joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e62f9
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebp, 4
bswap ebx
setae bh
sub esp, 0xe
jae 0x4e61ed
lea esp, [esp + 2]
jmp 0x4e6216
call 0x4e61b5
jmp 0x4e6212
jmp 0x4e6254
dec ebx
lea ebx, [eax + ecx]
mov ebx, edx
call fcn.004e62f9
cwde
sti
ror byte [ebp + 0x42], cl
and byte [edx - 0x5a], ah
ror byte [0x66d3d7ee], cl
mov edx, ebx
lea esp, [esp + 1]
jmp 0x4e61d1
lea esp, [esp + 2]
mov bx, word [esp]
xor edx, edx
jb 0x4e61ef
stc
mov ebx, esp
mov bx, bp
dec ebx
lea ebx, [eax + ecx]
call 0x4e623e
rcr byte [esi - 0x34], 1
stosd dword es:[edi], eax
shr word [edi], 1
and dword ss:[eax - 0x5d], esp
shr eax, cl
jl 0x4e61e8
jge 0x4e61e8
sub esp, 0x16
jmp 0x4e625c
stc
mov ebx, esp
mov bx, bp
jmp 0x4e61f1
mov byte [esp + 1], ch
push dword [esp + 1]
lea esp, [esp + 0x18]
lea esp, [esp + 2]
xchg dword [esp], ecx
pushal
jmp 0x4e62dd
sub esp, 5
lea esp, [esp + 1]
xchg dword [esp + 0x20], ecx
sub esp, 0x18
stc
pop dword [esp + 4]
jmp 0x4e630f
mov dword [esp + 8], ecx
pop dword [esp + 0xf]
lea esp, [esp + 2]
push dword [esp + 0xb]
lea esp, [esp + 2]
lea ecx, [ecx - 0x38]
jmp 0x4e62be
mov word [esp + 1], bx
jmp 0x4e631c
clc
mov word [esp + 0xd], dx
push dword [esp + 0x34]
ret 0x38
shl edx, 7
sub esp, 0x10
jp 0x4e6355
pop word [esp + 2]
lea esp, [esp + 2]
jmp 0x4e63b8
lea esp, [esp + 2]
jmp 0x4e63b8
pop word [esp + 2]
jmp 0x4e633f
sub esp, 0xa
jmp 0x4e63f5
sub esp, 0xa
lea esp, [esp]
lea esp, [esp + 2]
lea esp, [esp + 8]
sub esp, 2
jmp 0x4e63da
shr ebx, 0x19
or edx, ebx
jge 0x4e6396
jl 0x4e639f
stc
stc
xchg dword [esp], ecx
call 0x4e6406
or eax, 0x80711680
xor byte [ebp - 0x6e99e074], bh
adc byte [ebx + 0x648d02ec], al
and al, 2
lea esp, [esp + 2]
jmp 0x4e648b
lea esp, [esp]
lea esp, [esp + 2]
lea esp, [esp + 8]
call 0x4e63c1
adc ah, byte [esi - 1]
je 0x4e642e
add ebp, esi
jmp 0x4e6412
mov dword [esp], edi
pushfd
lea esp, [esp + 2]
lea ecx, [ecx - 0x2e]
sub esp, 4
mov dword [esp], eax
add al, 0x24
call fcn.004e658e
popal
mov al, byte [0x5bb6dfe0]
cwde
dec edx
hlt
fbstp tbyte [esi - 0xbb567a5]
dec ebp
push edx
jbe 0x4e6424
xor bl, ah
sbb dh, byte [ebp + 0x64]
into
hlt
adc al, 0x2d
adc dword [edi + reloc.KERNEL32.dll_GetProcAddress], eax
invalid
inc eax
call 0x4e6438
jne 0x4e61f5
mov bx, word [esp]
mov bh, byte [esp]
not eax
jmp 0x4e64cf
and al, 0x14
jmp 0x4e6454
xor dl, byte [eax]
clc
jnp 0x4e644e
jp 0x4e644e
loop 0x4e64e2
sub ah, al
jp 0x4e6444
sbb bh, dl
sti
adc al, 0x15
mov dl, 0xee
xor byte [ebx], dh
sub al, byte [ebp - 0x32]
add ebx, edx
aaa
invalid
ja 0x4e651c
jmp 0x4e6476
mov dword [ebp], edx
mov dx, cx
bswap edx
lea eax, [esi + 0x8a]
mov dx, 0x252f
jmp 0x44ac76
nop
inc edi
idiv bh
jmp 0x4e651a
push 0xdcf82b96
call fcn.0044e74a
sub edi, eax
fsub st(0), st(0)
xor dh, 0xff
in eax, 0x7d
in eax, dx
je 0x4e64b0
cmp edx, ebp
dec esi
fdivr qword [ebx - 0x59a06faa]
rcl dword [eax - 0x7d]
in al, dx
add eax, 0x124648d
xchg dword [esp + 0x14], ecx
push dword [esp + 0x14]
ret 0x18
Function at 0x4e6438
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebp, 4
bswap ebx
setae bh
sub esp, 0xe
jae 0x4e61ed
lea esp, [esp + 2]
jmp 0x4e6216
call 0x4e61b5
jmp 0x4e6212
jmp 0x4e6254
dec ebx
lea ebx, [eax + ecx]
mov ebx, edx
call fcn.004e62f9
cwde
sti
ror byte [ebp + 0x42], cl
and byte [edx - 0x5a], ah
ror byte [0x66d3d7ee], cl
mov edx, ebx
lea esp, [esp + 1]
jmp 0x4e61d1
lea esp, [esp + 2]
mov bx, word [esp]
xor edx, edx
jb 0x4e61ef
stc
mov ebx, esp
mov bx, bp
dec ebx
lea ebx, [eax + ecx]
call 0x4e623e
rcr byte [esi - 0x34], 1
stosd dword es:[edi], eax
shr word [edi], 1
and dword ss:[eax - 0x5d], esp
shr eax, cl
jl 0x4e61e8
jge 0x4e61e8
sub esp, 0x16
jmp 0x4e625c
stc
mov ebx, esp
mov bx, bp
jmp 0x4e61f1
mov byte [esp + 1], ch
push dword [esp + 1]
lea esp, [esp + 0x18]
lea esp, [esp + 2]
xchg dword [esp], ecx
pushal
jmp 0x4e62dd
sub esp, 5
lea esp, [esp + 1]
xchg dword [esp + 0x20], ecx
sub esp, 0x18
stc
pop dword [esp + 4]
jmp 0x4e630f
mov dword [esp + 8], ecx
pop dword [esp + 0xf]
lea esp, [esp + 2]
push dword [esp + 0xb]
lea esp, [esp + 2]
lea ecx, [ecx - 0x38]
jmp 0x4e62be
mov word [esp + 1], bx
jmp 0x4e631c
clc
mov word [esp + 0xd], dx
push dword [esp + 0x34]
ret 0x38
shl edx, 7
sub esp, 0x10
jp 0x4e6355
pop word [esp + 2]
lea esp, [esp + 2]
jmp 0x4e63b8
lea esp, [esp + 2]
jmp 0x4e63b8
pop word [esp + 2]
jmp 0x4e633f
sub esp, 0xa
jmp 0x4e63f5
sub esp, 0xa
lea esp, [esp]
lea esp, [esp + 2]
lea esp, [esp + 8]
sub esp, 2
jmp 0x4e63da
shr ebx, 0x19
or edx, ebx
jge 0x4e6396
jl 0x4e639f
stc
stc
xchg dword [esp], ecx
call 0x4e6406
or eax, 0x80711680
xor byte [ebp - 0x6e99e074], bh
adc byte [ebx + 0x648d02ec], al
and al, 2
lea esp, [esp + 2]
jmp 0x4e648b
lea esp, [esp]
lea esp, [esp + 2]
lea esp, [esp + 8]
call 0x4e63c1
adc ah, byte [esi - 1]
je 0x4e642e
add ebp, esi
jmp 0x4e6412
mov dword [esp], edi
pushfd
lea esp, [esp + 2]
lea ecx, [ecx - 0x2e]
sub esp, 4
mov dword [esp], eax
add al, 0x24
call fcn.004e658e
popal
mov al, byte [0x5bb6dfe0]
cwde
dec edx
hlt
fbstp tbyte [esi - 0xbb567a5]
dec ebp
push edx
jbe 0x4e6424
xor bl, ah
sbb dh, byte [ebp + 0x64]
into
hlt
adc al, 0x2d
adc dword [edi + reloc.KERNEL32.dll_GetProcAddress], eax
invalid
inc eax
call 0x4e6438
jne 0x4e61f5
mov bx, word [esp]
mov bh, byte [esp]
not eax
jmp 0x4e64cf
and al, 0x14
jmp 0x4e6454
xor dl, byte [eax]
clc
jnp 0x4e644e
jp 0x4e644e
loop 0x4e64e2
sub ah, al
jp 0x4e6444
sbb bh, dl
sti
adc al, 0x15
mov dl, 0xee
xor byte [ebx], dh
sub al, byte [ebp - 0x32]
add ebx, edx
aaa
invalid
ja 0x4e651c
jmp 0x4e6476
mov dword [ebp], edx
mov dx, cx
bswap edx
lea eax, [esi + 0x8a]
mov dx, 0x252f
jmp 0x44ac76
nop
inc edi
idiv bh
jmp 0x4e651a
push 0xdcf82b96
call fcn.0044e74a
sub edi, eax
fsub st(0), st(0)
xor dh, 0xff
in eax, 0x7d
in eax, dx
je 0x4e64b0
cmp edx, ebp
dec esi
fdivr qword [ebx - 0x59a06faa]
rcl dword [eax - 0x7d]
in al, dx
add eax, 0x124648d
xchg dword [esp + 0x14], ecx
push dword [esp + 0x14]
ret 0x18
Function at 0x4ed705
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4ed80c
cmc
mov eax, ebp
lea esp, [esp + 2]
neg esi
lea esp, [esp]
jmp 0x4ed7db
bsf ebp, esp
add esp, 0
shl eax, 3
xchg byte [esp + 2], cl
xchg word [esp], bx
xchg byte [esp + 1], ah
jmp 0x4ed74e
rdtsc
rdtsc
btr edx, edx
pop ebp
pop edx
push dword [esp]
jmp 0x4ed78d
std
bts esi, ebx
pop bx
setne ch
mov dword [esp + 4], ebx
cpuid
jmp 0x4ed7b7
mov edx, ecx
sub esp, 9
sbb edx, edi
bts ax, si
add esp, 0xf
stc
jmp 0x4ed77b
mov dword [esp + 3], ebx
lea esi, [edx + ebp]
add al, ch
lea esp, [esp + 1]
call fcn.004ed823
mov bl, 0x20
mov dh, 0xd1
and cl, cl
iretd
mov bx, word [esp + 1]
xchg edi, esi
lea ebp, [ebx*4]
xor si, 0xa253
sub esp, 0x13
mov ebp, dword [esp + 0x15]
jmp 0x4ed7a6
setg dh
xchg dword [esp], esi
not ebp
neg di
mov ebx, 0xd5262f02
not cl
jmp 0x4ed764

Function at 0x4edfab
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, cx
std
xchg bp, bx
bswap edi
not ah
mov cl, 0x35
jmp 0x4edf95
xchg dword [esp + 0xc], edi
push bp
bsf di, bp
lea edi, reloc.KERNEL32.dll_GetProcAddress
add esp, 0x16
jmp 0x4edf76

Function at 0x4ee98a
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.004ee027
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x4ee022
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x4ee8f4
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x40], edi
lea esp, [esp + 0x40]
jmp 0x4ee95e

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100014e0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push esi
push 0
push 2
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [esp + 8]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10001535
lea ecx, [esp + 8]
