joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4694e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x469501
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x46955b
inc edi
cmp edi, esi
jl 0x4694f5
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x469590
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x46954a
cmp byte [eax], bl
je 0x469565
cmp byte [eax + 1], bl
je 0x46956e
cmp byte [eax + 2], bl
je 0x469578
cmp byte [eax + 3], bl
je 0x469584
add eax, 4
cmp eax, edi
jb 0x469521
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x469b70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x469ba2
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], pe_nt_image_headers32
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x469c02
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x469bd9
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x469cb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x469d4c
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x469cdb
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret
Function at 0x40214a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x82314c]
jne 0x402154
repz ret
jmp fcn.00402c23

Function at 0x40fb76
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x82314c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040595d
and dword [ebp - 0x14], 0
cmp dword [0x825fe4], 0
mov dword [ebp - 0x18], eax
jne 0x40fc29
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40fcd1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40fcd1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x825fe4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x825fe8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x825fec], eax
call edi
push eax
call esi
mov dword [0x825ff4], eax
test eax, eax
je 0x40fc29
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x825ff0], eax
mov eax, dword [0x825ff0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40fc82
cmp dword [0x825ff4], ecx
je 0x40fc82
push eax
call esi
push dword [0x825ff4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40fc82
test ebx, ebx
je 0x40fc82
call edi
test eax, eax
je 0x40fc79
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40fc79
test byte [ebp - 8], 1
jne 0x40fc82
or dword [ebp + 0x10], 0x200000
jmp 0x40fcb5
mov eax, dword [0x825fe8]
cmp eax, dword [ebp - 0x18]
je 0x40fcb5
push eax
call esi
test eax, eax
je 0x40fcb5
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40fcb5
mov eax, dword [0x825fec]
cmp eax, dword [ebp - 0x18]
je 0x40fcb5
push eax
call esi
test eax, eax
je 0x40fcb5
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x825fe4]
call esi
test eax, eax
je 0x40fcd1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40fcd3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040214a
leave
ret
Function at 0x8140c0
Capabilities:
Get disk information
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x82314c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [0x82a1fc]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTimes]
push edi
mov ebx, 0x1519a5
mov edi, 0x8e46a7b8
lea esp, [esp]
mov dword [0x829e64], edi
cmp eax, 0x3dc
jne 0x81410a
push 0
push 0
push 0
call esi
mov eax, dword [0x82a1fc]
dec ebx
jne 0x8140f0
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor esi, esi
jmp 0x814120
cmp eax, 0x933
jne 0x814167
xor eax, eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0x30]
push ecx
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
mov eax, dword [0x82a1fc]
cmp esi, 0x845fef
jne 0x81417e
mov eax, dword [0x824d60]
add eax, 0xa231
mov dword [0x82a1fc], eax
cmp eax, 0x141
jne 0x814199
mov dword [0x826508], 0xec58acac
mov dword [0x82650c], 0xffffffff
inc esi
cmp esi, 0x12d16a2
jl 0x814120
call fcn.00813c40
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040214a
add esp, 0x41c
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xa407f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3ca000]
lea eax, [edi + 0x57f1c4]
push dword [eax]
mov dword [eax], 0xe1c59093
push eax
push edi
jmp 0xa4081a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa40821
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa40810
mov eax, 1
add ebx, ebx
jne 0xa40833
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa40844
jne 0xa40863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa40863
dec eax
add ebx, ebx
jne 0xa40850
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa40828
add ebx, ebx
jne 0xa4085f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa408b5
xor ecx, ecx
sub eax, 3
jb 0xa4087b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa408ea
sar eax, 1
mov ebp, eax
jmp 0xa40886
add ebx, ebx
jne 0xa40886
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa40854
inc ecx
add ebx, ebx
jne 0xa40894
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa40854
add ebx, ebx
jne 0xa408a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa40896
jne 0xa408b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa40896
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa408d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa408c6
jmp 0xa40816
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa408d4
add edi, ecx
jmp 0xa40816
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x3f9951
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xa40913
cmp byte [edi], 0x71
jne 0xa408f8
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xa408f6
lea edi, [esi + 0x620000]
mov eax, dword [edi]
or eax, eax
je 0xa40964
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x645700]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x645890]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa40919
mov ecx, edi
jns 0xa40948
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x645898]
or eax, eax
je 0xa4095e
mov dword [ebx], eax
add ebx, 4
jmp 0xa40936
call dword [esi + 0x645894]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xa40995
cmp al, 0xef
ja 0xa40988
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xa4096a
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xa40977
mov ebp, dword [esi + 0x64589c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x287]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa409c9
sub esp, 0xffffff80
jmp 0x7aa45e
Function at 0x79d8c4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x79d8ca
pop ebp
sub ebp, 6
sub ebp, 0x39d8c4
jmp 0x79d928
jmp 0x79d931
mov eax, 0x39d8c4
add eax, ebp
add eax, 0x93
mov ecx, 0x62b
mov edx, 0x11fe0e
xor byte [eax], dl
inc eax
dec ecx
jne 0x79d948
jmp 0x79d95b
dec esi
push cs
push ds
push cs
push cs
push cs
ret 0xe22
Function at 0x10001c03
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 8
call fcn.1000c3d4
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
add ebx, 4
push ebx
push 0x107
call fcn.1000c3d4
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x100d5b59
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0xff
rep stosb byte es:[edi], al
cmp dword [0x100d6552], 0
jne 0x10001cb1
mov dword [ebp - 0xc], esp
push str.shell32.dll
xor eax, eax
call dword [0x100d6566]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10001c95
push 0x4f
push 0x4014a08
push 6
call fcn.1000c3e0
add esp, 0xc
mov dword [0x100d6552], eax
cmp dword [0x100d6552], 0
jne 0x10001cb1
mov eax, 0x100264df
jmp 0x10001e14
push 0x80000301
push 0
push 0x400
push 1
mov ebx, 0x184
call fcn.1000cea0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001ce6
push ebx
call fcn.1000c3da
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
mov eax, dword [ebp - 8]
push eax
push 0x103
call fcn.1000c3d4
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0xff
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop ebx
add ebx, 4
push dword [ebp + 8]
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10001d56
push 0x110
push 0x4014a08
push 6
call fcn.1000c3e0
add esp, 0xc
push eax
mov ebx, dword [ebp - 0x10]
push ebx
mov edi, dword [ebp - 0x14]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
push edi
push 1
mov eax, 2
call fcn.1000c720
add esp, 4
pop edi
pop ebx
push ebx
push edi
mov edi, dword [edi]
mov ecx, dword [edi]
add edi, 4
test ecx, ecx
je 0x10001d97
mov eax, dword [edi]
add edi, 4
dec ecx
je 0x10001d95
imul eax, dword [edi]
jmp 0x10001d8a
mov ecx, eax
cmp ecx, 0xff
jle 0x10001da4
mov ecx, 0xff
mov esi, ebx
rep movsb byte es:[edi], byte [esi]
pop edi
pop ebx
add edi, 4
add ebx, 0xff
call fcn.1000c3da
add esp, 4
pop eax
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
push dword [ebx]
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10001df3
push 0x13a
push 0x4014a08
push 6
call fcn.1000c3e0
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x10001e0f
push eax
mov ebx, eax
call fcn.100016e6
inc eax
push eax
call fcn.1000c3d4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10001e14
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001e25
push ebx
call fcn.1000c3da
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
push ebx
call fcn.1000c3da
add esp, 4
pop ebx
call fcn.1000c3da
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x100020d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x400
push 1
mov ebx, 0x184
call fcn.1000cea0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10002115
push ebx
call fcn.1000c3da
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xffffffff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000214a
push 0x4f
push 0x4014a0c
push 6
call fcn.1000c3e0
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x10002166
push eax
mov ebx, eax
call fcn.100016e6
inc eax
push eax
call fcn.1000c3d4
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1000216b
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000217c
push ebx
call fcn.1000c3da
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x100024d9
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.1000cea0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000251e
push ebx
call fcn.1000c3da
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10002535
mov eax, 0x100264df
push eax
push 1
mov ebx, 0x130
call fcn.1000d190
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000257b
push 0x4f
push 0x4014a0b
push 6
call fcn.1000c3e0
add esp, 0xc
push 0x100264df
push dword [ebp - 4]
call fcn.10001a97
add esp, 8
cmp eax, 0
jne 0x100025cd
push 0x80000004
push 0
push 0x100d5b8b
push 1
mov ebx, 0x10c
call fcn.1000ccf0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100025c9
push ebx
call fcn.1000c3da
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100025e0
mov eax, 0x100264df
push eax
push 1
mov ebx, 0x178
call fcn.1000d2b0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x100025fe
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000260f
push ebx
call fcn.1000c3da
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1000cc50
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x1000cce2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x1000ccd4
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x1000cccc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x1000cc95
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x1000ccf0
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.1000c5b0
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x1000cd47
push ebx
push edi
call fcn.1000c6c0
push esi
mov ebx, esi
call fcn.1000c5b0
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x1000cd1e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x408a51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x408a60
pop dword [ebp - 0x38]
mov eax, 0x7eb324af
add eax, 0x818d65b1
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x85ba4c5f
add dword [ebp - 0x48], 0xc897f8ec
mov dword [ebp - 0x44], 0x1970294d
add dword [ebp - 0x44], 0x18c322f8
mov dword [ebp - 0x40], 0x29643e46
sub dword [ebp - 0x40], 0xdd17fa18
mov dword [ebp - 0x3c], 0x30a129ae
sub dword [ebp - 0x3c], 0x30a129ae
lea eax, [ebp - 0x48]
push eax
mov eax, 0xd7ed8c1b
add eax, 0x28534439
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x52453862
add dword [ebp - 0x48], 0x222d30f4
mov dword [ebp - 0x44], 0xce9552ac
add dword [ebp - 0x44], 0x72d70ec9
mov dword [ebp - 0x40], 0xabe3c5a8
sub dword [ebp - 0x40], 0x4874593c
mov dword [ebp - 0x3c], 0x3dcce4
add dword [ebp - 0x3c], 0xffc2331c
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xba4ae10
sub eax, 0xb63ddc4
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39aff
push 0
call eax
mov ecx, 0x25cae48c
add ecx, 0xda356425
mov edi, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x38]
mov ebx, 0xbec6c44d
sub ebx, 0xa9ed5483
sub dword [ebp - 0x24], 0x32c7242f
mov edx, dword [esi]
mov dword [ebp - 0x1c], 0xfee66026
sub edx, ebx
xor dword [ebp - 0x20], 0x172e0b82
mov dword [edi], edx
add dword [ebp - 0x1c], 0x1e83cce2
add edi, 0x477443d6
add edi, 0xb88bbc2e
add esi, 0xdc27d132
add esi, 0x23d82ed2
loop 0x408b7c
add eax, 0x47c8be6f
sub eax, 0x47c7a8d8
mov ebx, eax
add eax, 5
mov ecx, 0xe741a98d
sub ecx, 0xe701a98d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x707813a5
Capabilities:
Contain obfuscated stackstrings
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x444
lea eax, [ebp - 0x418]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], str.BuildingBlock.exe
mov dword [ebp - 0x14], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x18], str.BuildingBlock
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x418]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
jmp 0x707813f4
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x707813f0
jmp 0x70781404
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x70781400
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x418]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x418]
add eax, edx
mov word [eax], 0x5c
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcat
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyA_12
sub esp, 0xc
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x41c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x418]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 7
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret