joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f6c
Capabilities:
Parse pe header

Disassembly:
push 8
push 0x42d390
call fcn.00415cb0
mov esi, ecx
and dword [ebp - 4], 0
lea edi, [esi + 0x28]
push dword [ebp + 0xc]
push 0x40
push 0
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x4060fe
or dword [ebp - 4], 0xffffffff
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x4060ed
cmp dword [esi + 0x64], 0
je 0x4060ed
mov dword [ebp - 4], 1
lea edi, [esi + 0x68]
push dword [ebp + 0xc]
push pe_nt_image_headers32
push dword [esi + 0x64]
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x4060fe
or dword [ebp - 4], 0xffffffff
cmp dword [edi], 0x4550
jne 0x4060ed
mov eax, 0x10b
cmp word [esi + 0x80], ax
jne 0x4060ed
movzx eax, word [esi + 0x6e]
test ax, ax
je 0x4060ed
mov edi, eax
imul edi, edi, 0x28
movzx ecx, word [esi + 0x7c]
mov ebx, dword [esi + 0x64]
add ecx, 0x18
add ebx, ecx
mov eax, dword [0x4300fc]
mov ecx, 0x131
cmp eax, ecx
cmove eax, ecx
mov dword [0x4300fc], eax
test eax, eax
jne 0x40603b
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4300fc]
shl eax, 0x1a
or eax, 1
mov dword [0x4300fc], eax
push edi
call fcn.0041804d
pop ecx
mov dword [esi + 0x160], eax
test eax, eax
jne 0x40605e
push 8
jmp 0x406104
mov dword [ebp - 4], 2
push dword [ebp + 0xc]
push edi
push ebx
push eax
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x4060fe
or dword [ebp - 4], 0xffffffff
mov edx, dword [0x4300fc]
mov eax, 0x2b4
cmp edx, eax
cmove edx, eax
shl edx, 0x17
or edx, 1
mov dword [0x4300fc], edx
mov ecx, dword [0x4300f8]
mov eax, ecx
not eax
and eax, 0x3b9
neg eax
sbb eax, eax
and eax, 0x80000000
add eax, 0x80000000
shr ecx, 1
or ecx, eax
mov dword [0x4300f8], ecx
test edx, edx
jne 0x4060d1
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x4300fc]
or edx, 0x198
mov dword [0x4300fc], edx
lea eax, [ebx + edi]
mov dword [esi + 0x10], eax
xor eax, eax
jmp 0x406105
push 0xb
jmp 0x406104
or dword [ebp - 4], 0xffffffff
push 0x1e
pop eax
call fcn.00415ceb
ret 8
Function at 0x4085ba
Capabilities:
Hash data with crc32

Disassembly:
mov edi, edi
push ebx
push ebp
push esi
mov esi, dword [0x430104]
or esi, 1
push edi
mov dword [0x430104], esi
jne 0x408606
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x2bd
mov eax, 0x42533c
push eax
push eax
push 0
call edi
mov esi, dword [0x430104]
test esi, esi
jne 0x408606
push 0xdf
mov eax, 0x427058
push eax
push eax
push esi
call edi
mov esi, dword [0x430104]
mov eax, dword [0x430100]
mov ecx, eax
lea edx, [eax + eax]
not ecx
mov edi, 0x3b9
and ecx, edi
neg ecx
sbb ecx, ecx
neg ecx
or edx, ecx
mov eax, edx
not eax
and eax, edi
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
shl esi, 0x16
or esi, 0x7d21
neg eax
sbb eax, eax
neg eax
add edx, edx
or edx, eax
mov eax, edx
not eax
and eax, edi
mov edi, dword [esp + 0x18]
neg eax
sbb eax, eax
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
mov dword [0x430104], esi
mov dword [0x430100], edx
not ebx
jmp 0x4086a7
movzx eax, byte [ebp]
movzx ecx, bl
xor ecx, eax
push 8
dec edi
inc ebp
pop eax
test cl, 1
je 0x40868a
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x40868c
shr ecx, 1
dec eax
test eax, eax
jg 0x40867b
shr ebx, 8
xor ebx, ecx
test esi, esi
jne 0x4086a7
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x430104]
test edi, edi
jne 0x40866d
pop edi
pop esi
not ebx
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x40a9a8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
shr ecx, 2
shr edi, 2
lea ebx, [eax + ecx*4]
mov ebp, 0xc0c0c0c0
test ecx, ecx
je 0x40a9d9
add esi, 0xb16b00b0
xor esi, ebp
dec ecx
jne 0x40a9ce
test edi, edi
je 0x40aa51
mov ecx, dword [0x4301a0]
mov edx, 0x80000000
xor dword [ebx], esi
mov eax, ecx
not eax
and eax, 0x3b9
dec edi
neg eax
sbb eax, eax
and eax, edx
add eax, edx
shr ecx, 1
or ecx, eax
mov eax, ecx
not eax
and eax, 0x3b9
neg eax
sbb eax, eax
and eax, edx
add eax, edx
shr ecx, 1
or ecx, eax
mov eax, dword [0x4301a4]
shl eax, 0x1a
or eax, 0x3c0001ff
lea ebx, [ebx + 4]
mov dword [0x4301a0], ecx
mov dword [0x4301a4], eax
jne 0x40aa45
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x4301a0]
mov edx, 0x80000000
add esi, 0xb16b00b0
xor esi, ebp
test edi, edi
jne 0x40a9e8
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40e8b5
Capabilities:
Get common file path

Disassembly:
push 0x318
push 0x42ddf0
call fcn.00415cb0
or dword [ebp - 0x1c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.0040d12a
pop ecx
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
jmp 0x40e8ec
cmp byte [0x4337b0], 0
je 0x40eaf0
mov eax, dword [0x4301c4]
inc eax
push 0x39
pop ecx
cmove eax, ecx
or eax, 0x325
mov dword [0x4301c4], eax
mov byte [ebp - 0x328], bl
push 0x103
push ebx
lea eax, [ebp - 0x327]
push eax
call fcn.00415370
add esp, 0xc
mov ecx, dword [0x4316a8]
lea eax, [ecx + 0x88]
push eax
xor edi, edi
inc edi
push edi
call fcn.0040fb3c
cmp dword [eax], ebx
je 0x40e99b
mov ecx, dword [0x4316a8]
lea eax, [ecx + 0x3b0]
push eax
push edi
call fcn.0040fb3c
cmp dword [eax], ebx
je 0x40e975
mov ecx, dword [0x4316a8]
lea eax, [ecx + 0x3b0]
push eax
push edi
call fcn.0040fb3c
push ebx
call dword [eax]
mov esi, eax
jmp 0x40e977
mov esi, ebx
mov ecx, dword [0x4316a8]
lea eax, [ecx + 0x88]
push eax
push edi
call fcn.0040fb3c
push 0x104
lea ecx, [ebp - 0x328]
push ecx
push esi
call dword [eax]
jmp 0x40e99d
mov eax, ebx
test eax, eax
je 0x40eaf0
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea eax, [ebp - 0x11f]
push eax
call fcn.00415370
add esp, 0xc
mov edx, dword [0x4301c4]
inc edx
mov eax, 0x2a9
cmove edx, eax
mov dword [0x4301c4], edx
mov ecx, dword [0x4301c0]
mov eax, ecx
not eax
mov edi, 0x3b9
and eax, edi
neg eax
sbb eax, eax
mov esi, 0x80000000
and eax, esi
add eax, esi
shr ecx, 1
or ecx, eax
mov dword [0x4301c0], ecx
test edx, edx
jne 0x40ea20
push 0x2ee
mov eax, 0x4318e4
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0x4301c4]
mov ecx, dword [0x4301c0]
mov eax, ecx
not eax
and eax, edi
neg eax
sbb eax, eax
and eax, esi
add eax, esi
shr ecx, 1
or ecx, eax
mov eax, ecx
not eax
and eax, edi
neg eax
sbb eax, eax
and eax, esi
add eax, esi
shr ecx, 1
or ecx, eax
mov eax, ecx
not eax
and eax, edi
neg eax
sbb eax, eax
and eax, esi
add eax, esi
shr ecx, 1
or ecx, eax
mov dword [0x4301c0], ecx
shl edx, 0x1c
or edx, 0x33f
inc edx
mov eax, 0x340
cmove edx, eax
or edx, 0x306
mov dword [0x4301c4], edx
mov byte [ebp - 0x224], bl
push 0x103
push ebx
lea eax, [ebp - 0x223]
push eax
call fcn.00415370
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40eaf0
cmp eax, 0xf2
ja 0x40eaf0
lea eax, [ebp - 0x224]
push eax
push ebx
push 0x4318e8
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40eaf0
push 0x4318ec
lea eax, [ebp - 0x224]
push eax
call fcn.00418580
lea eax, [ebp - 0x328]
push eax
call fcn.0040c899
add esp, 0xc
mov eax, dword [ebp - 0x1c]
call fcn.00415ceb
ret
Function at 0x40ef24
Capabilities:
Terminate process

Disassembly:
mov eax, 0x423621
call fcn.00415c8c
push ebp
push esi
mov esi, dword [0x4301c4]
xor ebp, ebp
push edi
test esi, esi
jne 0x40ef82
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4301c4]
test esi, esi
jne 0x40ef82
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x37e
mov eax, 0x427278
push eax
push eax
push ebp
call edi
mov esi, dword [0x4301c4]
test esi, esi
jne 0x40ef82
push 0x129
mov eax, 0x42727c
push eax
push eax
push ebp
call edi
mov esi, dword [0x4301c4]
mov ecx, dword [0x4301c0]
mov eax, ecx
not eax
push ebx
mov ebx, 0x3b9
and eax, ebx
neg eax
sbb eax, eax
shr ecx, 1
mov edi, 0x80000000
and eax, edi
add eax, edi
or ecx, eax
inc esi
mov eax, 0x2a9
cmove esi, eax
inc esi
lea eax, [ebx - 0x17]
cmove esi, eax
mov eax, ecx
not eax
and eax, ebx
neg eax
sbb eax, eax
neg eax
lea edx, [ecx + ecx]
or edx, eax
mov eax, edx
not eax
and eax, ebx
neg eax
sbb eax, eax
and eax, edi
add eax, edi
shr edx, 1
or edx, eax
inc esi
mov eax, 0xcd
cmove esi, eax
mov eax, edx
not eax
and eax, ebx
neg eax
sbb eax, eax
and eax, edi
add eax, edi
shr edx, 1
or edx, eax
mov ecx, edx
not ecx
and ecx, ebx
neg ecx
sbb ecx, ecx
or esi, 0x1b1
neg ecx
lea eax, [edx + edx]
mov dword [0x4301c4], esi
or eax, ecx
mov esi, 0x40c39e
push esi
mov dword [0x4301c0], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00418005
push 1
push 0xffffffffffffffff
push dword [esp + 0x30]
call fcn.00406e8f
push 0x484
call fcn.004015ab
add esp, 0x14
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ebp
pop ebx
test eax, eax
je 0x40f06c
push ebp
push 0x2000003
mov ecx, eax
call fcn.004013c0
jmp 0x40f06e
mov eax, ebp
or dword [esp + 0x14], 0xffffffff
mov dword [0x4316a8], eax
test eax, eax
jne 0x40f091
or eax, 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
leave
ret 0x10
push 0x427280
push dword [0x4316a4]
call fcn.00418670
pop ecx
pop ecx
test eax, eax
je 0x40f0ac
push 0xfffffffffffffffe
pop eax
jmp 0x40f07f
push dword [esp + 0x28]
call fcn.0040e8b5
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x410833
Capabilities:
Check for vm using instruction vpcext
Reference the vmware io port

Disassembly:
push 0xc
push 0x42e590
call fcn.00415cb0
mov dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
xor ebx, ebx
mov ecx, 0x14
mov edx, 0x5658
in eax, dx
cmp eax, 0x20
jl 0x410873
cmp eax, 0x4000
jg 0x410873
mov eax, 1
or dword [ebp - 0x1c], eax
pop ebx
pop ecx
pop edx
jmp 0x41087f
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 1
push ebx
xor eax, eax
xor ebx, ebx
inc eax
invalid
Function at 0x4112d8
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push esi
mov esi, dword [0x4337dc]
jmp 0x411321
cmp dword [esi + 0x14], 0x10
jb 0x4112ed
mov eax, dword [esi]
jmp 0x4112ef
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [0x4301f8]
mov ecx, eax
not ecx
and ecx, 0x3b9
neg ecx
sbb ecx, ecx
or dword [0x4301fc], 0x397
neg ecx
add eax, eax
or eax, ecx
mov dword [0x4301f8], eax
add esi, 0x18
cmp esi, dword [0x4337e0]
jne 0x4112e3
pop esi
ret
Function at 0x413fde
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x422fbe
call fcn.00415c8c
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0x10
jb 0x413ffa
mov eax, dword [esi]
jmp 0x413ffc
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x414097
push dword [0x430228]
cmp dword [0x43022c], 0x10
mov eax, 0x430218
cmovae eax, dword [0x430218]
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.00412d36
mov edi, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x41406e
push ebx
push eax
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00406e50
and dword [ebp - 4], 0
push edi
push eax
call fcn.00413fde
mov bl, al
pop ecx
neg bl
pop ecx
sbb bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00401530
inc bl
pop ebx
je 0x41406e
xor al, al
jmp 0x4140a6
cmp dword [esi + 0x14], 0x10
jb 0x414078
mov eax, dword [esi]
jmp 0x41407a
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41406a
push esi
mov ecx, 0x4337c8
call fcn.00414136
mov byte [edi], 0
jmp 0x4140a4
test eax, 0x410
je 0x41406a
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x41419b
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x423ccc
call fcn.00415c8c
mov eax, 0x1038
call fcn.00418520
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x1050], ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push dword [esp + 0x1070]
mov dword [esp + 0x2c], ebx
push dword [esp + 0x1070]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [esp + 0x105c]
push 0xf
pop edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov dword [esp + 0x1050], ebx
xor ebp, ebp
inc ebp
mov dword [esp + 0x1c], ebp
test eax, eax
jne 0x4142e3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push dword [esp + 0x1078]
mov dword [esp + 0x24], 0x1000
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x44], bl
test eax, eax
jne 0x414290
mov eax, dword [esp + 0x18]
dec eax
cmp eax, 2
ja 0x4142f9
push ecx
lea eax, [esp + 0x48]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004022e2
mov dword [esp + 0x1050], ebp
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00411237
mov byte [esp + 0x1050], bl
lea ecx, [esp + 0x20]
call fcn.00401530
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4301fc]
mov edx, dword [0x4301f8]
mov ecx, 0xd1
cmp eax, ecx
cmove eax, ecx
inc eax
mov ecx, 0x1ee
cmove eax, ecx
mov ecx, edx
not ecx
and ecx, 0x3b9
or eax, 0x3cd
neg ecx
sbb ecx, ecx
mov dword [0x4301fc], eax
mov eax, 0x80000000
and ecx, eax
add ecx, eax
shr edx, 1
or edx, ecx
mov dword [0x4301f8], edx
mov ecx, dword [esp + 0x1048]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret
lea ecx, [esp + 0x38]
call fcn.00415b37
push 0x42df5c
lea eax, [esp + 0x3c]
push eax
call fcn.00415c2e
int3

Function at 0x4143a0
Capabilities:
Delete directory

Disassembly:
mov eax, 0x422fbe
call fcn.00415c8c
sub esp, 0x18
cmp dword [0x4337d8], 0
je 0x4143ff
push esi
mov esi, 0x4337c8
mov ecx, esi
call fcn.0041126f
push eax
lea ecx, [ebp - 0x24]
call fcn.0040b325
and dword [ebp - 4], 0
mov ecx, esi
call fcn.004140b4
cmp dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00401530
cmp dword [0x4337d8], 0
jne 0x4143bc
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x420b47
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4305f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [fcn.004148be]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00418e37
mov dword [ebp - 0x14], eax
cmp dword [0x434650], edi
jne 0x420c38
push 0x800
push edi
push 0x429580
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x420bc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x420d18
push 0x429580
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x420d18
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420d18
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x434650], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x434654], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x434658], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x434660], eax
test eax, eax
je 0x420c35
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43465c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x420c5d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x420c50
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x420c72
push 4
pop eax
jmp 0x420d1a
cmp dword [ebp - 0x14], edi
je 0x420c72
push dword [0x434650]
call dword [fcn.004148c2]
push 3
jmp 0x420c57
mov eax, dword [0x43465c]
mov ebx, dword [fcn.004148c2]
cmp eax, esi
je 0x420cd0
cmp dword [0x434660], esi
je 0x420cd0
push eax
call ebx
push dword [0x434660]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x420cd0
test eax, eax
je 0x420cd0
call ecx
test eax, eax
je 0x420cc5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x420cc5
test byte [ebp - 8], 1
jne 0x420cd0
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x420d00
mov eax, dword [0x434654]
cmp eax, esi
je 0x420cfd
push eax
call ebx
test eax, eax
je 0x420cfd
call eax
mov edi, eax
test edi, edi
je 0x420cfd
mov eax, dword [0x434658]
cmp eax, esi
je 0x420cfd
push eax
call ebx
test eax, eax
je 0x420cfd
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x434650]
call ebx
test eax, eax
je 0x420d18
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x420d1a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418bac
leave
ret
Function at 0x10002260
Capabilities:
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001bb98
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10024080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x48]
call fcn.10002170
xor ebx, ebx
mov dword [ebp - 4], ebx
push str.hardwarelog.lock
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.10002c70
add esp, 0xc
mov byte [ebp - 4], 1
mov edi, 8
cmp dword [eax + 0x14], edi
jb 0x100022bd
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], edi
jb 0x100022da
mov edx, dword [ebp - 0x2c]
push edx
call fcn.100085f3
add esp, 4
xor eax, eax
xor ecx, ecx
cmp esi, 0xffffffff
setne cl
push str.hardinfo.log
lea edx, [ebp - 0x48]
mov word [ebp - 0x2c], ax
push edx
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov dword [0x100253e4], ecx
call fcn.10002c70
add esp, 0xc
mov byte [ebp - 4], 2
mov edi, eax
mov esi, 0x100253c8
call fcn.100026f0
mov byte [ebp - 4], bl
mov esi, 8
cmp dword [ebp - 0x18], esi
jb 0x10002336
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.100085f3
add esp, 4
mov eax, dword [0x100253c8]
xor edx, edx
mov edi, 7
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], dx
cmp dword [0x100253dc], esi
jae 0x10002359
mov eax, 0x100253c8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], esi
jb 0x10002378
mov eax, dword [ebp - 0x48]
push eax
call fcn.100085f3
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], cx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10008214
mov esp, ebp
pop ebp
ret
Function at 0x10005940
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001bb52
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x10024080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
push 0x110
lea eax, [ebp - 0x120]
mov esi, ecx
push edi
push eax
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x128], edi
call fcn.10010d40
add esp, 0xc
lea ecx, [ebp - 0x124]
push ecx
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x120]
push edx
push eax
push 0x100203b8
call sym.HardwareLib.dll_DebugStringW
add esp, 0xc
cmp dword [0x100267b4], edi
jne 0x100059f0
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x10005a12
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100267b4], eax
cmp eax, edi
je 0x10005a12
lea ecx, [ebp - 0x12c]
push ecx
mov dword [ebp - 0x12c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x100267b4]
cmp dword [ebp - 0x12c], edi
jne 0x10005a2f
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
push 0x17
mov eax, str.driversMonitor_x86.sys
mov word [esi], dx
call fcn.10002860
jmp 0x10005a61
cmp dword [ebp - 0x120], 0xa
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
jb 0x10005a50
xor eax, eax
mov word [esi], ax
push 0x1d
mov eax, str.driversMonitor_win10_x64.sys
jmp 0x10005a5c
xor ecx, ecx
mov word [esi], cx
push 0x1c
mov eax, str.driversMonitor_win7_x64.sys
call fcn.10002860
mov dword [ebp - 4], edi
mov dword [ebp - 0x128], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10008214
mov esp, ebp
pop ebp
ret
Function at 0x10005ff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov edx, dword [esi + 0x128]
sub edx, dword [esi + 0x124]
xor eax, eax
xor ecx, ecx
sar edx, 2
mov word [ebp - 8], 0x5050
mov byte [ebp - 6], 0x27
mov word [ebp - 4], 0x201
mov byte [ebp - 2], al
mov dword [ebp - 0xc], ecx
test edx, edx
je 0x100060e1
push ebx
push edi
jmp 0x10006033
mov ecx, dword [ebp - 0xc]
movzx ebx, byte [ebp + ecx - 8]
movzx ecx, byte [ebp + ecx - 4]
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
push ebx
push ecx
mov ecx, esi
call edx
mov ecx, dword [ebp - 0xc]
movzx edi, al
movzx eax, byte [ebp + ecx - 4]
add edi, edi
mov dword [ebp - 0x10], edi
test al, al
je 0x1000607a
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
inc bl
movzx ecx, bl
push ecx
push eax
mov ecx, esi
call edx
mov ecx, dword [ebp - 0xc]
movzx eax, al
shr eax, 7
or edi, eax
mov dword [ebp - 0x10], edi
fild dword [ebp - 0x10]
fmul qword [0x10020fd0]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fcom qword [0x10020fc8]
fnstsw ax
test ah, 0x41
jp 0x100060af
fcom qword [0x10020fc0]
fnstsw ax
test ah, 1
jne 0x100060af
mov edx, dword [esi + 0x124]
cmp dword [edx + ecx*4], 0
je 0x100060d5
mov eax, dword [esi + 0x128]
fstp st(0)
sub eax, dword [esi + 0x124]
inc ecx
sar eax, 2
mov dword [ebp - 0xc], ecx
cmp ecx, eax
jb 0x10006030
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1001a170
cdq
xor eax, edx
pop edi
sub eax, edx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10006360
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
xor ebx, ebx
mov dword [ebp - 4], edi
cmp dword [esi + 0x124], ebx
jle 0x10006462
mov edi, edi
cmp edi, 0x14
jle 0x1000638e
cmp edi, 0x64
jl 0x10006462
cmp dword [esi + 0x120], 0x507
mov eax, dword [esi]
jne 0x10006434
mov edx, dword [eax + 8]
push 0x69
mov ecx, esi
call edx
lea ecx, [ebx + 0x38]
add cl, cl
movzx edx, cl
and eax, 3
mov dword [ebp - 8], eax
mov eax, dword [esi]
mov eax, dword [eax + 8]
push edx
mov ecx, esi
call eax
mov edx, dword [esi]
mov edx, dword [edx + 8]
movzx edi, al
mov al, bl
add al, al
add al, 0x71
movzx ecx, al
push ecx
mov ecx, esi
call edx
movzx ecx, al
cmp edi, 0xbb
je 0x10006452
cmp edi, 0xcc
je 0x10006452
mov eax, dword [ebp - 8]
cmp eax, 2
jne 0x100063fe
mov eax, edi
and eax, 0x80
shl eax, 8
jmp 0x1000640f
cmp eax, 3
jne 0x1000640d
mov eax, ecx
and eax, 1
shl eax, 0xf
jmp 0x1000640f
xor eax, eax
shl edi, 7
or edi, eax
shr ecx, 1
and edi, 0xfff0
and ecx, 0x70
or edi, ecx
mov dword [ebp - 8], edi
fild dword [ebp - 8]
fmul qword [0x10020fb8]
call fcn.1001a170
jmp 0x1000644f
mov eax, dword [eax + 8]
lea ecx, [ebx + 0x39]
add cl, cl
movzx edx, cl
push edx
mov ecx, esi
call eax
movzx eax, al
lea ecx, [eax - 1]
cmp ecx, 0x62
ja 0x10006455
mov dword [ebp - 4], eax
mov edi, dword [ebp - 4]
inc ebx
cmp ebx, dword [esi + 0x124]
jl 0x10006380
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret