joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10072200
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, ecx
lea eax, [edx + 7]
mov dword [esp + 8], ebp
shr eax, 3
push esi
mov ecx, dword [ebp]
push edi
mov edi, dword [esp + 0x28]
lea ebx, [eax*8 + 1]
add ebx, eax
mov dword [esp + 0x14], ebx
lea eax, [ecx + ebx]
cmp eax, dword [ebp + 0xc]
ja 0x1007223a
mov esi, dword [ebp + 4]
add esi, ecx
jmp 0x10072249
push edi
push ebx
mov ecx, ebp
call fcn.10072fe0
mov edx, dword [esp + 0x24]
mov esi, eax
test byte [edi], 8
jne 0x10072389
cmp dword [esp + 0x1c], 0
jne 0x10072261
mov byte [esi], 0x7f
inc esi
xor bl, bl
jmp 0x10072268
mov byte [esi], 0x80
inc esi
or bl, 0xff
mov ecx, dword [esp + 0x20]
movsx eax, bl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
cmp edx, 8
jbe 0x100722ea
lea edi, [edx - 9]
shr edi, 3
inc edi
lea esp, [esp]
movzx eax, byte [ecx]
sub edx, 8
xor al, bl
mov byte [esi], al
movzx eax, byte [ecx + 1]
xor al, bl
mov byte [esi + 1], al
movzx eax, byte [ecx + 2]
xor al, bl
mov byte [esi + 2], al
movzx eax, byte [ecx + 3]
xor al, bl
mov byte [esi + 3], al
movzx eax, byte [ecx + 4]
xor al, bl
mov byte [esi + 4], al
movzx eax, byte [ecx + 5]
xor al, bl
mov byte [esi + 5], al
movzx eax, byte [ecx + 6]
xor al, bl
mov byte [esi + 6], al
movzx eax, byte [ecx + 7]
add ecx, 8
xor al, bl
mov byte [esi + 7], al
mov byte [esi + 8], 9
add esi, 9
dec edi
jne 0x10072290
mov dword [esp + 0x24], edx
test edx, edx
je 0x10072382
xor ebp, ebp
test edx, edx
je 0x1007235c
cmp edx, 0x20
jb 0x10072347
lea eax, [ecx - 1]
lea edi, [esi - 1]
add eax, edx
add edi, edx
cmp esi, eax
ja 0x1007230f
cmp edi, ecx
jae 0x10072347
mov eax, edx
mov edi, edx
and eax, 0x1f
sub edi, eax
jmp 0x10072320
movdqu xmm0, xmmword [ecx]
add ebp, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [ecx + 0x10]
add ecx, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi + 0x10], xmm0
add esi, 0x20
cmp ebp, edi
jb 0x10072320
cmp ebp, edx
jae 0x1007235c
mov edi, edx
sub ecx, esi
sub edi, ebp
mov al, byte [ecx + esi]
xor al, bl
mov byte [esi], al
inc esi
dec edi
jne 0x10072351
mov eax, 8
sub eax, edx
push eax
movzx eax, bl
push eax
push esi
call fcn.10117460
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov ebp, dword [esp + 0x10]
mov al, cl
xor al, bl
sub esi, ecx
mov byte [esi + 8], al
mov eax, dword [esp + 0x14]
add dword [ebp], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x10072940
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, ecx
push edi
lea eax, [ebp + 8]
xor edi, edi
cmp eax, dword [esi]
jae 0x10072971
mov eax, dword [esi + 4]
movzx eax, byte [eax + ebp]
sub eax, ebx
je 0x10072971
sub eax, 0x80
je 0x10072a62
sub eax, 0x7f
jne 0x1007297f
mov ecx, dword [esp + 0x24]
push 0x3ec
call fcn.10062ab0
mov eax, dword [esp + 0x24]
test byte [eax], 4
jne 0x10072a7c
lea ecx, [ebp + 1]
mov ebp, 8
add ecx, dword [esi + 4]
neg ebx
mov esi, dword [esp + 0x1c]
sbb bl, bl
movsx eax, bl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movzx eax, bl
pshufd xmm1, xmm0, 0
mov dword [esp + 0x10], eax
lea ebx, [ebx]
movzx edx, byte [ecx + 8]
xor edx, eax
cmp edx, 8
cmova edx, ebp
lea ebp, [edx + edi]
mov dword [esp + 0x18], ebp
cmp ebp, dword [esp + 0x20]
ja 0x10072a6c
xor edi, edi
test edx, edx
je 0x10072a3f
cmp edx, 0x20
jb 0x10072a2e
lea eax, [ecx - 1]
lea ebp, [esi - 1]
add eax, edx
add ebp, edx
cmp esi, eax
ja 0x100729fa
cmp ebp, ecx
jae 0x10072a2a
mov eax, edx
mov ebp, edx
and eax, 0x1f
sub ebp, eax
movdqu xmm0, xmmword [ecx]
add edi, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [ecx + 0x10]
add ecx, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi + 0x10], xmm0
add esi, 0x20
cmp edi, ebp
jb 0x10072a03
mov ebp, dword [esp + 0x18]
cmp edi, edx
jae 0x10072a3f
sub edx, edi
mov al, byte [ecx]
inc ecx
xor al, bl
mov byte [esi], al
inc esi
dec edx
jne 0x10072a34
mov dl, byte [ecx]
mov edi, ebp
mov eax, dword [esp + 0x10]
xor dl, bl
inc ecx
mov ebp, 8
cmp dl, 8
ja 0x100729c0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ebx, 1
jmp 0x1007297f
mov ecx, dword [esp + 0x24]
push 1
push 0xfffffbf2
call fcn.10062a50
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x10073130
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
mov ecx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, 1
lea eax, [ecx + 9]
cmp eax, dword [ebp]
jae 0x10073164
mov eax, dword [ebp + 4]
movzx eax, byte [eax + ecx]
sub eax, ebx
je 0x10073164
sub eax, 0x80
je 0x1007319c
sub eax, 0x7f
jne 0x10073174
push 0x3ec
mov ecx, edi
call fcn.10062ab0
mov ecx, dword [esp + 0x14]
test byte [edi], 4
jne 0x10073193
mov eax, dword [ebp + 4]
inc eax
add ecx, eax
neg ebx
sbb bl, bl
mov dl, byte [ecx + 8]
lea ecx, [ecx + 9]
xor dl, bl
add esi, 9
cmp dl, 8
ja 0x10073183
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
mov ebx, esi
jmp 0x10073174
Function at 0x10081230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x10]
mov ecx, edi
push 0
mov dword [esi], 0x10009694
lea eax, [esi + 0x30]
mov dword [esi + 0x24], eax
lea eax, [esi + 0x88]
mov dword [esi + 0x20], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0x40
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0x40
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x70], 0
mov eax, dword [edi]
call dword [eax + 0x3c]
mov ecx, eax
call fcn.10089330
push 0x63c
mov eax, dword [eax + 8]
movzx ebx, byte [eax + 5]
and ebx, 1
call fcn.10118b22
add esp, 4
test eax, eax
je 0x100812ca
mov ecx, eax
call fcn.100810d0
jmp 0x100812cc
xor eax, eax
mov dword [esi + 0xc], eax
test eax, eax
jne 0x100812eb
mov ecx, dword [esp + 0x14]
push 1
push 0xfffffc0d
call fcn.10062a50
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x38]
push dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
push 0x40000
push ebx
push dword [eax + 0xc]
call fcn.1007c0b0
mov eax, dword [esi + 0xc]
pop edi
inc dword [eax]
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x18]
mov dword [esi + 0x10], eax
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x10082dd0
Capabilities:
Get hostname

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x10082df9
push dword [esp + 0x10]
mov ecx, esi
call fcn.100829a0
pop esi
ret 0xc

Function at 0x10082e60
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x1c]
mov ecx, reloc.mswstr10.dll_Ordinal_2
push esi
push edi
xor edi, edi
mov esi, 1
mov eax, dword [ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
test eax, eax
cmove eax, ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x10082eb3
cmp byte [ecx], 0
je 0x10082eb3
lea edx, [esp + 0x24]
push edx
push 0x20019
push edi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10082efe
lea edi, [eax + 1]
mov eax, dword [esp + 0x24]
jmp 0x10082eb7
mov dword [esp + 0x24], eax
test eax, eax
je 0x10082ef3
push ebx
mov ebx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push ebp
push ebx
push ecx
push 0
push dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp]
cmp eax, dword [esp + 0x10]
jae 0x10082eee
cmp dword [esp + 0x18], 1
jne 0x10082eee
test esi, esi
jne 0x10082eee
mov byte [eax + ebx], 0
mov eax, dword [esp + 0x28]
pop ebx
test edi, edi
je 0x10082efe
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
pop esi
sete al
pop ebp
pop ecx
ret 0x14
Function at 0x10082f10
Capabilities:
Resume thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x18]
cmp dword [esi + 0x18], 0
jne 0x10082fd0
mov eax, dword [esi + 0x14]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10118b22
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
jne 0x10082f5c
push 1
push 0xfffffc0d
mov ecx, edi
call fcn.10062a50
pop edi
pop esi
pop ebp
pop ebx
ret 8
xor ebx, ebx
cmp dword [esi + 0x14], ebx
jbe 0x10082fd0
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esp, [esp]
push 4
call fcn.10118b22
add esp, 4
test eax, eax
je 0x10082f90
push edi
push esi
push 0x10083230
mov ecx, eax
call fcn.1008dcb0
mov ecx, eax
jmp 0x10082f92
xor ecx, ecx
mov eax, dword [esi + 0x18]
mov dword [eax + ebx*4], ecx
mov eax, dword [esi + 0x18]
cmp dword [eax + ebx*4], 0
jne 0x10082faf
push 1
push 0xfffffc0d
mov ecx, edi
call fcn.10062a50
test byte [edi], 8
jne 0x10082ffd
lea eax, [esi + 0x68]
mov ecx, 1
lock xadd dword [eax], ecx
mov eax, dword [esi + 0x18]
mov eax, dword [eax + ebx*4]
push dword [eax]
call ebp
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x10082f70
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx + 8]
test eax, eax
je 0x1008303a
mov ecx, dword [esi + 0x54]
push eax
call fcn.10050770
test eax, eax
jne 0x1008303a
push 1
push 0xfffffc0e
mov ecx, edi
call fcn.10062a50
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esi + 0x18]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10083017
mov ecx, edi
call fcn.1008dd80
push edi
call fcn.10118b98
add esp, 4
mov eax, dword [esi + 0x18]
mov dword [eax + ebx*4], 0
test ebx, ebx
jne 0x10083044
push dword [esi + 0x18]
call fcn.10118b98
add esp, 4
mov dword [esi + 0x18], ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, dword [esi + 0x1c]
push edi
push ebx
call fcn.1008ddb0
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x1008dcb0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
mov esi, ecx
push eax
push 4
push dword [esp + 0x18]
push dword [esp + 0x18]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x1008dce3
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, esi
pop esi
pop ecx
ret 0xc
push edi
mov edi, dword [esp + 0x18]
mov ecx, 0x10137ca8
push edi
call fcn.100829a0
test byte [edi], 1
jne 0x1008dd18
cmp dword [edi + 4], 0xffffea84
jne 0x1008dd18
push 1
push 0
push 0
push 0xffffdf30
push 0xffffea84
mov ecx, edi
call fcn.100629e0
pop edi
mov eax, esi
pop esi
pop ecx
ret 0xc
Function at 0x100a9b05
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
mov edx, dword [esi + 0x8c]
mov ebx, edx
mov ecx, dword [esi + 0x60]
imul eax, edx, 0x24
shl ebx, 3
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], eax
mov eax, dword [ecx + eax + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0xe4]
add ecx, ebx
mov ebx, dword [eax + 0x104]
imul eax, dword [eax + 0x108], 0xc
mov dword [esp + 0x14], ecx
add eax, ebx
mov dword [esp + 0x10], eax
jmp 0x100a9c9e
mov ebp, dword [ebx]
mov edi, dword [ebp + 0xe4]
add edi, dword [esp + 0x2c]
and dword [esp + 0x20], 0
cmp dword [esp + 0x48], 0
je 0x100a9b9b
mov eax, dword [esp + 0x48]
push dword [eax + 0x28]
push ebx
push esi
call fcn.100ce71c
mov ecx, dword [esp + 0x14]
test eax, eax
mov eax, dword [esp + 0x10]
js 0x100a9c97
mov edx, dword [esp + 0x28]
cmp dword [esp + 0x4c], 0
je 0x100a9bac
cmp ebp, dword [esp + 0x4c]
je 0x100a9c97
test byte [edi + 4], 6
jne 0x100a9ce6
test byte [edi + 4], 1
je 0x100a9bd2
push 3
push dword [ebp + edx*4 + 0x28]
push dword [esi + 0x28]
call fcn.1003c9e0
and dword [edi + 4], 0xfffffffe
mov ecx, dword [esp + 0x14]
cmp byte [ecx], 2
je 0x100a9cb2
test byte [ecx + 4], 1
jne 0x100a9cb2
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
cmp dword [edx + eax + 0x64], 0xa
jne 0x100a9bff
cmp dword [esp + 0x50], 0
je 0x100a9c93
or dword [edi + 4], 8
mov dword [esp + 0x24], 1
mov byte [edi], 3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp dword [ecx + eax + 0x64], 0
jne 0x100a9c59
mov eax, dword [ebp + 0xf0]
mov edx, dword [eax + 8]
mov ecx, dword [eax + 4]
and edx, 0x3f
shl edx, 4
add edx, ecx
mov dword [esp + 0x30], ecx
cmp ecx, edx
jae 0x100a9c59
mov esi, ecx
mov ecx, dword [esi]
add esi, 0x10
mov eax, dword [edi + 4]
shl eax, 3
not eax
xor eax, dword [ecx + 4]
and eax, 0x40
xor dword [ecx + 4], eax
cmp esi, edx
jb 0x100a9c3b
mov esi, dword [esp + 0x3c]
mov eax, dword [ebp + 0xe0]
xor edi, edi
push edi
push edi
push dword [esp + 0x28]
push dword [esp + 0x50]
push dword [eax + 0x28]
push dword [esp + 0x48]
push dword [esi + 0x28]
call fcn.1003cda0
push dword [esp + 0x24]
push edi
push edi
push dword [esp + 0x50]
push ebp
push esi
call fcn.100a9b05
test eax, eax
js 0x100a9ca8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
add ebx, 0xc
cmp ebx, eax
jb 0x100a9b61
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x48]
push ebx
push dword [esp + 0x4c]
push esi
call fcn.100a9edc
test eax, eax
jne 0x100a9bff
and dword [esp + 0x24], eax
mov eax, dword [edi + 4]
and eax, 0xfffffff7
mov byte [edi], 2
or eax, 0x10
mov dword [edi + 4], eax
jmp 0x100a9c0e
lea eax, [esp + 0x44]
push eax
push ebp
push esi
call fcn.100ab6ae
xor eax, eax
push eax
push eax
push eax
push 0xffffe009
push eax
push eax
push dword [esp + 0x5c]
push dword [esi + 0x28]
call fcn.100377a0
mov eax, 0xfffffbe8
jmp 0x100a9ca8
Function at 0x100b50be
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x198
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x194], eax
push ebx
mov ebx, dword [esp + 0x1a0]
lea eax, [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x1ac]
push edi
mov edi, dword [esp + 0x1b4]
push 0x1c
push 0x64
push eax
push dword [edi + 8]
push ebx
call fcn.10091a7b
movsx ebp, ax
mov eax, dword [esi + 0x88]
add eax, ebp
cmp eax, dword [esi + 0x8c]
jle 0x100b5127
mov dword [esi + 0x8c], eax
shl eax, 5
push eax
lea eax, [esi + 0x84]
push eax
push ebx
call fcn.100ca17d
lea ebx, [esp + 0x14]
mov eax, ebx
mov ecx, ebx
mov dword [esp + 0x10], ecx
lea eax, [eax + ebp*4]
xor ebp, ebp
mov edx, eax
sub edx, ecx
xor ecx, ecx
add edx, 3
shr edx, 2
cmp ebx, eax
cmova edx, ecx
test edx, edx
je 0x100b5196
mov eax, dword [esi + 0x88]
mov ecx, eax
shl ecx, 5
add ecx, dword [esi + 0x84]
inc eax
mov dword [esi + 0x88], eax
mov eax, dword [ebx]
lea ebx, [ebx + 4]
mov dword [ecx + 8], eax
mov eax, dword [edi]
xor eax, dword [ecx]
and eax, 1
xor dword [ecx], eax
mov al, byte [edi + 0x10]
mov byte [ecx + 0x10], al
mov al, byte [edi + 0x11]
mov byte [ecx + 0x11], al
mov eax, dword [edi]
xor eax, dword [ecx]
and eax, 0x10
xor dword [ecx], eax
inc ebp
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
cmp ebp, edx
jb 0x100b514d
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011720d
add esp, 0x198
ret 0xc
Function at 0x100d5a39
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
cmp dword [ebp + 0x10], 0
je 0x100d5a5b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001b6c0
jmp 0x100d5a69
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10018440
mov esi, eax
cmp esi, 0xfffffbb2
je 0x100d5a8b
cmp esi, 0xfffffbad
je 0x100d5a8b
cmp esi, 0xfffffbaf
je 0x100d5a8b
cmp esi, 0xfffffbae
jne 0x100d5a99
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
cmp eax, 0x2710
jb 0x100d5a45
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x10
Function at 0x100de7c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x40
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x48]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x5c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ecx
mov eax, dword [edi + 0x64]
lea esi, [edi + 0x58]
mov ebx, dword [edi + 0x60]
mov dword [esp + 0x1c], eax
movsx eax, word [edi + 0x68]
imul ebp, eax, 0x14
mov eax, dword [edi]
mov eax, dword [eax]
add ebp, ebx
cmp dword [esi], 0
mov dword [esp + 0x34], eax
jne 0x100de82d
push esi
push 1
mov eax, 0x1000
push eax
push ecx
call fcn.100c9f55
test eax, eax
js 0x100de953
mov ecx, dword [esp + 0x28]
mov eax, 0x1000
mov word [edi + 0x5c], ax
movsx eax, word [edi + 0x5c]
mov esi, dword [esi]
add eax, esi
mov dword [esp + 0x2c], eax
jmp 0x100de949
and dword [esp + 0x10], 0
lea eax, [esp + 0x38]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], esi
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x14
push eax
lea eax, [esp + 0x30]
add esi, 4
push eax
push ebx
push ecx
push dword [esp + 0x6c]
call fcn.100abd02
test eax, eax
js 0x100de953
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov eax, dword [esp + 0x2c]
sub eax, esi
cmp dword [esp + 0x14], eax
ja 0x100de968
push dword [esp + 0x14]
push dword [esp + 0x28]
push esi
call fcn.101175c0
add esp, 0xc
cmp dword [esp + 0x10], 0
je 0x100de8bc
push dword [esp + 0x10]
call fcn.10116a00
mov ecx, dword [esp + 0x1c]
movsx eax, word [esp + 0x20]
push eax
movzx eax, word [ecx + 4]
push eax
movzx eax, word [ecx]
push eax
push dword [ebx + 4]
mov eax, dword [esp + 0x3c]
sub eax, esi
push eax
push dword [esp + 0x2c]
push esi
push dword [esp + 0x70]
call fcn.100dd420
test eax, eax
js 0x100de953
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push esi
movzx eax, word [edx + 4]
movzx ecx, word [edx]
push eax
movsx eax, word [edx + 2]
push eax
push ecx
movsx eax, cx
push eax
push dword [ebx + 4]
call fcn.100dccd2
push eax
mov eax, dword [esp + 0x48]
movzx eax, word [eax]
push eax
push dword [edi + 4]
push dword [esp + 0x54]
push dword [esp + 0x78]
call fcn.100dcceb
test eax, eax
js 0x100de953
mov eax, dword [esp + 0x18]
cmp dword [eax], 0xffffffff
je 0x100de936
add esi, dword [eax]
mov eax, dword [esp + 0x30]
add ebx, 0x14
add dword [esp + 0x1c], 6
mov ecx, dword [esp + 0x28]
inc word [eax]
cmp ebx, ebp
jb 0x100de83e
xor eax, eax
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011720d
add esp, 0x40
ret 0x10
cmp dword [esp + 0x10], 0
je 0x100de978
push dword [esp + 0x10]
call fcn.10116a00
mov eax, 0xfffff401
jmp 0x100de953
Function at 0x100dfe0f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
movzx eax, ax
sub eax, 0
je 0x100dfe61
push esi
dec eax
je 0x100dfe38
dec eax
je 0x100dfe34
dec eax
je 0x100dfe2d
mov esi, dword [0x1017b2a8]
jmp 0x100dfe48
mov esi, 0x96
jmp 0x100dfe3b
push 0x64
jmp 0x100dfe3a
push 0x32
pop esi
cmp dword [0x1017b2a8], esi
cmovb esi, dword [0x1017b2a8]
push edi
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
test esi, esi
je 0x100dfe5f
call sub.KERNEL32.dll_GetTickCount
sub eax, edi
cmp eax, esi
jb 0x100dfe54
pop edi
pop esi
ret 4
Function at 0x100f61fe
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
and dword [esp + 4], 0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
or ebp, 0xffffffff
mov dword [esp + 0x14], ebp
mov eax, dword [esi + 0xf0]
mov ebx, dword [esi + 0xec]
test eax, eax
je 0x100f635b
imul eax, eax, 0x34
push edi
add eax, ebx
cmp ebx, eax
jae 0x100f625c
sub eax, ebx
lea edi, [ebx + 0x30]
push 0x34
xor edx, edx
dec eax
pop ebp
div ebp
push 0x3f
inc eax
pop edx
mov cx, word [edi]
xor cx, word [esi + 0xdc]
and cx, dx
xor word [edi], cx
add edi, ebp
dec eax
jne 0x100f6243
mov ebp, dword [esp + 0x18]
mov eax, dword [esi + 0xdc]
test eax, eax
je 0x100f635a
mov ecx, dword [esi + 0xd8]
xor edi, edi
and dword [esp + 0x10], edi
imul eax, eax, 0x34
add eax, ecx
mov dword [esp + 0x1c], eax
cmp ecx, eax
jae 0x100f6348
mov eax, dword [ecx + 4]
mov dl, byte [eax + 4]
cmp dl, 0xa
jne 0x100f6364
cmp byte [eax + 5], 0
jne 0x100f62a7
mov esi, dword [eax + 8]
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x28]
cmp dl, 0xa
jne 0x100f6364
cmp byte [eax + 5], 0
jne 0x100f6364
mov eax, dword [esp + 0x14]
cmp byte [eax + 9], 3
jne 0x100f6364
imul edx, dword [eax + 4], 0x34
add edx, ebx
inc edi
mov dword [esp + 0x18], edi
movzx edi, word [edx + 0x30]
mov eax, edi
shl eax, 0xa
cwde
sar eax, 0xa
cmp eax, dword [esi + 0xdc]
jne 0x100f6333
mov eax, edi
xor eax, dword [esp + 0x10]
and eax, 0x3f
xor eax, edi
mov word [edx + 0x30], ax
mov eax, dword [ecx + 0x28]
and eax, 0x80
or dword [edx + 0x28], eax
cmp byte [edx + 0x2e], 1
jne 0x100f6322
test byte [ecx + 0x28], 0x80
je 0x100f6322
cmp word [esi + 0xbc], 6
jne 0x100f6322
or dword [esi + 0xb4], 0x80
cmp ebp, 0xffffffff
je 0x100f632f
movsx eax, byte [edx + 0x2e]
cmp eax, ebp
jg 0x100f637a
movsx ebp, byte [edx + 0x2e]
mov edi, dword [esp + 0x18]
add ecx, 0x34
inc dword [esp + 0x10]
cmp ecx, dword [esp + 0x1c]
jb 0x100f6287
cmp edi, dword [esi + 0xdc]
jne 0x100f635a
or dword [esi + 0xb4], 0x400
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
test byte [esi + 0xb4], 0x20
je 0x100f635a
test dword [ecx + 0x28], 0x1000
jne 0x100f637a
xor ebp, ebp
jmp 0x100f6337
push 0
push 0
push 0xffffe071
push dword [ecx + 4]
push dword [esi + 0x80]
mov esi, dword [esp + 0x38]
push esi
call fcn.10095bef
push 0xfffff439
push dword [esi + 0x18]
call fcn.1011a990
int3
Function at 0x10113850
Capabilities:
Delete file

Disassembly:
sub esp, 0x218
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x10137de8], 0
mov eax, dword [esp + 0x21c]
je 0x10113892
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1011720d
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.101134d0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x101138e0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x101138e0
cmp dword [esp + 4], 0xffffffff
je 0x101138e0
push eax
call fcn.1011741a
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1011720d
add esp, 0x218
ret 4

Function at 0x10113a10
Capabilities:
Get hostname

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x10137de8], 0
mov eax, dword [esp + 0x220]
push edi
mov edi, dword [esp + 0x228]
je 0x10113a5c
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
pop edi
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1011720d
add esp, 0x21c
ret 8
push esi
push dword [edi]
lea ecx, [esp + 0xc]
push eax
call fcn.101132c0
push edi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [esp + 8]
mov esi, eax
call fcn.10113460
test eax, eax
jle 0x10113a84
dec eax
lea ecx, [esp + 8]
mov dword [edi], eax
call fcn.10113460
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
cmp ecx, eax
je 0x10113ab4
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10113ab4
cmp dword [esp + 8], 0xffffffff
je 0x10113ab4
push ecx
call fcn.1011741a
add esp, 4
mov ecx, dword [esp + 0x220]
mov eax, esi
pop esi
pop edi
xor ecx, esp
call fcn.1011720d
add esp, 0x21c
ret 8

Function at 0x10113ad0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x218
mov eax, dword [0x1013567c]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x10137de8], 0
mov eax, dword [esp + 0x21c]
je 0x10113b12
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1011720d
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.101134d0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x10113b60
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10113b60
cmp dword [esp + 4], 0xffffffff
je 0x10113b60
push eax
call fcn.1011741a
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1011720d
add esp, 0x218
ret 4