joyce8/EMBER2024-capa huggingface dataset:
Function at 0x196d946
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ebx
sar eax, 0x4b
lea ecx, [ecx + eax - 0x414a68c1]
not ecx
rol ecx, 3
mov dword [esp + edx - 0x5b], eax
bswap ecx
idiv dl
dec dword [esp + edx*8 - 0x2d8]
not ecx
shl edx, 0xd1
lea ecx, [ecx + edx*4 + 0x3d4224aa]
neg ecx
xor ebx, ecx
xchg word [esp + edx*2 - 0x16c0000], ax
imul dx, ax
and word [esp + edx - 0xb5fffe], ax
adc edi, ecx
and word [esp + edx - 0xb5ffff], dx
cwd
pop edx
jge fcn.0121e846

Function at 0x196e8ff
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
inc ebp
mov ebx, dword [ebx + ecx*2 - 0x16800]
pop ebx
jae fcn.019363ab
mov eax, ebp
mov edx, 0x430a9ead
call fcn.0192fbf9
movzx edx, al
lea esi, [edx + esi - 5]
lea edx, [eax + eax*4 + 0x7c80e718]
xor ecx, ebx
neg edx
not dword [esp + 7]
imul dword [esp + 8]
sbb ecx, 0xfd852c21
push edx
call fcn.0107180c
call fcn.018dd21c

Function at 0x196f193
Capabilities:
Authenticate hmac

Disassembly:
jmp edi
sal eax, 0xeb
bt ax, ax
xor edx, ebx
ror al, 0x21
lea ecx, [eax + eax*4 + 0x1fa631b7]
sub ecx, 0x6ab9e284
rol edx, 3
or cl, ah
neg ax
not edx
sar cl, 0x63
neg edx
sub edx, 0x982b300b
sub al, 0xac
or ax, ax
bswap edx
neg edx
bts eax, 0x92
xor ebx, edx
add edi, edx
mul eax
rol edx, cl
mov dx, word [ebp + eax - 0x79a99b90]
lea ecx, [eax + ecx + 0x90c170c]
movzx eax, byte [eax + esi - 0x79a99b95]
bt cx, 0x89
bt ecx, 0x18
lea esi, [esi + ecx*2 - 0x65e1a529]
xor al, bl
inc ecx
sub al, 0xad
bts cx, 0x94
xor al, 0x15
sar ecx, cl
jbe 0x191b046
inc cx
dec al
add cl, ch
bts ecx, ecx
shr cl, cl
ror al, 1
ror ecx, 9
ror ecx, 0x65
neg al
xor bl, al
not ecx
bt ecx, ecx
sub cl, ch
adc eax, esp
inc ecx
mov word [eax], dx
mov eax, ecx
mov ecx, dword [ebp + 2]
movsx edx, ax
btc ax, 0x25
ror ax, 0xaf
mov edx, dword [ecx]
movzx ecx, ax
mov dword [ebp + ecx*2 - 0x1fc84], edx
lea edx, [ecx*4 - 0x6ee1b1fb]
xchg ecx, edx
jb 0x18e14ef
inc edx
inc esi
xor dword [ebx + 0x2b7577ea], esp
mov dword [0x2b7577ea], eax
or eax, 0x13a59383
mov ecx, 0xfa24c1b9
jns 0x11f6be4
lea ebp, [ebp + edx*8 - 0x7f216]
ror ax, 0x24
jae 0x105feb6
lodsb al, byte [esi]
aad 0xea
or eax, 0xc166fff8
enter 0xf24, 0xffffffffffffff83
mov dh, 0xe9
ja 0x18e14ff
invalid
cmp al, 0x46
insd dword es:[edi], dx
salc
add al, byte [eax - 0x4a]
je 0x18e1525
retf 0x1e2c
jl 0x18e155b
retf 0x1e2c
lcall 0x70a7, 0x3a2ee8ab
and eax, edx
push esp
mov bh, 0xdb
push edx
sub byte [esi - 0x1e], dh
daa
test eax, 0xb5430683
push ss
mov edx, dword [esi + 0x4cb416eb]
adc dword [ebx - 0x753ad9bb], 6
adc byte [eax - 0x571679e6], ch
shl byte [ebx - 0x6e8f0019], 0x95
out 0xff, eax
jo 0x18e14f0
xchg ebp, eax
je 0x18e152e
fistp qword [ecx - 0xada7869]
hlt
xor ecx, edi
mov dword [esp + 4], 0xe324fd1b
mov dword [esp], 0x78237492
rol dword [esp + 5], 0x35
inc edx
neg dword [esp + 5]
jp 0x19837c3
mov eax, 0xf3197b92
mov edx, eax
mov edx, dword [esi - 4]
jmp 0x11f6b0f
Function at 0x1977fa0
Capabilities:
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
sub dl, 0x90
sub dword [esp + 5], 0x120f7f8f
xor eax, 0xa515352f
or cx, 0x3eab
not dl
push eax
cwde
xor bl, dl
add word [esp + eax - 0x372f], cx
jge 0x18e2f1e
neg ecx
inc ecx
inc edi
inc esp
mov eax, eax
bt di, ax
dec ecx
inc ecx
shl edx, 0x85
and al, bl
inc ecx
shl al, 0x65
inc ecx
push esi
inc esp
mov esi, edi
inc edx
xor dword [esp - 0x2e28ff7d], ecx
not ebx
inc ecx
pop esi
dec eax
arpl cx, cx
dec eax
add esi, ecx
inc cx
bts ecx, 0x87
inc ecx
bswap edi
jmp esi
or eax, eax
lea edx, [esp + edx + 0x10]
sal al, 0xa5
add al, ah
mov eax, dword [edx + eax*2 - 0x6e2e]
sbb ebp, 3
btc ecx, 0xd
mov dword [ebp], eax
movsx edx, cx
shl edx, 0xdd
bswap ecx
pop ecx
pop edx
pop ecx
pop edx
jp fcn.019143e0
ror eax, 3
push edx
not eax
rol word [esp + ecx - 0x4f4bfffe], 0x61
and ecx, ecx
shl ecx, 0xbd
lea eax, [eax + edx - 0x595e1f76]
not eax
bt ecx, edx
ror dx, 0xeb
xor ebx, eax
add edi, eax
xchg byte [esp + ecx*2 + 9], cl
mov dword [esp + ecx*4 - 0x1f4], edx
not byte [esp + ecx - 0x7a]
lea esi, [esi + ecx*2 - 0xfd]
movsx eax, dl
and edx, dword [esp + ecx - 0x7e]
movzx edx, byte [ecx + esi - 0x7e]
rol eax, cl
xor dl, bl
inc ax
sal al, 0x81
sbb dword [esp + ecx - 0x76], eax
neg dl
idiv byte [esp + ecx - 0x78]
ror ax, 0x8b
rol al, 0xc4
ror dl, 1
lea ecx, [eax + ecx - 0x707b8556]
mov dword [esp + 6], eax
jmp 0x106ce73
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43ebce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43ebc3
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403320
Capabilities:
Copy file
Shutdown system

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push esi
push edi
mov esi, ecx
call fcn.00402930
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0x40ddd4
push 0x40ced0
call edi
test eax, eax
je 0x403376
push 0x3ff00000
push 0
push 0x40ddd4
push 0x40fdd4
push 0x40ced0
mov ecx, 0x411294
call fcn.00405930
push 0x40ddd4
mov ecx, esi
call fcn.00402800
push 0
push 0x40dfd4
push 0x40ced0
call edi
test eax, eax
je 0x4033b4
push 0x3ff00000
push 0
push 0x40dfd4
push 0x40fdd4
push 0x40ced0
mov ecx, 0x411294
call fcn.00405930
push 0x40dfd4
mov ecx, esi
call fcn.00402800
push 0
push 0x40d9d4
push 0x40ced0
call edi
test eax, eax
je 0x4033f2
push 0x3ff00000
push 0
push 0x40d9d4
push 0x40fdd4
push 0x40ced0
mov ecx, 0x411294
call fcn.00405930
push 0x40d9d4
mov ecx, esi
call fcn.00402800
push 0
push 0x40e3d4
push 0x40ced0
call edi
test eax, eax
je 0x403430
push 0x3ff00000
push 0
push 0x40e3d4
push 0x40fdd4
push 0x40ced0
mov ecx, 0x411294
call fcn.00405930
push 0x40e3d4
mov ecx, esi
call fcn.00402800
push 0
push 0x40d5d4
push 0x40ced0
call edi
test eax, eax
je 0x40346e
push 0x40490000
push 0
push 0x40d5d4
push 0x40fbd4
push 0x40ced0
mov ecx, 0x411294
jmp 0x51c024
push 0
push 0x40dbd4
push 0x40ced0
call edi
test eax, eax
je 0x4034ac
push 0x40dbd4
mov ecx, esi
call fcn.00402810
push 0x3ff00000
push 0
push 0x40dbd4
push 0x40f9d4
push 0x40ced0
mov ecx, 0x411294
call fcn.00405930
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0x14]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 0xc]
push 0
push 0
lea edx, [esp + 0x18]
push 0
push edx
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b9b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [edx], 0x2c
je 0x40b9e4
mov ecx, dword [eax + 0x11c]
test ecx, ecx
jne 0x40b9dc
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0040432c
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [edx + 4]
mov edi, dword [edx + 8]
mov ebp, dword [edx + 4]
test edi, edi
je 0x40b9dc
mov edx, dword [eax + 0x104]
xor ebx, ebx
lea ecx, [eax + 4]
mov dword [esp + 0x1c], ecx
mov esi, eax
jmp 0x40ba1c
mov ecx, edx
inc edx
mov byte [esi + ecx + 4], al
mov dword [esi + 0x104], edx
mov byte [esi + 0x108], al
inc ebx
cmp edi, ebx
je 0x40b9dc
mov al, byte [ebp + ebx]
cmp edx, 0xff
jne 0x40ba04
mov byte [esi + 0x103], 0
mov edx, dword [esi + 0x110]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xff
mov edx, dword [esp + 0x1c]
mov dword [esp], edx
mov byte [esp + 0x18], al
call dword [esi + 0x10c]
inc dword [esi + 0x124]
mov edx, 1
xor ecx, ecx
mov al, byte [esp + 0x18]
jmp 0x40ba07
Function at 0x40e528
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
lea esi, [ebp + 0xc]
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], esi
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x40e574
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
test ecx, ecx
jne 0x40e590
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
mov ecx, dword [ebp - 0x3c]
je 0x40e640
mov eax, dword [ebp - 0x24]
cmp eax, 0x40
je 0x40e634
cmp eax, 4
je 0x40e634
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
cmp eax, 0x40
mov edx, dword [ebp - 0x40]
je 0x40e585
cmp eax, 4
je 0x40e585
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0040e528
Function at 0x405280
Capabilities:
Encode data using xor

Disassembly:
push 0x405334
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
pushal
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov ebx, 0x93ecd7ec
xor al, 0xfa
inc ebp
stosb byte es:[edi], al
adc eax, edi
pop esi
pushal
jg 0x40529c
mov al, byte [pe_dos_header]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub eax, 0x30303043
sub eax, 0x67637670
popal
arpl word [ebx + 0x74], bp
arpl word [eax], bp
jge 0x4052ed
xor ch, byte [esi]
cmp dword [eax], esi
cmp dword [ebx], esi
xor al, 0x30
xor dh, byte [ebx]
cmp byte [ebx + esi], dh
cmp dword [edx], esi
cmp byte [0x36353334], dh
xor eax, 0x34353634
add byte ss:[edi + ebp*2 + 0x6c], ah
xor ch, byte gs:[esi]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
adc byte [eax + eax*2], al
add bh, bh
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], dl
test byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x405fb4
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x40e818]
call fcn.0040a1aa
mov edi, eax
test edi, edi
je 0x406016
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x405fdd
push dword [esp + 0xc]
push edi
call eax
jmp 0x406016
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
jmp section..htext
pop edi
ret 8

Function at 0x40633f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x1c]
push eax
mov ebx, 0xc8
mov dword [ebp - 0x1c], 0x94
call edi
test eax, eax
je 0x406428
mov eax, dword [ebp - 0xc]
dec eax
je 0x40640b
dec eax
jne 0x406428
lea eax, [ebp - 0xb8]
push eax
xor esi, esi
mov dword [ebp - 0xb8], 0x9c
call edi
test eax, eax
je 0x40639e
cmp byte [ebp - 0x1e], 1
jne 0x40639e
inc esi
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x406407
dec eax
je 0x406403
dec eax
je 0x4063e1
dec eax
jne 0x406428
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x4063d5
dec eax
je 0x4063c9
dec eax
jne 0x406428
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x5f]
jmp 0x406428
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x55]
jmp 0x406428
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x4b]
jmp 0x406428
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x4063ff
dec eax
je 0x4063fb
dec eax
jne 0x406428
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x41]
jmp 0x406428
push 0x3c
jmp 0x406427
push 0x32
jmp 0x406427
push 0x14
jmp 0x406427
push 5
jmp 0x406427
cmp dword [ebp - 0x14], 0
je 0x406425
cmp dword [ebp - 0x14], 0xa
je 0x406421
cmp dword [ebp - 0x14], 0x5a
jne 0x406428
push 0x28
jmp 0x406427
push 0x1e
jmp 0x406427
push 0xa
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x78
leave
ret
Function at 0x1001e76c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1001e77b
pop dword [ebp - 0x38]
mov eax, 0x1809a851
sub eax, 0x807c0d6
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xaac1ada8
add dword [ebp - 0x48], 0xa39097a3
mov dword [ebp - 0x44], 0x7654f60b
add dword [ebp - 0x44], 0xbbde563a
mov dword [ebp - 0x40], 0x7023a62c
sub dword [ebp - 0x40], 0x23d761fe
mov dword [ebp - 0x3c], 0xd4bf1eb1
sub dword [ebp - 0x3c], 0xd4bf1eb1
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x21bd9905
add dword [ebp - 0x48], 0x52b4d051
mov dword [ebp - 0x44], 0x69668aaf
sub dword [ebp - 0x44], 0x27fa293a
mov dword [ebp - 0x40], 0xfe285235
sub dword [ebp - 0x40], 0x9ab8e5c9
mov dword [ebp - 0x3c], 0x6711fa8
sub dword [ebp - 0x3c], 0x6711fa8
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x9d1f4cff
add eax, 0x72e0c405
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39d51
push 0
call eax
mov ecx, 0x56eea231
sub ecx, 0x56ee62e8
xor esi, esi
add esi, eax
mov edx, 0xe6a9adb3
add edx, 0x29592c4d
add edx, dword [ebp - 0x38]
mov edi, 0xb5079241
add edi, 0x5099f8e3
sub dword [ebp - 0x20], 0xe1c9fa8
mov ebx, dword [edx]
xor dword [ebp - 0x10], 0xc03e826e
add ebx, edi
add dword [ebp - 0x2c], esi
mov dword [esi], ebx
add esi, 4
add edx, 0x63f45cf6
sub edx, 0x63f45cf2
loop 0x1001e89a
add eax, 0x8b354430
add eax, 0x74cbabc7
mov ebx, eax
add eax, 5
mov ecx, sym.msimp32.dll_Ordinal_5
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x10023d3a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10001b3c]
jne 0x1002420f
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10028d58], eax
mov dword [0x10028d54], ecx
mov dword [0x10028d50], edx
mov dword [0x10028d4c], ebx
mov dword [0x10028d48], esi
mov dword [0x10028d44], edi
mov word [0x10028d70], ss
mov word [0x10028d64], cs
mov word [0x10028d40], ds
mov word [0x10028d3c], es
mov word [0x10028d38], fs
mov word [0x10028d34], gs
pushfd
pop dword [0x10028d68]
mov eax, dword [ebp]
mov dword [0x10028d5c], eax
mov eax, dword [ebp + 4]
mov dword [0x10028d60], eax
lea eax, [ebp + 8]
mov dword [0x10028d6c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10028ca8], 0x10001
mov eax, dword [0x10028d60]
mov dword [0x10028c5c], eax
mov dword [0x10028c50], 0xc0000409
mov dword [0x10028c54], 1
mov eax, dword [0x10001b3c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10028390]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10028ca0], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10001b4c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10028ca0], 0
jne 0x100242fb
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x473330
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4a0800]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004732c5
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004598f0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x47337f
cmp dword [ebp - 0x1c], 5
jb 0x473397
jmp 0x473393
cmp dword [ebp - 0x10], 1
jne 0x473397
cmp dword [ebp - 0x1c], 4
ja 0x473393
jne 0x473397
cmp dword [ebp - 0x18], 0
jbe 0x473397
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x483844
call fcn.0041b790
test eax, eax
jge 0x4733b8
mov byte [0x4a6454], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004552e7
add ebp, 0x78
leave
ret
Function at 0x10019b0
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10019d3
jmp 0x1001a30
lea ecx, [ebp - 8]
push ecx
push 0x1001244
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x10019f6
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001a30
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x80010002
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
mov esp, ebp
pop ebp
ret
Function at 0x1002140
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 8], 0x2000
mov eax, dword [ebp - 8]
shr eax, 1
add eax, 2
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.010080d8
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1002186
xor eax, eax
jmp 0x100229e
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100224c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x10021cc
jmp 0x1002284
cmp dword [ebp - 0x10], 7
je 0x10021dc
jmp 0x1002284
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.010080cc
add esp, 4
mov eax, dword [ebp - 8]
shr eax, 1
add eax, 2
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.010080d8
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1002228
jmp 0x1002284
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
jmp 0x10021ab
mov eax, dword [ebp - 0x18]
shr eax, 1
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov word [eax + edx*2], cx
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov word [eax + edx*2 + 2], cx
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.01001c40
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1002284
mov eax, dword [ebp - 0x14]
jmp 0x100229e
cmp dword [ebp - 0x1c], 0
je 0x100229c
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.010080cc
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1006210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x100a1b0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x22c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x1006268
mov eax, 3
jmp 0x10063f2
cmp dword [ebp + 0x14], 2
jge 0x1006278
mov eax, 3
jmp 0x10063f2
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov dword [ebp - 0x228], ecx
mov edx, dword [ebp - 0x228]
movzx eax, word [edx]
test eax, eax
jne 0x100629a
mov eax, 3
jmp 0x10063f2
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
test ecx, ecx
jne 0x10062b7
mov eax, 3
jmp 0x10063f2
push 0
lea edx, [ebp - 0x220]
push edx
push 0x104
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x104
jae 0x10062e4
cmp dword [ebp - 8], 0
jne 0x10062ee
mov eax, 2
jmp 0x10063f2
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100630a
mov eax, 2
jmp 0x10063f2
lea edx, [ebp - 0x220]
mov dword [ebp - 0x228], edx
mov eax, dword [ebp - 0xc]
or eax, 1
mov dword [ebp - 0xc], eax
push 0x1001628
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x1006343
jmp 0x10063d9
push 0x1001604
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1006362
jmp 0x10063d9
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x228]
neg ecx
sbb ecx, ecx
add ecx, 0xeeaf
push ecx
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x20
push eax
call fcn.010017f0
add esp, 0x10
lea edx, [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x228]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
call dword [ebp - 0x10]
test eax, eax
jne 0x10063b3
jmp 0x10063d9
push 0xeeb2
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x20
push eax
call fcn.010017f0
add esp, 8
xor eax, eax
cmp dword [ebp - 0x22c], 0
setne al
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x224], 0
je 0x10063ef
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.010080e3
mov esp, ebp
pop ebp
ret 0x14