joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001470
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.10001260
cmp dword [0x10025438], 1
jne 0x1000152a
push str.interface.u
call fcn.100013a0
cmp eax, dword [0x1002546c]
je 0x1000152a
push 0x10020b00
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000a634
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push str.Interface_files_are_changed______Interface.u
push 0x10020b14
push eax
call fcn.10001200
push dword [ebp - 4]
call fcn.10007651
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x10
push 0
push str._L2J_Guard_Protection____http:__www.l2jguard.org___n_n___We_find_programs_using_the_same_function_Hackers_Bots._n___Believed_to_be_an_error_._We_inform_or_will_fix._n___Send_folder_L2JGuard__your_system_to_the_Administrator___n_n___Sorry_for_the_inconvenience__we_need_maximum_security_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x1002543c], 1
jne 0x10001570
push str.interface.xdat
call fcn.100013a0
cmp eax, dword [0x10025470]
je 0x10001570
push 0x10020b00
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000a634
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push str.Interface_files_are_changed______Interface.xdat
jmp 0x100014bf
cmp dword [0x10025440], 1
jne 0x100015b6
push str.WarGuard_Protect.bmp
call fcn.100013a0
cmp eax, dword [0x10025474]
je 0x100015b6
push 0x10020b00
lea eax, [ebp - 4]
push str.Protection.log
push eax
call fcn.1000a634
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100014d5
push str.Interface_files_are_changed______Image_Protect_BMP
jmp 0x100014bf
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100015c0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push esi
mov esi, dword [0x10029894]
push edi
mov edi, dword [0x10029898]
cmp esi, edi
je 0x100015f0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop dword [eax]
push dword [esi]
call ebx
test eax, eax
jne 0x100015f3
add esi, 4
cmp esi, edi
jne 0x100015e0
pop ebx
pop edi
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001740
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x1002400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0xf
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x100017f6
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100017ef
push esi
nop dword [eax + eax]
mov eax, ebx
lea ecx, [ebp - 0x20c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x100017be
test dx, dx
je 0x100017ba
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x100017be
add ecx, 4
add eax, 4
test dx, dx
jne 0x10001798
xor eax, eax
jmp 0x100017c3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100017dc
push dword [ebp - 0x228]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x10001806
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10001790
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100035c0
mov esp, ebp
pop ebp
ret
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10020b00
lea eax, [ebp - 0x234]
push str.WarGuard_Log.txt
push eax
call fcn.1000a634
push ebx
push str._ls___WP__n
push dword [ebp - 0x234]
call fcn.10001200
push dword [ebp - 0x234]
call fcn.10007651
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100018a0
Capabilities:
Create process on windows
Enumerate processes
Terminate process

Disassembly:
mov ecx, str.L2Tower.exe
call fcn.10001740
mov ecx, str.L2NET.exe
call fcn.10001740
mov ecx, str.HxD.exe
call fcn.10001740
mov ecx, str.boot.exe
call fcn.10001740
mov ecx, str.alquimista.exe
call fcn.10001740
mov ecx, str.L2Divine.exe
call fcn.10001740
mov ecx, str.SandMan.exe
call fcn.10001740
mov ecx, str.SbieSvc.exe
call fcn.10001740
mov ecx, str.SbieSvc32.exe
call fcn.10001740
mov ecx, str.SbieSvc32.exe
call fcn.10001740
mov ecx, str.SbieCtrl.exe
call fcn.10001740
mov ecx, str.Start.exe
jmp fcn.10001740
Function at 0x100019c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10001a5f
push 0x10020b00
lea eax, [ebp - 4]
push str.WarGuard_Log.txt
push eax
call fcn.1000a634
push esi
push str._s___TW__n
push dword [ebp - 4]
call fcn.10001200
push dword [ebp - 4]
call fcn.10007651
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001a70
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov ecx, str.Process_Explorer_11.33
call fcn.100019c0
mov ecx, str.Process_Explorer
call fcn.100019c0
mov ecx, str.ArtMoney_PRO_v7.27
call fcn.100019c0
mov ecx, str.ArtMoney_SE_v7.31
call fcn.100019c0
mov ecx, str.ArtMoney_SE_v7.32
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.0
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.1
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.1.1
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.2
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.3
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.4
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.5
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.6
call fcn.100019c0
mov ecx, str.Cheat_Engine_5.6.1
call fcn.100019c0
mov ecx, str.Cheat_Engine_6.0
call fcn.100019c0
mov ecx, str.Cheat_Engine_6.1
call fcn.100019c0
mov ecx, str.Cheat_Engine_6.4
call fcn.100019c0
mov ecx, str.Cheat_Engine
call fcn.100019c0
mov ecx, str.Created_processes
call fcn.100019c0
mov ecx, str.SandBoxie_Plus_v0.9.3
call fcn.100019c0
mov ecx, str.Sandboxie_Control___sandboxie_plus.com
call fcn.100019c0
mov ecx, str.Created_processes
call fcn.100019c0
mov ecx, str.Lineage2_v1.71
call fcn.100019c0
mov ecx, str.XAAAA
jmp fcn.100019c0
Function at 0x10001b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
push esi
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
test eax, eax
je 0x10001c23
push 0x10020b00
lea eax, [ebp - 4]
push str.WarGuard_Log.txt
push eax
call fcn.1000a634
push esi
push str._s___CW__n
push dword [ebp - 4]
call fcn.10001200
push dword [ebp - 4]
call fcn.10007651
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x1c
push 0
push str.taskkill__IM_L2Tower.exe__F
call esi
push 0
push str.taskkill__IM_l2.exe__F
call esi
push 0
push str.taskkill__IM_l2.bin__F
call esi
push 0
push str.taskkill__IM_L2.exe__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0
push str.taskkill__IM_L2.bin__F
call esi
push 0x200010
push str.WarGuard_Protection
push str._Illegal_program_detected__Programa_ilegal_detectado_._n_n_Contact_the_server_adm__Contate_o_adm_do_server__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001c30
Capabilities:
Create process on windows
Set registry value
Terminate process

Disassembly:
mov ecx, str.PROCEXPL
call fcn.10001b80
mov ecx, str.TreeListWindowClass
call fcn.10001b80
mov ecx, str.ProcessHacker
call fcn.10001b80
mov ecx, str.RegEdit_RegEdit
call fcn.10001b80
mov ecx, str.ProcessThreadsView
call fcn.10001b80
mov ecx, str.TreeListWindowClass
call fcn.10001b80
mov ecx, str.PhTreeNew
call fcn.10001b80
mov ecx, 0x100211a0
call fcn.10001b80
mov ecx, str.TformSettings
call fcn.10001b80
mov ecx, str.TWildProxyMain
call fcn.10001b80
mov ecx, str.TUserdefinedform
call fcn.10001b80
mov ecx, str.TformAddressChange
call fcn.10001b80
mov ecx, str.TMemoryBrowser
call fcn.10001b80
mov ecx, str.TFoundCodeDialog
call fcn.10001b80
mov ecx, str.TL2PacketHackMain
call fcn.10001b80
mov ecx, str.vxwindowclassnr
call fcn.10001b80
mov ecx, str.l2packet
call fcn.10001b80
mov ecx, str.hlapex
call fcn.10001b80
mov ecx, str.wp_v5
call fcn.10001b80
mov ecx, 0x10021250
call fcn.10001b80
mov ecx, str.TfProcessRawLog
call fcn.10001b80
mov ecx, str.TfScriptEditor
call fcn.10001b80
mov ecx, str.TfScript
call fcn.10001b80
mov ecx, str.TTabSheet
call fcn.10001b80
mov ecx, str.TJvSpinEdit
call fcn.10001b80
mov ecx, str.PhTreeNew
call fcn.10001b80
mov ecx, str.TPaintPanel
call fcn.10001b80
mov ecx, str.ThtmlLiteEx
call fcn.10001b80
mov ecx, str.TfmMain
call fcn.10001b80
mov ecx, str.TvkProgressBar
call fcn.10001b80
mov ecx, str.TTabSheet
call fcn.10001b80
mov ecx, str.SandboxieControlWnsClass
call fcn.10001b80
mov ecx, str.0x150114__1376532_
call fcn.10001b80
mov ecx, str.0x507B6__329654_
jmp fcn.10001b80
Function at 0x10002000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ebx
cmp byte [ebx], 0xe9
jne 0x10002024
lea ecx, [ebx + 5]
add ecx, dword [ebx + 1]
call fcn.10002000
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10024d1c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100298a8]
cmp eax, dword [ecx + 4]
jle 0x1000207c
push 0x100298a8
call fcn.10003aee
add esp, 4
cmp dword [0x100298a8], 0xffffffff
jne 0x1000207c
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x100298a8
mov dword [0x100298a4], eax
call fcn.10003aa4
add esp, 4
push esi
mov esi, dword [0x100298a4]
push edi
lea edx, [esi + 0x1000]
cmp esi, edx
je 0x100020a3
nop
lea ecx, [esi + 0x1c]
call fcn.10001ff0
test eax, eax
je 0x100020a5
add esi, 0x20
cmp esi, edx
jne 0x10002090
xor esi, esi
xor edi, edi
lea ecx, [edi + ebx]
call fcn.10001db0
add edi, eax
cmp edi, 5
jl 0x100020a7
test edi, edi
jle 0x100020d1
mov ecx, esi
sub ebx, esi
mov edx, edi
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x100020c0
mov ebx, dword [ebp - 0xc]
lea ecx, [edi + esi]
sub edi, ecx
mov byte [ecx], 0xe9
lea eax, [edi - 5]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add eax, ebx
mov dword [ecx + 1], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call edi
mov eax, dword [ebp - 0x10]
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x10020b00
lea eax, [ebp - 4]
mov esi, ecx
push str.Protection.log
push eax
call fcn.1000a634
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x100021bb
push esi
push 0x10020b14
push eax
call fcn.10001200
push dword [ebp - 4]
call fcn.10007651
add esp, 0x10
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x100021e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x108c
call fcn.10019500
mov eax, dword [0x1002400c]
xor eax, esp
mov dword [esp + 0x1088], eax
mov eax, ecx
mov dword [esp + 0x1060], 0xf2c3870
push ebx
push esi
push edi
movups xmm0, xmmword [eax]
push ecx
lea edx, [esp + 0x1070]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1074], 0x171811fb
mov dword [esp + 0x1078], 0x15012d12
mov dword [esp + 0x107c], 0xef8107a
movups xmmword [esp + 0x1080], xmm0
call fcn.100010d0
lea esi, [esp + 0x1080]
mov dword [esp + 0x18], 3
add esp, 4
mov dword [esp + 0x10], esi
mov ecx, dword [esi + 4]
lea edi, [esp + 0x64]
mov eax, dword [esi]
mov esi, 0x10
mov dword [esp + 0xc], ecx
xor eax, dword [edi]
lea edi, [edi - 4]
mov edx, eax
mov dword [esp + 0x18], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [esp + eax*4 + 0x68]
add eax, dword [esp + ecx*4 + 0x468]
movzx ecx, dl
mov edx, ebx
xor eax, dword [esp + ecx*4 + 0x868]
movzx ecx, bl
add eax, dword [esp + ecx*4 + 0xc68]
xor eax, dword [esp + 0xc]
mov dword [esp + 0xc], edx
sub esi, 1
jne 0x10002277
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
xor ecx, edx
mov dword [esi], ecx
mov ecx, dword [esp + 0x24]
xor ecx, eax
mov dword [esi + 4], ecx
add esi, 8
sub dword [esp + 0x14], 1
mov dword [esp + 0x10], esi
jne 0x10002265
mov eax, dword [esp + 0x1c]
movups xmm0, xmmword [esp + 0x107c]
mov ecx, dword [esp + 0x1094]
pop edi
pop esi
pop ebx
xor ecx, esp
movups xmmword [eax], xmm0
call fcn.100035c0
mov esp, ebp
pop ebp
ret

Function at 0x100023b0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c88
call fcn.10019500
mov eax, dword [0x1002400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x2c88]
mov dword [ebp - 0x2c88], 0x2880
push eax
lea eax, [ebp - 0x2c84]
mov esi, ecx
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x100023fd
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100035c0
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x2af0], 0
lea eax, [ebp - 0x2c84]
jne 0x10002448
nop dword [eax]
cmp byte [eax + 0x195], 0
jne 0x10002448
cmp byte [eax + 0x196], 0
jne 0x10002448
cmp byte [eax + 0x197], 0
jne 0x10002448
cmp byte [eax + 0x198], 0
jne 0x10002448
cmp byte [eax + 0x199], 0
jne 0x10002448
mov eax, dword [eax]
cmp byte [eax + 0x194], 0
je 0x10002410
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x404]
push 0x3e8
push eax
call fcn.10002150
push 0x3e8
lea eax, [ebp - 0x404]
push eax
push 0x3e8
push esi
push 0
call fcn.1000b3e3
mov ecx, dword [ebp - 4]
add esp, 0x38
xor ecx, ebp
mov al, 1
pop esi
call fcn.100035c0
mov esp, ebp
pop ebp
ret
Function at 0x10002640
Capabilities:
Get common file path
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d24
call fcn.10019500
mov eax, dword [0x1002400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100
lea eax, [ebp - 0x204]
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10002753
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.100050e0
push str.._
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1000b102
lea eax, [ebp - 0x204]
mov byte [ebp - 0x202], 0
push eax
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.1000b403
add esp, 0x24
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002753
push 0x2710
lea eax, [ebp - 0x2d14]
mov dword [ebp - 0x2d24], 0
push 0
push eax
mov dword [ebp - 0x2d18], 0
mov dword [ebp - 0x2d20], 0
mov dword [ebp - 0x2d1c], 0
call fcn.100050e0
add esp, 0xc
lea eax, [ebp - 0x2d24]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2d14]
push eax
push 0xc
lea eax, [ebp - 0x2d20]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10002765
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100035c0
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x2cfc]
lea eax, [ebp - 0x604]
push eax
push ecx
lea ecx, [ebp - 0x2d14]
call fcn.100024c0
push eax
push 0x10021358
lea eax, [ebp - 0x604]
push 0x3e8
push eax
call fcn.10002150
push 0x3e8
lea eax, [ebp - 0x604]
push eax
push 0x3e8
push edi
push 0
call fcn.1000b3e3
mov ecx, dword [ebp - 4]
add esp, 0x2c
xor ecx, ebp
mov al, 1
pop edi
pop esi
call fcn.100035c0
mov esp, ebp
pop ebp
ret
Function at 0x10010483
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100102f9
Function at 0x401590
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
shr edi, 2
xor ebx, ebx
mov eax, edi
mov dword [ebp - 4], 1
shr eax, 1
mov ecx, ebx
add eax, 3
mov dword [esi], eax
add esi, 0x10
test edi, edi
je 0x4015c7
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, edi
jb 0x4015ba
mov edx, dword [esi + edi*4 - 4]
imul eax, edi, 0xc
add eax, 0x70
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jne 0x401635
movzx eax, dl
mov ebx, dword [ebp - 4]
push 0x1b
movzx ecx, byte [eax + 0xac50c0]
mov eax, edx
shr eax, 0x18
shl ecx, 8
movzx eax, byte [eax + 0xac50c0]
or ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
shr edx, 8
shl ecx, 8
movzx eax, byte [eax + 0xac50c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0xac50c0]
xor edx, ebx
add ebx, ebx
or edx, ecx
test ebx, 0x100
pop eax
cmovne ebx, eax
mov dword [ebp - 4], ebx
mov ebx, edi
jmp 0x401682
cmp ebx, 4
jne 0x401685
cmp edi, 6
jbe 0x401685
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + 0xac50c0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + 0xac50c0]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0xac50c0]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx edx, byte [eax + 0xac50c0]
or edx, ecx
mov eax, dword [ebp + 8]
xor edx, dword [esi]
dec ebx
mov dword [esi + edi*4], edx
add esi, 4
cmp esi, eax
jne 0x4015d6
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402765
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x402786
lea ecx, [ebp - 0x10]
call fcn.00402748
test eax, eax
je 0x402786
mov eax, dword [ebp - 8]
leave
ret
xor eax, eax
leave
ret
Function at 0x4027b9
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0xaf8008]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x402802
push str.SetDefaultDllDirectories
push 0xac7368
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402802
push 0xc00
call eax
test eax, eax
jne 0x40289e
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x40289e
cmp eax, 0x104
ja 0x40289e
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x2d6], cx
je 0x402839
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
mov cl, byte [0xac72f8]
push esi
mov esi, 0xac72f8
test cl, cl
je 0x40289d
push ebx
push edi
lea edi, [ebp - 0x2d4]
push 0x6c
lea edi, [edi + eax*2]
pop ebx
mov edx, edi
inc esi
movzx eax, cl
mov cl, byte [esi]
inc esi
mov word [edx], ax
lea edx, [edx + 2]
test cl, cl
jne 0x40285a
push 0x2e
pop eax
push 0x64
mov word [edx], ax
pop eax
mov word [edx + 2], ax
xor eax, eax
push 8
push eax
mov word [edx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov word [edx + 4], bx
mov word [edx + 6], bx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov cl, byte [esi]
test cl, cl
jne 0x402857
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a8f813
leave
ret
Function at 0x406a92
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
xor eax, eax
push esi
mov esi, ecx
inc eax
push edi
push 0x20
pop ecx
or dword [esi + 0x90], 0xffffffff
mov edx, ebx
or dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
mov eax, dword [esi + 4]
cmp eax, ecx
mov dword [ebp - 4], esi
cmova eax, ecx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x58], ebx
cmp eax, dword [esi + 0x20]
je 0x406b48
lea edi, [esi + 0xc8]
mov ebx, ecx
cmp dword [edi + 8], 0
je 0x406b22
mov ecx, edi
call fcn.00405b36
add edi, 0x28
sub ebx, 1
jne 0x406b15
cmp dword [esi + 0x5c], ebx
je 0x406b3e
mov eax, dword [esi + 0x14]
push dword [esi + 0x5c]
push eax
call dword [eax + 4]
mov dword [esi + 0x5c], ebx
jmp 0x406b40
xor ebx, ebx
mov eax, dword [esi]
mov edx, dword [esi + 0x58]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x98], eax
lea eax, [edx + 5]
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
imul ebx, eax, 0x28
lea eax, [edx + 1]
mov dword [esi + 0x58], eax
add ebx, esi
mov ecx, ebx
call fcn.00405b19
mov edi, eax
test edi, edi
jne 0x406bd7
lea ecx, [ebx + 0x20]
call fcn.0040885d
mov edi, eax
test edi, edi
jne 0x406bd7
lea ecx, [ebx + 0x1c]
call fcn.0040885d
mov edi, eax
test edi, edi
jne 0x406bd7
push ebx
call fcn.00406838
mov edi, eax
test edi, edi
je 0x406bd7
and dword [esi + 0x44], 0
lea ebx, [esi + 0xc8]
push 0x20
pop esi
mov ecx, ebx
call fcn.00405b5a
add ebx, 0x28
sub esi, 1
jne 0x406bc5
mov esi, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
test eax, eax
je 0x406beb
mov dword [esi + 0x40], eax
xor edx, edx
cmp dword [esi + 0x38], edx
jne 0x406bff
cmp dword [esi + 0x40], edx
jne 0x406bff
cmp dword [esi + 0x3c], edx
jne 0x406bff
mov dword [esi + 0x44], edx
xor ecx, ecx
cmp dword [esi + 0x44], edx
pop edi
pop esi
cmovne eax, ecx
pop ebx
leave
ret

Function at 0x407f6e
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 8], 0
and dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret