joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004540
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
xor al, al
push esi
mov esi, ecx
mov byte [ebp - 1], al
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10004554
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10004575
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
xor ecx, ecx
lea edi, [esi + 1]
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100170de
add esp, 4
mov ebx, eax
test edi, edi
je 0x100045ad
mov ecx, edi
xor eax, eax
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edi, [esi + 1]
push dword [ebp + 8]
push edi
push ebx
call fcn.1003271f
add esp, 0xc
xor edi, edi
nop dword [eax]
movzx eax, word [ebx + edi*2]
cmp eax, 0x5c
je 0x100045ce
cmp eax, 0x2f
jne 0x1000460f
mov dword [ebp - 0xc], eax
xor eax, eax
push ebx
mov word [ebx + edi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10004608
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10004627
mov eax, dword [ebp + 0xc]
mov byte [ebp - 1], 1
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x10004608
mov dword [ebp - 8], ebx
lea edx, [ebp - 8]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov eax, dword [ebp - 0xc]
mov word [ebx + edi*2], ax
inc edi
cmp edi, esi
jbe 0x100045c0
push ebx
call fcn.100170e7
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov byte [ebp - 1], 0
call fcn.100170e7
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004740
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1006e098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.1002e2b0
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
add esp, 0xc
or ecx, 0x8000
cmp byte [ebp + 0x10], 0
cmove ecx, dword [ebp + 0xc]
push eax
push 0
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
test eax, eax
je 0x100047c0
xor eax, eax
mov word [esi], ax
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100170cd
mov esp, ebp
pop ebp
ret
xor eax, eax
lea ecx, [ebp - 0x20c]
mov word [esi], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100047d0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10002b10
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100170cd
mov esp, ebp
pop ebp
ret
Function at 0x10004cd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1006e098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10004d5c
push 0x228
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.1002e2b0
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10004d5c
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10004d55
nop dword [eax]
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.1003942a
add esp, 8
test eax, eax
je 0x10004d6e
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10004d30
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100170cd
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
xor ecx, ebp
pop edi
pop esi
call fcn.100170cd
mov esp, ebp
pop ebp
ret
Function at 0x10006910
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10050a28
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1006e098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x50], eax
test edi, edi
jne 0x10006957
xor al, al
jmp 0x10006a7b
cmp dword [ecx + 0x14], 0
lea esi, [ecx + 4]
ja 0x100069a7
lea eax, [ebp - 0x40]
push eax
call fcn.10004ac0
mov edi, eax
add esp, 4
cmp esi, edi
je 0x1000699c
mov ecx, esi
call fcn.100027d0
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea ecx, [ebp - 0x40]
call fcn.100027d0
mov edi, dword [ebp - 0x48]
push esi
lea ecx, [ebp - 0x28]
call fcn.10002e10
push 0xa
push str.Software_
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.10002650
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100069d0
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.10002650
mov esi, dword [ebp - 0x4c]
test esi, esi
je 0x10006a1d
push 1
push 0x100566bc
lea ecx, [ebp - 0x28]
call fcn.10002650
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006a04
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10002650
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x44]
push ecx
push 0xf003f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x44], 0
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006a71
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x10006a5d
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10006a68
push 0
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.100027d0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100170cd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006f00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1006e098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
cmp dword [edi + 0x14], 0
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
ja 0x10006f99
lea eax, [ebp - 0x1c]
push eax
call fcn.10004ac0
mov esi, eax
lea ebx, [edi + 4]
add esp, 4
cmp ebx, esi
je 0x10006f8e
mov ecx, ebx
call fcn.100027d0
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebx], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebx + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x1c]
call fcn.100027d0
mov ebx, dword [ebp - 0x30]
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
jb 0x10006fa4
mov eax, dword [eax]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x20]
push ecx
push 0xf013f
push 0
push eax
push 0x80000003
call esi
test eax, eax
jne 0x10006fe3
lea eax, [ebp - 0x24]
push eax
push 0xf013f
push 0
push str.SoftWare
push dword [ebp - 0x20]
call esi
test eax, eax
je 0x10006ff8
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100170cd
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x28]
push 0
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push ebx
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x10007040
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100170cd
mov esp, ebp
pop ebp
ret 0x10
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x28]
call esi
test eax, eax
je 0x10007089
push dword [ebp - 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100170cd
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp - 0x38]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007091
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x28]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100170cd
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10007f20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10050bd8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x1006e098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x70]
push eax
call fcn.10008380
mov ecx, eax
call fcn.10005d20
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp - 0x70]
mov ecx, esp
push eax
call fcn.10002e10
call fcn.10003b50
mov ecx, eax
add esp, 0x18
or ecx, edx
jne 0x10007fc5
lea eax, [ebp - 0x58]
push eax
call fcn.10008380
mov ecx, eax
call fcn.10005650
sub esp, 0x18
mov byte [ebp - 4], 1
lea eax, [ebp - 0x58]
mov ecx, esp
push eax
call fcn.10002e10
call fcn.10003b50
push 0xa
push edx
push eax
call fcn.10012450
add esp, 0x24
lea ecx, [ebp - 0x58]
test eax, eax
je 0x100080a2
mov byte [ebp - 4], 0
call fcn.100027d0
jmp 0x10007fe3
test edx, edx
jl 0x10007fe3
jg 0x10007fcf
test eax, eax
je 0x10007fe3
push 3
push edx
push eax
call fcn.100123e0
add esp, 0xc
test eax, eax
je 0x100080a7
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x74], esp
push 0
call fcn.1003961e
push edx
push eax
push esi
call fcn.100039c0
add esp, 0x10
mov byte [ebp - 4], 2
call fcn.10008380
mov ecx, eax
mov byte [ebp - 4], 0
call fcn.10006650
lea eax, [ebp - 0x28]
push eax
call fcn.10008380
mov ecx, eax
call fcn.100053b0
push 0xa
push 0x10056aa8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.10002650
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000809f
push 8
xor eax, eax
mov dword [ebp - 0x30], 0
push str.15067041
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.10002b10
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x40]
push 0
push ecx
push eax
mov byte [ebp - 4], 4
call fcn.100122f0
add esp, 0x14
lea ecx, [ebp - 0x40]
call fcn.100027d0
lea ecx, [ebp - 0x28]
call fcn.100027d0
mov edx, dword [ebp - 0x5c]
cmp edx, 8
jb 0x100080dd
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100080d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100080f7
push edx
push ecx
call fcn.10016b0e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100170cd
mov esp, ebp
pop ebp
ret
call fcn.100323d9
int3
Function at 0x1000d6d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10050f60
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1006e098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10016ea2
mov edi, eax
add esp, 4
test edi, edi
je 0x1000d77b
push 1
mov dword [ebp - 4], 0
call fcn.10015bc0
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100122f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1006e098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001232d
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100170cd
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.10012060
add esp, 8
mov dword [ebp - 0x50], 0
test ebx, ebx
mov dword [ebp - 0x20], 0
mov ecx, str.open
mov dword [ebp - 0x58], 0x3c
mov eax, str.runas
mov dword [ebp - 0x48], esi
cmove eax, ecx
mov dword [ebp - 0x54], 0x40
cmp dword [ebp - 8], 8
xorps xmm0, xmm0
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push eax
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x20]
mov esi, eax
test ecx, ecx
je 0x100123c2
cmp dword [ebp + 0x10], 0
je 0x100123c2
push dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x1c]
call fcn.100027d0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100170cd
mov esp, ebp
pop ebp
ret
Function at 0x10012b20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051a58
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x1006e098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x234], esi
mov edi, dword [0x10070548]
test edi, edi
jne 0x10012bec
push 0x1007054c
mov dword [ebp - 0x234], 0x1007054c
call fcn.10015271
add esp, 4
test eax, eax
je 0x10012b88
push eax
call fcn.10015525
add esp, 4
mov edi, dword [0x10070548]
mov dword [ebp - 4], 0
test edi, edi
jne 0x10012bc4
push 8
call fcn.10016ea2
add esp, 4
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10012bbc
mov ecx, eax
call fcn.10005190
mov edi, eax
jmp 0x10012bbe
xor edi, edi
mov dword [0x10070548], edi
push 0x1007054c
mov dword [ebp - 4], 2
call fcn.10015296
add esp, 4
test eax, eax
je 0x10012be5
push eax
call fcn.10015525
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.100053b0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x230]
push eax
mov dword [ebp - 4], 3
call edi
test eax, eax
jne 0x10012c82
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.1002e2b0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x1007070c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012c60
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.10002b10
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call edi
test eax, eax
jne 0x10012cb9
push eax
mov dword [esi + 0x10], eax
mov ecx, esi
mov dword [esi + 0x14], 7
push 0x100566b4
mov word [esi], ax
call fcn.10002b10
jmp 0x10012d32
lea eax, [ebp - 0x230]
push eax
call fcn.10003a50
add esp, 4
test eax, eax
jne 0x10012cde
push 1
push 0x100566bc
lea ecx, [ebp - 0x230]
call fcn.10002650
push 0xa
push str.xsSoft.exe
lea ecx, [ebp - 0x230]
call fcn.10002650
movups xmm0, xmmword [ebp - 0x230]
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov word [ebp - 0x230], ax
movq xmm0, qword [ebp - 0x220]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
lea ecx, [ebp - 0x230]
call fcn.100027d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100170cd
mov esp, ebp
pop ebp
ret 4
Function at 0x10018d96
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100441e8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10043eab

Function at 0x100441f3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004402c

Function at 0x1004955d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004921d
Function at 0x41da62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x41da71
pop dword [ebp - 0x44]
mov eax, 0x77d8933a
sub eax, 0x7796b8c9
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xa3d884de
sub dword [ebp - 0x54], 0x55863f93
mov dword [ebp - 0x50], 0x67e7a85
add dword [ebp - 0x50], 0x2bb4d1c0
mov dword [ebp - 0x4c], 0x82af6539
sub dword [ebp - 0x4c], 0x3663210b
mov dword [ebp - 0x48], 0x75c8865f
add dword [ebp - 0x48], 0x8a3779a1
lea eax, [ebp - 0x54]
push eax
mov eax, 0x497bdf89
sub eax, 0x49382d75
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xcbdb8ddd
sub dword [ebp - 0x54], 0x57692487
mov dword [ebp - 0x50], 0x10604863
add dword [ebp - 0x50], 0x310c1912
mov dword [ebp - 0x4c], 0xfc3f8239
sub dword [ebp - 0x4c], 0x98d015cd
mov dword [ebp - 0x48], 0x88450c30
add dword [ebp - 0x48], 0x77baf3d0
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x32b4930c
add eax, 0xcd8f1f64
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x4444e
push 0
call eax
mov ecx, 0xc51fd664
sub ecx, 0xc51f8e52
mov edi, eax
mov ebx, 0x464e00
add ebx, dword [ebp - 0x44]
mov esi, 0x88bf7383
sub esi, 0x74f58523
mov edx, dword [ebx]
sub dword [ebp - 8], 0xdd5fa308
sub edx, esi
xor dword [ebp - 0x1c], esi
mov dword [edi], edx
xor dword [ebp - 0x18], eax
add edi, 0x79ceb4f
sub edi, 0x79ceb4b
add ebx, 0x9194668
add ebx, 0xf6e6b99c
loop 0x41db8d
add eax, 0xde766e58
sub eax, 0xde755b3d
xor ebx, ebx
add ebx, eax
add eax, 0x90942fc4
add eax, 0x6f6bd041
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x101ed09
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x101ed44
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x101ed2b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x101ed3c
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x101ed46
inc edi
add eax, 0x28
cmp edi, esi
jb 0x101ed21
xor eax, eax
pop edi
pop esi
ret

Function at 0x101f065
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0101ecd9
push eax
push esi
push dword [ebp + 8]
call fcn.0101ec8e
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0101ecd9
push eax
push esi
push dword [ebp + 8]
jne 0x101f0e2
call fcn.0101ec8e
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x101f164
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0101ecd9
push eax
push esi
push dword [ebp + 8]
call fcn.0101ec8e
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0101ecc9
jl 0x101f10f
or ebx, esp
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0101ecc9
and dword [ecx], esp
push ebp
invalid