joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40402a
Capabilities:
Identify system language via api

Disassembly:
cmp byte [0x47c000], 0
push ebx
push ebp
push esi
push edi
mov ebx, pe_overlay
mov edi, 0x47c000
je 0x404049
push edi
call fcn.0040640a
jmp 0x40404f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, dword [0x44bb84]
mov ecx, esi
dec esi
test ecx, ecx
je 0x4040a3
mov ecx, dword [0x44bb48]
mov ecx, dword [ecx + 0x64]
mov edx, ecx
imul ecx, esi
neg edx
add ecx, dword [0x44bb80]
mov bp, word [ecx]
xor bp, ax
and ebp, ebx
test bp, bp
je 0x40408a
mov ebp, esi
dec esi
add ecx, edx
test ebp, ebp
jne 0x404072
jmp 0x4040a3
mov edx, dword [ecx + 2]
mov dword [0x447b20], edx
mov edx, dword [ecx + 6]
mov dword [0x44bbe8], edx
lea edx, [ecx + 0xa]
test edx, edx
jne 0x4040b5
cmp bx, 0xffff
jne 0x4040b1
mov ebx, 0x3ff
jmp 0x40404f
xor ebx, ebx
jmp 0x40404f
mov dword [0x447b1c], edx
movzx eax, word [ecx]
push eax
push edi
call fcn.004063f1
push 0xfffffffffffffffe
push 0x447b40
call fcn.004064c3
push eax
push dword [0x4354e0]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x44bb6c]
mov esi, dword [0x44bb68]
mov ecx, eax
dec eax
test ecx, ecx
je 0x40410f
lea ebx, [esi + 0x18]
lea ebp, [eax + 1]
mov edi, 0x2018
mov eax, dword [esi]
test eax, eax
je 0x404108
push eax
push ebx
call fcn.004064c3
add esi, edi
add ebx, edi
dec ebp
jne 0x4040fb
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405cc4
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x43ad08], 0x44
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x405ce8
test al, 0x10
jne 0x405ceb
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x43ad08
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405d16
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x405d96
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040607b
test byte [ebp + 0xc], 8
mov dword [ebp - 4], eax
je 0x405dca
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x44bbc8], eax
jmp 0x405f93
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp + 8], ebx
je 0x405de8
test eax, eax
je 0x405f17
test byte [ebp + 0xc], 2
je 0x405f17
mov esi, 0x436508
push edi
push esi
call fcn.00406494
test ebx, ebx
je 0x405e05
push str..
push esi
call fcn.004064b2
jmp 0x405e0b
push edi
call fcn.00405fe0
push 0x40a268
push edi
call fcn.004064b2
push edi
call fcn.004064a5
mov ebx, eax
lea eax, [ebp - 0x144]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f0d
cmp byte [ebp - 0x118], 0x2e
jne 0x405e5c
cmp byte [ebp - 0x117], 0x2e
je 0x405ef0
cmp byte [ebp - 0x117], 0
je 0x405ef0
lea eax, [ebp - 0x118]
push eax
push ebx
call fcn.00406494
test byte [ebp - 0x144], 0x10
je 0x405e87
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405ef0
push dword [ebp + 0xc]
push edi
call fcn.00405d96
jmp 0x405ef0
push edi
push str.Delete:_DeleteFile___s__
call fcn.0040691c
mov eax, dword [ebp - 0x144]
pop ecx
pop ecx
and al, 0xfe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405ee8
test byte [ebp + 0xc], 4
push edi
je 0x405ed4
push str.Delete:_DeleteFile_on_Reboot___s__
call fcn.0040691c
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.00405771
push 0
push edi
call fcn.004061dd
jmp 0x405ef0
push str.Delete:_DeleteFile_failed___s__
call fcn.0040691c
inc dword [0x44bbc8]
pop ecx
pop ecx
jmp 0x405ef0
push edi
push 0xfffffffffffffff2
call fcn.00405771
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405e39
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405f17
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp + 8], esi
je 0x405f93
cmp dword [ebp - 4], esi
push edi
jne 0x405f39
push str.RMDir:_RemoveDirectory_invalid_input___s__
call fcn.0040691c
inc dword [0x44bbc8]
pop ecx
pop ecx
jmp 0x405f93
call fcn.00406938
test eax, eax
je 0x405f93
push edi
call fcn.00405f99
push edi
push str.RMDir:_RemoveDirectory___s__
call fcn.0040691c
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405f8b
test byte [ebp + 0xc], 4
push edi
je 0x405f84
push str.RMDir:_RemoveDirectory_on_Reboot___s__
call fcn.0040691c
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.00405771
push esi
push edi
call fcn.004061dd
jmp 0x405f93
push str.RMDir:_RemoveDirectory_failed___s__
jmp 0x405f2a
push edi
push 0xffffffffffffffe5
call fcn.00405771
pop edi
pop esi
leave
ret 8
Function at 0x40607b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x438508
push esi
call fcn.00406494
push esi
call fcn.0040602c
mov edi, eax
test edi, edi
jne 0x40609c
xor eax, eax
jmp 0x4060ee
push edi
call fcn.00406704
test byte [0x44bb50], 0x80
je 0x4060b5
mov al, byte [edi]
test al, al
je 0x406098
cmp al, 0x5c
je 0x406098
sub edi, esi
push esi
call fcn.004064a5
cmp eax, edi
push esi
jle 0x4060d8
call fcn.00406938
test eax, eax
je 0x4060d0
test byte [eax], 0x10
je 0x406098
push esi
call fcn.00405fe0
jmp 0x4060b7
call fcn.00405f99
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x406165
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x406194
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4061d9
mov eax, edi
dec edi
test eax, eax
jne 0x40619f
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4061d3
Function at 0x4061dd
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00406976
test eax, eax
mov esi, dword [esp + 0x18]
je 0x406209
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x40634d
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x43ae90], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x43ae90
je 0x40624d
push 1
push 0
push esi
call fcn.00406165
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406353
cmp eax, edi
jg 0x406353
mov esi, 0x43a908
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406353
cmp eax, edi
jg 0x406353
push esi
push ebp
push str._s_s_r_n
push 0x43a508
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call fcn.004064b2
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40634d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x406335
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x406329
push str._Rename__r_n
push edi
call fcn.004060f3
test eax, eax
jne 0x40635a
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call fcn.00406494
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x43a508
push eax
call fcn.0040613f
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x44bbd0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x40aa18
push eax
call fcn.004060f3
test eax, eax
je 0x406310
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x406383
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x406376
sub eax, edi
jmp 0x406312
Function at 0x406387
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4063eb
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4063da
cmp dword [ebp + 0x14], 1
je 0x4063dc
cmp dword [ebp + 0x14], 2
je 0x4063dc
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40679d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4067c2
mov eax, dword [0x40a914]
cmp eax, 0xffffffff
je 0x4067b9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a914], 0xffffffff
jmp 0x406835
cmp dword [0x43baa0], ebx
je 0x406835
cmp byte [0x43b6a0], bl
je 0x406801
cmp dword [0x40a914], 0xffffffff
jne 0x40680a
push 4
push 0x40000000
push 0x43b6a0
call fcn.00406165
cmp eax, 0xffffffff
mov dword [0x40a914], eax
je 0x406835
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a914], 0xffffffff
je 0x406835
push esi
mov esi, 0x43fae0
push 0x40aae8
push esi
call fcn.004064b2
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.004064a5
push eax
push esi
push dword [0x40a914]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4069dd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x43b294], esi
push edi
jne 0x406a17
mov ecx, 0x43b290
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x4069f3
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x43b690
jl 0x4069ee
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406a4c
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43b290]
xor eax, esi
inc ecx
dec edx
jne 0x406a2f
pop edi
pop esi
not eax
ret 0xc
Function at 0x100071a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100071bb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100071f2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x100071ee
jmp 0x100071e0
cmp esi, eax
jae 0x100071f2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100071e0
cmp esi, eax
jb 0x100071f9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp esi, ebx
je 0x10008803
cmp dword [ebp + 8], ebx
je 0x10008803
mov eax, dword [esi + 0x24]
push edi
mov edi, dword [esi + 0x20]
mov ecx, edi
xor ecx, 0x18
shr ecx, 3
and ecx, 0x3f
mov byte [ecx + esi + 0x28], pe_nt_image_headers32
add dword [esi + 0x20], 8
mov dword [ebp - 4], eax
jne 0x1000876e
inc dword [esi + 0x24]
mov dword [esi + 0x20], ebx
test dword [esi + 0x20], 0x1ff
jne 0x10008780
push esi
call fcn.10008220
add esp, 4
mov edx, dword [esi + 0x20]
and edx, 0x1ff
cmp edx, 0x1c0
je 0x100087d0
mov eax, dword [esi + 0x20]
xor eax, 0x18
shr eax, 3
and eax, 0x3f
mov byte [eax + esi + 0x28], bl
add dword [esi + 0x20], 8
jne 0x100087ad
inc dword [esi + 0x24]
mov dword [esi + 0x20], ebx
test dword [esi + 0x20], 0x1ff
jne 0x100087bf
push esi
call fcn.10008220
add esp, 4
mov ecx, dword [esi + 0x20]
and ecx, 0x1ff
cmp ecx, 0x1c0
jne 0x10008791
mov edx, dword [ebp - 4]
push esi
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edi
call fcn.10008220
add esp, 4
xor eax, eax
pop edi
mov ecx, eax
xor ecx, 3
mov dl, byte [ecx + esi]
mov ecx, dword [ebp + 8]
mov byte [eax + ecx], dl
inc eax
cmp eax, 0x20
jl 0x100087e5
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008810
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x100e5900]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
xor ecx, 0xa3b1bac6
xor edx, 0x56aa3350
mov dword [ebp - 0x124], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x120], edx
mov edx, dword [eax + 0xc]
push ebx
xor ecx, 0x677d9197
xor edx, 0xb27022dc
push esi
mov dword [ebp - 0x84], 0x70e15
mov dword [ebp - 0x80], 0x1c232a31
mov dword [ebp - 0x7c], 0x383f464d
mov dword [ebp - 0x78], 0x545b6269
mov dword [ebp - 0x74], 0x70777e85
mov dword [ebp - 0x70], 0x8c939aa1
mov dword [ebp - 0x6c], 0xa8afb6bd
mov dword [ebp - 0x68], 0xc4cbd2d9
mov dword [ebp - 0x64], 0xe0e7eef5
mov dword [ebp - 0x60], 0xfc030a11
mov dword [ebp - 0x5c], 0x181f262d
mov dword [ebp - 0x58], 0x343b4249
mov dword [ebp - 0x54], 0x50575e65
mov dword [ebp - 0x50], 0x6c737a81
mov dword [ebp - 0x4c], 0x888f969d
mov dword [ebp - 0x48], 0xa4abb2b9
mov dword [ebp - 0x44], 0xc0c7ced5
mov dword [ebp - 0x40], 0xdce3eaf1
mov dword [ebp - 0x3c], 0xf8ff060d
mov dword [ebp - 0x38], 0x141b2229
mov dword [ebp - 0x34], 0x30373e45
mov dword [ebp - 0x30], 0x4c535a61
mov dword [ebp - 0x2c], 0x686f767d
mov dword [ebp - 0x28], 0x848b9299
mov dword [ebp - 0x24], 0xa0a7aeb5
mov dword [ebp - 0x20], 0xbcc3cad1
mov dword [ebp - 0x1c], 0xd8dfe6ed
mov dword [ebp - 0x18], 0xf4fb0209
mov dword [ebp - 0x14], 0x10171e25
mov dword [ebp - 0x10], 0x2c333a41
mov dword [ebp - 0xc], 0x484f565d
mov dword [ebp - 8], 0x646b7279
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], edx
xor esi, esi
jmp 0x10008950
mov eax, dword [ebp + esi - 0x84]
xor eax, dword [ebp + esi - 0x120]
add esi, 4
xor eax, dword [ebp + esi - 0x11c]
xor eax, dword [ebp + esi - 0x120]
mov ebx, eax
mov ecx, eax
shr ecx, 0x18
movzx ecx, byte [ecx + 0x100de400]
mov edx, eax
shr ebx, 0x10
shr edx, 8
shl ecx, 8
movzx ebx, bl
movzx ebx, byte [ebx + 0x100de400]
movzx edx, dl
movzx edx, byte [edx + 0x100de400]
or ecx, ebx
movzx eax, al
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 0x100de400]
shl ecx, 8
or ecx, edx
mov eax, ecx
rol eax, 0xd
mov edx, ecx
ror edx, 9
xor eax, edx
xor eax, dword [ebp + esi - 0x128]
xor eax, ecx
mov dword [ebp + esi - 0x118], eax
mov dword [esi + edi - 4], eax
cmp esi, 0x80
jb 0x10008950
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10077184
mov esp, ebp
pop ebp
ret
Function at 0x10008fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e5900]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push ebx
push edi
mov edi, ecx
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov bl, 4
lea eax, [ebp - 0x12]
mov dl, byte [eax + 1]
xor byte [eax - 2], dl
mov cl, byte [eax - 2]
xor cl, dl
mov dl, byte [eax]
xor byte [eax - 2], cl
xor byte [eax - 1], dl
mov byte [eax + 1], cl
mov cl, byte [eax - 1]
xor cl, dl
xor byte [eax - 1], cl
mov byte [eax], cl
add eax, 4
dec bl
jne 0x10009013
lea eax, [ebp - 0x14]
push eax
call fcn.10008810
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
xor al, al
pop ebx
call fcn.10077184
mov esp, ebp
pop ebp
ret
Function at 0x1000f340
Capabilities:
Check os version
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3860
call fcn.10077ab0
mov eax, dword [0x100e5900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [0x100b319c]
mov dword [ebp - 0x3860], ebx
mov dword [ebp - 0x3858], ebx
mov edi, edi
mov eax, dword [ebp - 0x3858]
push eax
push str..PhysicalDrive_d
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.100775ee
add esp, 0x10
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000f58e
xor eax, eax
mov dword [ebp - 0x37c0], eax
mov dword [ebp - 0x37bc], eax
push 0x2710
mov dword [ebp - 0x37b8], eax
lea eax, [ebp - 0x2fe4]
push ebx
push eax
mov dword [ebp - 0x385c], ebx
mov dword [ebp - 0x37c0], ebx
mov dword [ebp - 0x37bc], ebx
call fcn.10076930
add esp, 0xc
push ebx
lea ecx, [ebp - 0x385c]
push ecx
push 0x2710
lea edx, [ebp - 0x2fe4]
push edx
push 0xc
lea eax, [ebp - 0x37c0]
push eax
push 0x2d1400
push esi
call edi
test eax, eax
je 0x1000f581
mov edx, dword [ebp - 0x2fd8]
lea ecx, [ebp - 0x33cc]
push ecx
push ebx
push edx
lea eax, [ebp - 0x2fe4]
push eax
call fcn.1000f1d0
mov edx, dword [ebp - 0x2fd4]
lea ecx, [ebp - 0x8d4]
push ecx
push ebx
push edx
lea eax, [ebp - 0x2fe4]
push eax
call fcn.1000f1d0
mov edx, dword [ebp - 0x2fd0]
lea ecx, [ebp - 0x37b4]
push ecx
push ebx
push edx
lea eax, [ebp - 0x2fe4]
push eax
call fcn.1000f1d0
push 0x94
lea ecx, [ebp - 0x3854]
push ebx
push ecx
call fcn.10076930
add esp, 0x3c
lea edx, [ebp - 0x3854]
push edx
mov dword [ebp - 0x3854], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x3850]
cmp eax, 6
jne 0x1000f56e
cmp dword [ebp - 0x384c], 2
jae 0x1000f574
lea eax, [ebp - 0x4ec]
push eax
push 1
mov ecx, dword [ebp - 0x2fcc]
push ecx
lea edx, [ebp - 0x2fe4]
push edx
call fcn.1000f1d0
add esp, 0x10
cmp byte [0x100e76d0], bl
jne 0x1000f539
movsx eax, byte [ebp - 0x4ec]
push eax
call fcn.1007798e
add esp, 4
test eax, eax
jne 0x1000f500
movsx ecx, byte [ebp - 0x4d9]
push ecx
call fcn.1007798e
add esp, 4
test eax, eax
je 0x1000f539
lea edx, [ebp - 0x4ec]
push edx
push 0x400
push 0x100e76d0
call fcn.10077a44
lea eax, [ebp - 0x8d4]
push eax
push 0x400
push 0x100e70c0
call fcn.10077a44
add esp, 0x18
mov dword [ebp - 0x3860], 1
push 0x2710
lea ecx, [ebp - 0x2fe4]
push ebx
push ecx
call fcn.10076930
add esp, 0xc
push ebx
lea edx, [ebp - 0x385c]
push edx
push 0x2710
lea eax, [ebp - 0x2fe4]
push eax
push ebx
push ebx
push 0x700a0
push esi
call edi
jmp 0x1000f587
jbe 0x1000f4b1
lea eax, [ebp - 0x4ec]
push eax
push ebx
jmp 0x1000f4ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [0x100b3198]
mov eax, dword [ebp - 0x3858]
inc eax
mov dword [ebp - 0x3858], eax
cmp eax, 0x10
jl 0x1000f370
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3860]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10077184
mov esp, ebp
pop ebp
ret
Function at 0x10010290
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [esi]
mov dword [ebp - 0x10], edi
mov edi, dword [esi + 4]
mov dword [ebp - 0xc], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov edx, 0xc6ef3720
mov dword [ebp - 8], edi
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], 0x20
mov esi, ecx
shr esi, 5
add esi, dword [ebp - 4]
mov edi, ecx
shl edi, 4
add edi, dword [ebp - 8]
xor esi, edi
lea edi, [edx + ecx]
xor esi, edi
sub eax, esi
mov esi, eax
shr esi, 5
add esi, dword [ebp - 0xc]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0x10]
xor esi, edi
lea edi, [edx + eax]
xor esi, edi
sub ecx, esi
add edx, 0x61c88647
dec dword [ebp + 0xc]
jne 0x100102c6
mov edx, dword [ebp + 8]
pop edi
mov dword [edx], ecx
mov dword [edx + 4], eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10010440
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x100e5900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.10010170
test eax, eax
jns 0x100105b9
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.10076930
add esp, 0xc
cmp dword [0x100e7ad4], ebx
jne 0x1001049b
push 0x100e7ad4
push 0x100e7ad4
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
mov edx, dword [0x100e7ad4]
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x100104c5
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.BODGEdit.exe
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100105a7
push 0x38
lea eax, [ebp - 0x144]
push ebx
push eax
call fcn.10076930
add esp, 0xc
lea edx, [ebp - 0x148]
lea ecx, [ebp - 0x108]
push edx
mov dword [ebp - 0x148], 0x3c
mov dword [ebp - 0x144], 0x40
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], str.open
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], 0x100b377c
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [ebp - 0x110]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x110]
lea ecx, [ebp - 0x10c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x110]
push eax
call dword [0x100b3198]
mov ecx, esi
call fcn.10010170
xor ecx, ecx
test eax, eax
setns cl
pop ebx
pop esi
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077184
mov esp, ebp
pop ebp
ret
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10077184
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.10077184
mov esp, ebp
pop ebp
ret