push ecx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10001535
mov esi, dword [esp + 0x134]
cmp dword [esp + 0x10], esi
je 0x10001547
lea edx, [esp + 8]
push edx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10001520
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
add esp, 0x128
ret
mov edx, dword [esp + 0x138]
test edx, edx
je 0x10001575
push edi
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop ebx
add esp, 0x128
ret

Function at 0x10001620
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x104
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov dword [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, eax
lea eax, [esp + 0x10]
push 0xff
push eax
push esi
call ebp
test eax, eax
jle 0x10001682
mov ecx, dword [esp + 0x114]
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.10005560
lea ecx, [esp + 0x18]
add esp, 8
cmp eax, ecx
je 0x100016ea
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x100016fa
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x100016d1
lea edx, [esp + 0x10]
push 0xff
push edx
push esi
call ebp
test eax, eax
jle 0x100016d1
mov eax, dword [esp + 0x114]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.10005560
lea edx, [esp + 0x18]
add esp, 8
cmp eax, edx
je 0x100016ea
push 2
push esi
call edi
mov esi, eax
test esi, esi
jne 0x10001698
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x104
ret
test esi, esi
je 0x100016fa
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x104
ret
Function at 0x10001710
Capabilities:
Shutdown system

Disassembly:
push esi
push edi
push str.user32.dll
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x100014d3
push str.LockWorkStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100014cc
call eax
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
ret
push str.SeShutdownPrivilege
call fcn.10001440
mov eax, dword [esp + 8]
add esp, 4
cmp eax, 3
ja case.default.0x10001726
jmp dword [eax*4 + 0x10001758]
jmp 0x100014a0
push 0
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
ret
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
ret
push 0
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
ret
xor eax, eax
ret

Function at 0x100019f0
Capabilities:
Check for foreground window switch

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [sym.imp.USER32.dll_GetForegroundWindow]
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, edi
je 0x10001a43
push str.user32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
push str.SwitchToThisWindow
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1f4
call ebp
push 0
push 0
push 0x2a
push 0x11
call dword [sym.imp.USER32.dll_keybd_event]
push 0x64
call ebp
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x10]
push 0
push ecx
call fcn.100014e0
add esp, 8
test eax, eax
je 0x10001acc
push 1
push 0x57
push 0x100
push edi
call esi
push 0x32
call ebp
push 1
push 0x57
push 0x101
push edi
call esi
push 0x64
call ebp
call ebx
cmp eax, edi
je 0x10001abe
call ebx
push 1
mov ebx, eax
push 0xd
push 0x100
push ebx
call esi
push 1
push 0xd
push 0x101
push ebx
call esi
mov ebx, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 0x14
mov dword [esp + 0x18], eax
jl 0x10001a63
push 0
push 2
push 0x2a
push 0x11
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0xf060
push 0x112
push edi
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x10001b00
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
sub esp, 0x100
push ebp
xor ebp, ebp
push esi
push ebp
push ebp
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x10001c00
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x10001be0
lea eax, [esp + 0x10]
push 0xff
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x10001be0
lea ecx, [esp + 0x10]
push ecx
push esi
push str._d__s
call fcn.10007640
mov edx, dword [esp + 0x124]
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.10005560
lea ecx, [esp + 0x24]
add esp, 0x14
cmp eax, ecx
jne 0x10001be0
mov eax, dword [esp + 0x114]
cmp eax, 5
ja case.default.0x10001b99
jmp dword [eax*4 + 0x10001c0c]
push 0
push esi
call ebx
mov ebp, eax
jmp 0x10001be0
push 5
push esi
call ebx
mov ebp, eax
jmp 0x10001be0
push 6
push esi
call ebx
mov ebp, eax
jmp 0x10001be0
push 3
push esi
call ebx
mov ebp, eax
jmp 0x10001be0
push esi
call fcn.10001930
add esp, 4
mov ebp, eax
jmp 0x10001be0
push esi
call fcn.100019f0
add esp, 4
mov ebp, eax
jmp 0x10001be0
xor ebp, ebp
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x10001b24
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
add esp, 0x100
ret
mov eax, ebp
pop esi
pop ebp
add esp, 0x100
ret
Function at 0x10002300
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x277]
mov byte [ebp - 0x278], bl
rep stosd dword es:[edi], eax
xor ecx, ecx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0xf], ecx
mov byte [ebp - 0x34], bl
stosw word es:[edi], ax
mov dword [ebp - 0xb], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 7], ecx
lea edx, [ebp - 0x78]
stosb byte es:[edi], al
mov al, byte [0x1002f83c]
mov word [ebp - 3], cx
mov byte [ebp - 0x10], al
mov byte [ebp - 1], cl
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x53]
push edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x33]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.100242e2
add esp, 8
test eax, eax
je 0x10002381
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x58]
push eax
call fcn.10012ad6
push eax
push str._Y__m__d__H:_M:_S
lea ecx, [ebp - 0x54]
push 0x18
push ecx
call fcn.100121e5
lea edx, [ebp - 0x5c]
push edx
call fcn.10012ad6
push eax
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x34]
push 0x18
push eax
call fcn.100121e5
add esp, 0x28
lea ecx, [ebp - 0x278]
push ecx
push 0x1ff
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x10002425
lea edx, [ebp - 0x14]
lea eax, [ebp + 8]
push edx
push eax
lea ecx, [ebp - 0x278]
push 0x1002a380
push ecx
mov dword [ebp + 8], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10002425
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
and edx, 0xffff
shr ecx, 0x10
push edx
push ecx
mov ecx, eax
lea edx, [ebp - 0x10]
and ecx, 0xffff
shr eax, 0x10
push ecx
push eax
push str._d._d._d._d
push 0xf
push edx
call fcn.10011e3e
add esp, 0x1c
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x54]
push ecx
push edx
push eax
push esi
call fcn.10006620
mov ecx, dword [ebp + 0xc]
add esp, 4
push eax
push str._r_n__20s__10d__20s__20s__10s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002570
Capabilities:
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
push ebx
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x283]
mov byte [ebp - 0x284], 0
mov byte [ebp - 0x84], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0x83]
mov ebx, dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1002a4bc
push ebx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, eax
lea eax, [ebp - 0x84]
push eax
push 0x7f
call fcn.100061f0
push str._tmp.reg
lea ecx, [ebp - 0x84]
push 0x7f
push ecx
call fcn.10005a30
add esp, 0x1c
lea edx, [ebp - 0x84]
lea eax, [ebp - 0x284]
push edx
push str.regedit__e___s___HKEY_LOCAL_MACHINESOFTWAREGZSAClient_Security_
push 0x1ff
push eax
call fcn.10011e3e
add esp, 0x10
lea ecx, [ebp - 0x284]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0x80
push 3
push 0
push 0
lea edx, [ebp - 0x84]
push closesocket
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [ebp - 4], eax
je 0x10002696
lea ecx, [ebp + 8]
push 0
lea edi, [esi + ebx]
push ecx
push 0x100000
push edi
push eax
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 8]
cmp eax, 2
jbe 0x1000267d
add esi, 2
mov byte [edi], 0xd
mov byte [edi + 1], 0xa
push eax
lea edi, [esi + ebx]
push edi
push edi
call fcn.10007c40
push edi
call fcn.100056c0
add esp, 0x10
add esi, eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x84]
push eax
call fcn.10012c36
add esp, 4
lea ecx, [esi + ebx]
push 0x1002a454
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
add eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x107]
mov byte [ebp - 0x108], 0
rep stosd dword es:[edi], eax
push 0
stosw word es:[edi], ax
call fcn.10011d10
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.10012ad6
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 8
push ecx
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x10]
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [ebp + 8]
add edx, 0x76c
push ecx
push edx
push eax
push str._s_04d_02d_02d_02d_02d_02d.txt
lea ecx, [ebp - 0x108]
push 0xfe
push ecx
call fcn.10011e3e
add esp, 0x28
lea edx, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
test ebx, ebx
je 0x10002b19
push esi
push 0x100000
mov dword [ebp - 4], 0
call fcn.10012d54
mov esi, eax
mov ecx, 0x40000
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push esi
push eax
call fcn.10001ff0
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jbe 0x10002a2e
lea ecx, [ebp - 4]
push 0
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 0xc]
mov ecx, 0x40000
xor eax, eax
mov edi, esi
push esi
push edx
rep stosd dword es:[edi], eax
call fcn.10001e70
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jbe 0x10002a5c
lea ecx, [ebp - 4]
push 0
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0x40000
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
call fcn.100026c0
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jbe 0x10002a86
lea edx, [ebp - 4]
push 0
push edx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0x40000
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
call fcn.10002570
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jbe 0x10002ab0
lea ecx, [ebp - 4]
push 0
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp + 8]
mov ecx, 0x40000
xor eax, eax
mov edi, esi
push esi
push edx
rep stosd dword es:[edi], eax
call fcn.10002720
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jbe 0x10002ade
lea ecx, [ebp - 4]
push 0
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0x40000
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
call fcn.100028f0
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jbe 0x10002b08
lea edx, [ebp - 4]
push 0
push edx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.10012c6b
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002ce0
Capabilities:
Get disk information via ioctl
Print debug messages

Disassembly:
sub esp, 0x130
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
mov ecx, 7
lea edi, [esp + 0x19]
mov dword [esp + 0x10], eax
mov byte [esp + 0x18], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x39]
mov byte [esp + 0x38], 0
rep stosd dword es:[edi], eax
movsx ecx, byte [esp + 0x13c]
push ecx
lea edx, [esp + 0x1c]
push str.._c:
push edx
mov dword [esp + 0x14], 0
stosw word es:[edi], ax
call fcn.10011dec
add esp, 0xc
lea eax, [esp + 0x18]
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10002d8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x3c]
push str.CreateFile___Error:__ld_n
push ecx
call fcn.10011dec
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, esi
pop edi
pop esi
add esp, 0x130
ret
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x10]
push 0xc
push ecx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10002de4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x3c]
push str.IOCTL_DISK_GET_DRIVE_LAYOUT_EX_Error:__ld_n
push edx
call fcn.10011dec
add esp, 0xc
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x130
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x130
ret