joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016f10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x100aa874
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10016ff0
push 0x100aa870
push 0
push 0
push 0x8004
push dword [0x100aa874]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10016ff0
movaps xmm0, xmmword [0x1009e0b0]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x30683e39
movaps xmm0, xmmword [0x1009e820]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x3a6c2a18
movaps xmm0, xmmword [0x1009ea30]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x7928220d
mov word [ebp - 4], 0x25
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x10016f94
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x100aa870]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10016ff0
push 0x100aa86c
push 0x800000
push dword [0x100aa870]
push 0x6801
push dword [0x100aa874]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10016ff0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100aa868], eax
call fcn.100665a0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10066a70
push 0x10016d70
push 0x100aa864
call fcn.100662b0
call fcn.10066600
push 4
push 0x450890
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001705f
mov dword [0x100aa864], 0x450890
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10016d70
push 0x100aa864
call fcn.10065e20
call fcn.10066600
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10016e10
push 0x100aa860
call fcn.100662b0
call fcn.10066600
push 4
push 0x4504c0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100170bc
mov dword [0x100aa860], 0x4504c0
call fcn.100665a0
call esi
push eax
call fcn.10066a70
push 0x10016e10
push 0x100aa860
call fcn.10065e20
call fcn.10066600
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100175a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1006a300
add esp, 0xc
mov eax, 0x100aad08
cmp dword [0x100aad1c], 0x10
cmovae eax, dword [0x100aad08]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Option.Ini
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebp - 0x110], 0
mov dword [ebp - 0x114], 0xf
mov dword [ebp - 0x118], 0
mov byte [ebp - 0x128], 0
jne 0x10017626
xor eax, eax
jmp 0x10017639
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10017630
sub eax, edx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x128]
call fcn.10002770
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x110]
push eax
push 1
push str.LootWeapon
push str.PetLooting
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
mov edi, 1
push eax
push edi
push str.LootArmor
cmova ecx, edi
push str.PetLooting
mov byte [0x100aad90], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootAccessory
cmova ecx, edi
push str.PetLooting
mov byte [0x100aad91], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootNormal
cmova ecx, edi
push str.PetLooting
mov byte [0x100aad92], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootMagic
cmova ecx, edi
push str.PetLooting
mov byte [0x100aad93], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootRare
cmova ecx, edi
push str.PetLooting
mov byte [0x100aad94], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootUpgrade
cmova ecx, edi
push str.PetLooting
mov byte [0x100aad95], cl
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
cmova ecx, edi
push edi
mov byte [0x100aad96], cl
push str.LootUnique
push str.PetLooting
call esi
movzx ecx, al
cmp al, 1
lea eax, [ebp - 0x110]
push eax
push edi
push str.LootCraft
cmova ecx, edi
push str.PetLooting
mov byte [0x100aad97], cl
call esi
cmp al, 1
movzx ecx, al
mov eax, dword [ebp - 0x114]
cmova ecx, edi
mov byte [0x100aad98], cl
cmp eax, 0x10
jb 0x100177a8
inc eax
lea ecx, [ebp - 0x128]
push eax
push dword [ebp - 0x128]
call fcn.10002650
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x100178f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100aaf01], 0
jne 0x10017938
push 0x100aaf28
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp eax, 1
jne 0x10017928
push 0x100aaf30
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov al, 1
mov byte [0x100aaf00], al
mov byte [0x100aaf01], al
jmp 0x1001793d
xor al, al
mov byte [0x100aaf01], 1
mov byte [0x100aaf00], al
jmp 0x1001793d
mov al, byte [0x100aaf00]
test al, al
je 0x10017984
push 0x100aaf28
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [0x100aaf2c]
mov ecx, dword [0x100aaf28]
call fcn.10085480
mov edx, dword [0x100aaf34]
mov ecx, dword [0x100aaf30]
movsd qword [ebp - 8], xmm0
call fcn.10085480
movsd xmm1, qword [ebp - 8]
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WINMM.dll_timeGetTime]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1009e400]
cvtpd2ps xmm0, xmm0
mov esp, ebp
pop ebp
ret
Function at 0x10017e30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1fc
lea eax, [ebp - 0x200]
mov esi, ecx
push 0
push eax
call fcn.1006a300
add esp, 0xc
mov dword [ebp - 0x200], 0x1fc
lea eax, [ebp - 0x200]
mov dword [ebp - 0x1fc], esi
mov dword [ebp - 0x1f8], 1
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov byte [0x100aa87c], 0
mov byte [0x100aa81f], 0
pop esi
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x10019700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087450
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
mov eax, dword [0x100a7078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, byte [0x100aa8ae]
cmp bl, 0x41
je 0x10019857
mov ecx, 0xd78dd4
xor bh, bh
call fcn.10019420
mov ecx, eax
call fcn.10001e40
cmp ecx, eax
jne 0x10019763
mov ecx, 0xd78dd4
call fcn.10019420
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
je 0x10019765
mov bh, 1
call fcn.10001e50
cmp dword [0x100aa8f4], eax
mov edx, 1
movzx ecx, bh
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, eax
call fcn.100157e0
mov ecx, 0xd78dd4
mov esi, eax
call fcn.10019420
cmp esi, eax
jne 0x100197c3
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, eax
call fcn.100157e0
mov ecx, dword [0x100aa890]
mov esi, eax
call fcn.100157e0
cmp eax, esi
jne 0x100197c3
cmp byte [ebp - 0x14], 0
je 0x10019857
movaps xmm0, xmmword [0x1009e520]
xor ecx, ecx
movups xmmword [ebp - 0x80], xmm0
movzx eax, bl
movaps xmm0, xmmword [0x1009eb10]
push eax
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 0x7b66607a
mov word [ebp - 0x5c], 0x78
nop dword [eax]
mov al, byte [ebp - 0x80]
xor byte [ebp + ecx - 0x7f], al
inc ecx
cmp ecx, 0x24
jb 0x100197f0
sub esp, 0x18
mov byte [ebp - 0x5b], 0
lea eax, [ebp - 0x7f]
mov ecx, esp
push eax
call fcn.10002870
lea eax, [ebp - 0x58]
push eax
call fcn.1000d830
add esp, 0x20
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1001ce90
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x10019845
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.10002650
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x58], 0
call fcn.10022620
test eax, eax
je 0x100198ea
movaps xmm0, xmmword [0x1009e900]
xor ecx, ecx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x797c78
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x12
jb 0x10019878
cmp byte [ebp - 0x27], 0
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x100198a5
xor ecx, ecx
jmp 0x100198b9
lea ecx, [ebp - 0x27]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100198b0
sub ecx, edx
push ecx
lea eax, [ebp - 0x27]
push eax
lea ecx, [ebp - 0x40]
call fcn.10002770
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 1
call fcn.1001ce90
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x100198ea
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10002650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b2c0
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100874d6
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.1006a300
add esp, 0xc
lea eax, [ebp - 0x118]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x118], 0
jne 0x1001b323
xor ecx, ecx
jmp 0x1001b339
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001b330
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
mov ecx, 0x100aadc8
push eax
call fcn.10002770
mov cl, 0x50
mov byte [ebp - 0x11a], 0
mov al, 0xc
mov byte [ebp - 0x11c], cl
xor al, cl
mov byte [ebp - 0x11a], 0
mov byte [ebp - 0x11b], al
jne 0x1001b371
xor ecx, ecx
jmp 0x1001b389
lea ecx, [ebp - 0x11b]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001b380
sub ecx, edx
push ecx
push ecx
lea eax, [ebp - 0x11b]
push eax
call fcn.1001d5f0
push 0xffffffffffffffff
inc eax
mov ecx, 0x100aadc8
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.10003aa0
mov esi, eax
cmp esi, 0x100aadc8
je 0x1001b3f9
mov ecx, dword [0x100aaddc]
cmp ecx, 0x10
jb 0x1001b3d3
inc ecx
push ecx
push dword [0x100aadc8]
mov ecx, 0x100aadc8
call fcn.10002650
push esi
mov ecx, 0x100aadc8
mov dword [0x100aaddc], 0xf
mov dword [0x100aadd8], 0
mov byte [0x100aadc8], 0
call fcn.10009430
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x12c]
cmp eax, 0x10
jb 0x1001b41e
inc eax
lea ecx, [ebp - 0x140]
push eax
push dword [ebp - 0x140]
call fcn.10002650
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [0x100aa890], eax
call fcn.10001e50
mov dword [0x100aa8f4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1000c5c0
call fcn.1000c6a0
call fcn.10002d80
sidt [ebp - 0x124]
mov eax, dword [ebp - 0x122]
and eax, 0xff000000
cmp eax, 0xff000000
jne 0x1001b47a
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.10002df0
call fcn.10002ea0
test al, al
jne 0x1001b463
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x128], 0
rdtsc
mov dword [ebp - 0x124], eax
rdtsc
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 0x124]
cmp eax, 0x1f4
ja 0x1001b463
call fcn.10002f50
call fcn.10022040
mov dword [0x100aa918], eax
test eax, eax
je 0x1001b4d9
mov ecx, eax
call fcn.10022230
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x1001ca10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1009e8c0]
xor ecx, ecx
mov eax, dword [0x100aa8f0]
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
movups xmmword [ebp - 0x38], xmm0
mov byte [ebp - 0x28], 0
nop dword [eax]
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0xf
jb 0x1001ca40
sub esp, 0x18
mov byte [ebp - 0x28], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x37], 0
jne 0x1001ca71
xor ecx, ecx
jmp 0x1001ca80
lea ecx, [ebp - 0x37]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001ca77
sub ecx, esi
push ecx
lea eax, [ebp - 0x37]
mov ecx, edx
push eax
call fcn.10002770
lea ecx, [ebp - 0x1c]
call fcn.10063690
mov edi, dword [ebp - 8]
add esp, 0x18
cmp dword [0x100aa8ec], 0
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0
jbe 0x1001caf9
xor edx, edx
mov dword [ebp - 0x20], edx
cmp edi, 0x10
lea ecx, [ebp - 0x1c]
cmovae ecx, ebx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001cac0
sub ecx, esi
mov eax, edx
cmp edi, 0x10
lea esi, [ebp - 0x1c]
cmovae esi, ebx
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x20]
mov al, byte [edx + esi]
mov edx, dword [ebp - 0x3c]
xor byte [ecx + edx], al
mov eax, dword [ebp - 0x24]
inc eax
movzx edx, ax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
cmp edx, dword [0x100aa8ec]
jb 0x1001cab2
cmp edi, 0x10
jb 0x1001cb0b
lea eax, [edi + 1]
push eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.10002650
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x1001cc70
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087680
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x50
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x100aa87d], 0
je 0x1001ce65
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
sub eax, dword [0x100aa910]
sbb edx, dword [0x100aa914]
mov dword [ebp - 0x5c], edx
jne 0x1001ccdf
cmp eax, 0xbb8
jb 0x1001ce65
call esi
movaps xmm0, xmmword [str.9KXTjV_MxUPO_]
xor ecx, ecx
mov dword [0x100aa910], eax
mov dword [0x100aa914], edx
movups xmmword [ebp - 0x24], xmm0
nop dword [eax]
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xe
jb 0x1001cd00
sub esp, 0x18
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x23]
mov ecx, esp
push eax
call fcn.10002870
lea ecx, [ebp - 0x48]
call fcn.10063690
add esp, 0x18
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
mov byte [ebp - 0x49], 0xa1
mov dword [ebp - 0x30], vtable.ByteBuffer.0
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x1000
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.1000f360
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
mov edi, edx
mov ecx, dword [ebp - 0x20]
sub edi, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], vtable.Packet.0
cmp edi, 0x989680
ja 0x1001cdca
lea esi, [eax + 1]
cmp edi, esi
jae 0x1001cdbd
push esi
lea ecx, [ebp - 0x20]
call fcn.1000f2a0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dl, byte [ebp - 0x49]
mov byte [ecx + eax], dl
inc eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
sub edx, ecx
mov byte [ebp - 4], 3
mov byte [ebp - 0x49], 0xa5
cmp edx, 0x989680
ja 0x1001cdfc
lea esi, [eax + 1]
cmp edx, esi
jae 0x1001cdf2
push esi
lea ecx, [ebp - 0x20]
call fcn.1000f2a0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dl, byte [ebp - 0x49]
mov byte [ecx + eax], dl
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
cmovae eax, dword [ebp - 0x48]
push eax
call fcn.1001eac0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], eax
cmp ecx, 0x4000
ja 0x1001ce41
mov eax, dword [0x100aa88c]
mov dword [ebp - 0x5c], eax
mov ecx, dword ds:[0x10097e9c]
mov ecx, dword ds:[ecx]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
call dword [ebp - 0x5c]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x30], vtable.ByteBuffer.0
call fcn.1000f460
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x1001ce65
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.10002650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001d060
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087718
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x38], esi
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1001d0cb
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
jmp 0x1001d233
xorps xmm0, xmm0
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], fcn.1001d260
mov dword [ebp - 0x24], edi
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 8
lea eax, [ebp - 0x30]
movq qword [ebp - 0x20], xmm0
push eax
push 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
push 0x2d1400
push edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001d151
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 0x10
jb 0x1001d140
mov eax, dword [esi]
jmp 0x1001d142
mov eax, esi
mov byte [eax], 0
mov dword [ebp - 4], 1
jmp 0x1001d226
mov eax, dword [ebp - 0x2c]
push eax
mov dword [ebp - 0x38], eax
call fcn.10067f54
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1001d176
push dword [ebp - 0x38]
push 0
push ebx
call fcn.1006a300
add esp, 0xc
jmp 0x1001d178
xor ebx, ebx
mov dword [ebp - 0x34], ebx
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x38]
lea eax, [ebp - 0x20]
push ebx
push 0xc
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1001d1d4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], eax
jb 0x1001d1b9
mov eax, dword [esi]
jmp 0x1001d1bb
mov eax, esi
mov byte [eax], 0
test ebx, ebx
je 0x1001d1cb
push ebx
call fcn.10067d17
add esp, 4
mov dword [ebp - 4], 3
jmp 0x1001d226
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x1001d20c
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], eax
jb 0x1001d1f5
mov eax, dword [esi]
jmp 0x1001d1f7
mov eax, esi
push ebx
mov byte [eax], 0
call fcn.10067d17
add esp, 4
mov dword [ebp - 4], 4
jmp 0x1001d226
add eax, ebx
mov ecx, esi
push eax
call fcn.10002870
push ebx
call fcn.10067d17
add esp, 4
mov dword [ebp - 4], 5
test edi, edi
je 0x1001d233
push edi
call fcn.1001d260
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
Function at 0x10022040
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x100a7078]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, 0x1d
mov dword [ebp - 0x2f8], 0x71694f1d
mov dword [ebp - 0x2f4], 0x797c7251
xor eax, eax
mov dword [ebp - 0x2f0], 0x746f694e
mov word [ebp - 0x2ec], 0x7a73
mov byte [ebp - 0x2ea], 0
xor byte [ebp + eax - 0x2f7], cl
inc eax
cmp eax, 0xd
jae 0x1002209a
mov cl, byte [ebp - 0x2f8]
jmp 0x10022085
push ebx
mov byte [ebp - 0x2e8], 0x14
mov al, 0x7a
xor al, byte [ebp - 0x2e8]
mov bl, 0x78
mov ah, bl
mov byte [ebp - 0x2e7], al
mov al, byte [ebp - 0x2e8]
mov dl, 0x70
mov bh, ah
mov byte [ebp - 0x2d9], ah
xor bl, al
mov byte [ebp - 0x2de], 0
xor ah, al
mov byte [ebp - 0x2ea], 0
xor bh, al
mov byte [ebp - 0x2e3], ah
mov dh, dl
mov byte [ebp - 0x2e4], bl
xor dl, al
mov byte [ebp - 0x2e0], bh
xor dh, al
mov byte [ebp - 0x2e5], dl
mov cl, 0x60
mov byte [ebp - 0x2e1], dh
xor cl, al
mov byte [ebp - 0x2de], 0
mov ch, 0x3a
mov byte [ebp - 0x2e6], cl
xor ch, al
mov al, byte [ebp - 0x2d9]
xor al, byte [ebp - 0x2e8]
mov byte [ebp - 0x2df], al
lea eax, [ebp - 0x2f7]
push esi
push eax
lea eax, [ebp - 0x2e7]
mov byte [ebp - 0x2e2], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
jne 0x10022161
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10067955
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1002214f
push 0x2cc
lea eax, [ebp - 0x2d8]
push 0
push eax
call fcn.1006a300
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1002214f
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1002214f
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1002214f
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10001fb0
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1002214f
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.10067955
mov esp, ebp
pop ebp
ret