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068b20
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x10085070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x28], 0x64005c
push 0x2800
push eax
push 0x1008de10
mov dword [ebp - 0x24], 0x650073
mov dword [ebp - 0x20], 0x750074
mov dword [ebp - 0x1c], 0x2e0070
mov dword [ebp - 0x18], 0x6c0064
mov dword [ebp - 0x14], 0x6c
call fcn.10044620
add esp, 0xc
push 0x1008de10
call fcn.1000b3b0
test al, al
je 0x1000adc8
mov ecx, 0x1008de10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000abd1
sub ecx, edx
sar ecx, 1
je 0x1000adc8
push 0x1008e610
call fcn.1000af70
test al, al
je 0x1000adc8
mov ecx, 0x1008e610
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000ac00
sub ecx, edx
sar ecx, 1
je 0x1000adc8
push 0x1008ee10
call fcn.1000b5e0
test al, al
je 0x1000adc8
mov ecx, 0x1008ee10
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000ac30
sub ecx, edx
sar ecx, 1
je 0x1000adc8
push 0x1008f610
call fcn.1000b730
test al, al
je 0x1000adc8
mov ecx, 0x1008f610
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000ac60
sub ecx, edx
sar ecx, 1
je 0x1000adc8
push 0x1008fe10
lea eax, [ebp - 0x28]
push eax
call fcn.1000aa00
test al, al
je 0x1000adc8
mov eax, 0x1008fe10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000ac93
sub eax, edx
sar eax, 1
je 0x1000adc8
push 0x1008de10
lea ecx, [ebp - 0x40]
call fcn.10008b10
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000a5a0
push eax
mov ecx, 0x10090610
call fcn.10002d20
lea ecx, [ebp - 0x58]
call fcn.10002cb0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.10008ad0
push 0x1008e610
lea ecx, [ebp - 0x40]
call fcn.10008b10
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000a5a0
push eax
mov ecx, 0x10090628
call fcn.10002d20
lea ecx, [ebp - 0x58]
call fcn.10002cb0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.10008ad0
push 0x1008ee10
lea ecx, [ebp - 0x40]
call fcn.10008b10
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1000a5a0
push eax
mov ecx, 0x10090640
call fcn.10002d20
lea ecx, [ebp - 0x58]
call fcn.10002cb0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.10008ad0
push 0x1008f610
lea ecx, [ebp - 0x70]
call fcn.10008b10
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 3
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.1000a5a0
push eax
mov ecx, 0x10090658
call fcn.10002d20
lea ecx, [ebp - 0x88]
call fcn.10002cb0
lea ecx, [ebp - 0x70]
call fcn.10008ad0
push 0
push 0
push 0x1000ab20
call fcn.1004bfd3
add esp, 0xc
mov al, 1
jmp 0x1000adca
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002b695
mov esp, ebp
pop ebp
ret
Function at 0x1000d6d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10085070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, str.Initializing_extender
call fcn.100075d0
push eax
call fcn.100078c0
add esp, 4
cmp dword [0x10089db4], 0
jne 0x1000d7c9
mov dword [0x10089db4], 1
call fcn.100118a0
test al, al
je 0x1000d7c9
mov edx, str.PHX_created
call fcn.100075d0
push eax
call fcn.100078c0
add esp, 4
call fcn.1000ab50
test al, al
je 0x1000d7c9
mov edx, str.HWID_created
call fcn.100075d0
push eax
call fcn.100078c0
add esp, 4
lea eax, [ebp - 0x28]
push eax
call fcn.10003d30
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x1000d776
mov eax, dword [eax]
push eax
call dword [0x10090708]
lea ecx, [ebp - 0x28]
mov dword [0x100899ac], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10002cb0
cmp dword [0x100899ac], 0
je 0x1000d7c9
mov edx, str.ENGINE_created
call fcn.100075d0
push eax
call fcn.100078c0
push 0
push 0
push 0x1000d5e0
call fcn.1004bfd3
push 0
push 0
push 0x1000d7f0
call fcn.1004bfd3
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002b695
mov esp, ebp
pop ebp
ret

Function at 0x1000e740
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068d73
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x10085070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x78]
push eax
call fcn.10003850
mov edx, eax
mov dword [ebp - 4], 0
cmp dword [edx + 0x14], 0x10
jb 0x1000e786
mov edx, dword [edx]
mov dword [ebp - 0x7c], 0xf
mov dword [ebp - 0x80], 0
mov byte [ebp - 0x90], 0
cmp byte [edx], 0
jne 0x1000e7a4
xor ecx, ecx
jmp 0x1000e7b9
mov ecx, edx
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000e7b0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x90]
call fcn.10002f00
lea edx, [ebp - 0x90]
mov byte [ebp - 4], 1
call fcn.10007330
push eax
call fcn.100078c0
add esp, 4
lea ecx, [ebp - 0x90]
call fcn.10002cb0
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], 0xffffffff
call fcn.10002cb0
lea eax, [ebp - 0x78]
push eax
call fcn.10003850
cmp dword [eax + 0x14], 0x10
jb 0x1000e809
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
lea ecx, [ebp - 0x78]
mov esi, eax
call fcn.10002cb0
test esi, esi
je 0x1000e850
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000e850
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
push eax
lea eax, [ebp - 0x60]
push str._u._u._u._u
push eax
call fcn.1000e6d0
add esp, 0x18
lea esi, [ebp - 0x60]
jmp 0x1000e855
mov esi, 0x1007a7f9
mov edx, str.getHostAddress__
call fcn.100075d0
push eax
call fcn.100078c0
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002b695
mov esp, ebp
pop ebp
ret
Function at 0x10010aa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
jmp 0x10010abc
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
push eax
push dword [ebp + 8]
lea ecx, [ebx + 0x100]
mov dword [ebx + 0x110], eax
push ecx
call fcn.100440a0
add esp, 0xc
xor eax, eax
nop dword [eax]
mov byte [eax + ebx], al
inc eax
cmp eax, 0x100
jl 0x10010ae0
xor edi, edi
mov dword [ebx + 0x114], 0
mov dword [ebx + 0x118], 0
xor esi, esi
mov dword [ebp + 0xc], edi
nop word [eax + eax]
mov dl, byte [esi + ebx]
movzx eax, byte [ebx + edi + 0x100]
add eax, dword [ebp + 0xc]
movzx ecx, dl
add ecx, eax
movzx ecx, cl
mov dword [ebp + 0xc], ecx
mov al, byte [ecx + ebx]
mov byte [esi + ebx], al
lea eax, [edi + 1]
mov byte [ecx + ebx], dl
inc esi
cdq
idiv dword [ebx + 0x110]
mov edi, edx
cmp esi, 0x100
jl 0x10010b10
jmp 0x10010b59
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10014440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069558
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10085070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1001456f
cmp byte [ebx + 0x3d], 0
je 0x1001456f
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10014499
xor al, al
jmp 0x10014571
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10006000
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10014507
sub eax, 1
je 0x1001450b
sub eax, 2
je 0x10014561
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.10002cb0
mov al, bl
jmp 0x10014571
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x10014543
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1005070a
add esp, 0x10
cmp esi, eax
jne 0x100144f9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x10014561
test esi, esi
jne 0x100144c4
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10004620
jmp 0x100144be
lea ecx, [ebp - 0x28]
mov bl, 1
call fcn.10002cb0
mov al, bl
jmp 0x10014571
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002b695
mov esp, ebp
pop ebp
ret
Function at 0x10014730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069586
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10085070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1002bc43
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100177c7
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov ecx, edi
mov eax, dword [edi + 0x20]
push 0
push dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
call fcn.10014590
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100159e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069676
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10085070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1002bc43
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100177c7
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002e4dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1005ab92
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005aa11

Function at 0x1005e1cd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005de8d
Function at 0x40b780
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x272c8dc], 0x930
jne 0x40b79d
push str.zetiguhupidatoxagekelelorunad
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp dword [0x272c8dc], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x272c5f8], eax
jne 0x40b7c3
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov esp, ebp
pop ebp
ret
Function at 0x425a48
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
mov esi, dword [esp + 0x10]
inc dword [esi + 0x10]
xor ebp, ebp
cmp byte [esi + 0xa], 0
je 0x425a64
call ebx
mov ebp, eax
push dword [esi + 4]
call dword [esi]
pop ecx
cmp al, byte [esi + 8]
je 0x425a73
mov al, 1
jmp 0x425aa3
cmp byte [esi + 0xa], 0
je 0x425aa1
push edi
mov edi, dword [esi + 0x10]
call ebx
movzx edx, word [esi + 0x14]
lea ecx, [edi - 1]
imul ecx, edx
sub ecx, ebp
add eax, ecx
xor edx, edx
div edi
mov ecx, 0x1388
pop edi
cmp eax, ecx
jb 0x425a9d
mov eax, ecx
mov word [esi + 0x14], ax
xor al, al
pop esi
pop ebp
pop ebx
ret
Function at 0x4312b5
Capabilities:
Get disk information

Disassembly:
mov eax, 0x45cd39
call fcn.0044e550
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x4313fd
cmp byte [esi], bl
je 0x4313fd
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
test byte [ebp + 0xc], 4
je 0x4312f8
push ebx
push esi
lea ecx, [ebp - 0x24]
call fcn.00438269
mov esi, eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp + 8], esi
cmp edi, ebx
jne 0x431308
lea edi, [ebp - 0x14]
cmp byte [esi], 0x5c
jne 0x431370
lea eax, [esi + 1]
cmp byte [eax], 0x5c
jne 0x431340
cmp byte [esi + 2], 0x3f
jne 0x431340
cmp byte [esi + 3], 0x5c
jne 0x431340
push 8
pop ebx
push 4
add esi, 4
push str.UNC_
push esi
call sym.qmmacro.exe_q_strnicmp
add esp, 0xc
test eax, eax
jne 0x431370
add esi, 3
jmp 0x431347
mov esi, eax
cmp byte [esi], 0x5c
jne 0x43136b
push 0
push 0
push edi
push 0x40
push 0x464494
push esi
call fcn.00445eff
add esp, 0x18
test eax, eax
jl 0x4313f1
add esi, dword [edi]
or ebx, 2
jmp 0x431396
push 0x11
pop ebx
jmp 0x431396
cmp byte [esi + 1], 0x3a
jne 0x4313f1
movzx eax, byte [esi]
mov ecx, 0x103
test word [eax*2 + 0x475468], cx
je 0x4313f1
mov dword [ebp + 8], esi
inc esi
inc esi
cmp byte [esi], 0x5c
jne 0x431393
inc esi
or ebx, 1
mov eax, esi
sub eax, dword [ebp - 0x10]
mov dword [edi], eax
cmp byte [esi], 0
je 0x4313ab
test byte [ebp + 0xc], 1
jne 0x4313f1
or ebx, 4
test byte [ebp + 0xc], 2
je 0x4313e1
mov eax, ebx
and al, 0x11
cmp al, 1
jne 0x4313e1
mov eax, dword [ebp + 8]
mov cl, byte [eax]
mov al, byte [eax + 1]
mov byte [ebp + 9], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 8], cl
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x4313e1
or ebx, 2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0042b651
mov eax, ebx
jmp 0x4313ff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0042b651
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret