joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021f8c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100178dc
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10021ffb
cmp esi, dword [ebp - 4]
je 0x10021ff6
cmp dword [ebp + 0xc], 0
je 0x10021ff6
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10021fd3
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10021ade
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10021ffd
xor eax, eax
inc eax
jmp 0x10021ffd
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10022062
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10035840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100178dc
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100178dc
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100220d9
cmp word [ecx], dx
je 0x100220d9
mov eax, dword [0x1002da5c]
push edi
dec eax
push eax
push 0x1002d948
call fcn.10022001
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1002214c
cmp word [eax], dx
je 0x1002214c
mov eax, dword [edi]
test eax, eax
je 0x100220fd
cmp word [eax], dx
je 0x100220fd
lea eax, [ebp - 0x10]
push eax
call fcn.100219e4
jmp 0x10022106
lea eax, [ebp - 0x10]
push eax
call fcn.10021a7f
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10022176
mov eax, dword [0x1002d944]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1002d638
call fcn.10022001
add esp, 0xc
test al, al
je 0x10022176
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10022141
cmp word [eax], di
je 0x10022141
lea eax, [ebp - 0x10]
push eax
call fcn.100219e4
pop ecx
jmp 0x10022178
lea eax, [ebp - 0x10]
push eax
call fcn.10021a7f
jmp 0x1002213e
mov eax, dword [edi]
test eax, eax
je 0x10022163
cmp word [eax], dx
je 0x10022163
lea eax, [ebp - 0x10]
push eax
call fcn.10021999
pop ecx
jmp 0x10022176
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10022241
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10021e86
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10022241
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10022241
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10022241
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100221ce
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100199b4
test ebx, ebx
je 0x1002223c
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100199b4
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10022241
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10022241
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10024fee
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10022243
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009c5b
leave
ret
Function at 0x10026b00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10026b2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10026b2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431004]
jne 0x40100a
repz ret
jmp fcn.0040130e

Function at 0x4054c3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x431004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004034d1
and dword [ebp - 0x14], 0
cmp dword [0x43395c], 0
mov dword [ebp - 0x18], eax
jne 0x405576
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40561e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40561e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43395c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x433960], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x433964], eax
call edi
push eax
call esi
mov dword [0x43396c], eax
test eax, eax
je 0x405576
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x433968], eax
mov eax, dword [0x433968]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4055cf
cmp dword [0x43396c], ecx
je 0x4055cf
push eax
call esi
push dword [0x43396c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4055cf
test ebx, ebx
je 0x4055cf
call edi
test eax, eax
je 0x4055c6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4055c6
test byte [ebp - 8], 1
jne 0x4055cf
or dword [ebp + 0x10], 0x200000
jmp 0x405602
mov eax, dword [0x433960]
cmp eax, dword [ebp - 0x18]
je 0x405602
push eax
call esi
test eax, eax
je 0x405602
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405602
mov eax, dword [0x433964]
cmp eax, dword [ebp - 0x18]
je 0x405602
push eax
call esi
test eax, eax
je 0x405602
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43395c]
call esi
test eax, eax
je 0x40561e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405620
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x42d110
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
mov edx, dword [0x1f05de4]
mov eax, dword [0x1f05b08]
xor ecx, ecx
mov word [0x1f05e00], cx
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
mov dword [0x1f05dec], 0x6e0072
mov dword [0x1f05df0], 0x6c0065
mov dword [0x1f05df4], 0x320033
mov dword [0x1f05df8], 0x64002e
mov dword [0x1f05dfc], 0x6c006c
mov dword [0x1f05de8], 0x65006b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x42d340
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x431dd0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1f05b08]
push edi
mov edi, dword [0x1f05de4]
push eax
call fcn.0042d260
add esp, 4
cmp dword [0x1f05de4], 0x2f
jne 0x42d39d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0042d2b0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d620
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x431004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
xor edi, edi
cmp dword [0x1f05de4], 0x8cf
jne 0x42d656
push 0
push 0
call ebx
cmp edi, 0x845013
jne 0x42d66d
mov eax, dword [0x432bf0]
add eax, 0xa231
mov dword [0x1f05de4], eax
cmp dword [0x1f05de4], 0x141
jne 0x42d69b
push str.viwesorihefukenapedumate_ronofo_virejesirahipuj_cafaloteceselu_dizupucucakixucafukiz
lea ecx, [ebp - 0x804]
push ecx
call esi
mov dword [0x433e80], 0xec58acac
mov dword [0x433e84], 0xffffffff
inc edi
cmp edi, 0xbbe2a98
jl 0x42d644
call fcn.0042d3b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401000
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41ba40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 4
push edi
mov edi, 0x4d4400
push esi
push ebx
sub esp, 0xbc
mov eax, dword [esp + 0xd4]
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41b992
mov edi, 0x4d4404
mov ecx, 5
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41b9e0
mov edi, 0x4d4409
mov ecx, 2
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x41ba37
lea ebx, [eax + 2]
movzx edx, byte [eax + 2]
xor esi, esi
jmp 0x41b92b
cmp dl, 0x3a
jne 0x41ba2e
add ebx, 1
movzx edx, byte [ebx]
test dl, dl
je 0x41b982
movzx edi, dl
movsx eax, dl
test byte [edi + edi + 0x509c61], 1
je 0x41b918
movzx edi, byte [ebx + 1]
test byte [edi + edi + 0x509c61], 1
je 0x41b918
call fcn.0041b780
mov edi, dword [esp + 0xdc]
lea ebp, [ebx + 2]
add edi, esi
add esi, 1
mov edx, eax
shl edx, 4
mov byte [edi], dl
movsx eax, byte [ebx + 1]
mov ebx, ebp
mov dword [esp + 0xc], edx
call fcn.0041b780
mov edx, dword [esp + 0xc]
or eax, edx
mov byte [edi], al
movzx edx, byte [ebx]
test dl, dl
jne 0x41b92b
mov eax, 1
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [esp + 0x10]
mov dword [esp], esi
call fcn.004a9ff0
mov eax, dword [esp + 0xd0]
mov dword [esp + 8], esi
mov dword [esp + 4], fcn.004aa860
mov dword [esp], eax
call dword [esp + 0xd8]
test eax, eax
je 0x41b987
mov eax, dword [esp + 0xdc]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004aa7b0
mov eax, 1
jmp 0x41b987
lea esi, [esp + 0x10]
mov dword [esp], esi
call fcn.004aabc0
mov eax, dword [esp + 0xd0]
mov dword [esp + 8], esi
mov dword [esp + 4], fcn.004ac070
mov dword [esp], eax
call dword [esp + 0xd8]
test eax, eax
je 0x41b987
mov eax, dword [esp + 0xdc]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004abf70
mov eax, 1
jmp 0x41b987
cmp dl, 0x2d
je 0x41b921
call sub.msvcrt.dll_abort
nop
nop
nop
nop
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov dword [esp + 8], 0xee
mov dword [esp + 4], 1
mov dword [esp], 0x4d4420
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x124
mov dword [esp + 4], 1
mov dword [esp], 0x4d4510
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x12d
mov dword [esp + 4], 1
mov dword [esp], 0x4d4638
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x39
mov dword [esp + 4], 1
mov dword [esp], 0x4d4768
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x39
mov dword [esp + 4], 1
mov dword [esp], 0x4d47a4
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x59
mov dword [esp + 4], 1
mov dword [esp], 0x4d47e0
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x83
mov dword [esp + 4], 1
mov dword [esp], 0x4d483c
call sub.msvcrt.dll_fwrite
add esp, 0x18
pop ebx
ret
Function at 0x458960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
movzx eax, byte [ebx + 0x28]
mov edx, eax
and edx, 0x18
cmp dl, 0x10
jne 0x45897c
test byte [ebx + 0x2a], 1
jne 0x458990
mov dword [esp], 5
call fcn.0044baf0
xor eax, eax
add esp, 0x18
pop ebx
ret
mov edx, dword [ebx + 4]
and eax, 7
mov eax, dword [edx + eax*4 + 0x84]
mov dword [esp], ebx
call eax
test eax, eax
jne 0x4589b0
add esp, 0x18
xor eax, eax
pop ebx
ret
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x94]
mov dword [esp], ebx
call eax
test eax, eax
je 0x4589a6
and byte [ebx + 0x28], 0xf8
and byte [ebx + 0x2b], 0xed
and byte [ebx + 0x2a], 0x7f
or dword [ebx + 0x28], 0x10000
movzx eax, byte [ebx + 0x2b]
mov dword [ebx + 0x84], 0x4fe3c0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
and eax, 0xfffffffb
or eax, 1
mov byte [ebx + 0x2b], al
movzx eax, byte [ebx + 0x28]
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
and eax, 0xffffffe7
or eax, 8
mov byte [ebx + 0x28], al
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0xa4], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0xa0], 0
mov dword [esp], ebx
call fcn.0044d460
mov dword [esp + 4], 1
mov dword [esp], ebx
call fcn.00454030
mov eax, 1
jmp 0x45898a
Function at 0x100024f0
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
sub esp, 0x774
mov eax, dword [0x1001803c]
xor eax, esp
mov dword [esp + 0x770], eax
push ebx
push ebp
mov ebp, dword [esp + 0x780]
push esi
push edi
mov esi, ecx
push ebp
push 0x10016044
mov ecx, 0x104
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], esi
call fcn.100010c0
mov edi, dword [esp + 0x794]
add esp, 8
cmp edi, 1
jne 0x100025aa
mov edx, ebp
call fcn.10005cb0
push eax
mov ebx, 0x10016048
call fcn.10006050
add esp, 4
test eax, eax
je 0x100025aa
lea eax, [esp + 0x14]
push str..JPG_www.
push eax
mov eax, 0x104
call fcn.10005b20
add esp, 8
test eax, eax
jne 0x10002587
lea ecx, [esp + 0x14]
push str..JPEG_www.
push ecx
mov eax, 0x104
call fcn.10005b20
add esp, 8
test eax, eax
je 0x100025aa
push str.New_Heur.FB_Kolab_
push 0x10016040
mov ecx, 0x40
mov edi, esi
call fcn.100010c0
add esp, 8
mov eax, 0x25
jmp 0x10002747
lea eax, [esp + 0x118]
mov esi, ebp
mov ecx, eax
mov edx, 0x12c
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffed2]
test ecx, ecx
je 0x100025e0
movzx ecx, word [esi + eax]
test cx, cx
je 0x100025e0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100025c0
jmp 0x100025e4
test edx, edx
jne 0x100025e7
sub eax, 2
xor edx, edx
mov word [eax], dx
lea ecx, [esp + 0x118]
xor eax, eax
push ecx
mov word [esp + 0x122], ax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x10002745
lea eax, [esp + 0x370]
mov ecx, ebp
xor esi, esi
call fcn.10005d00
test eax, eax
je 0x1000264e
lea eax, [esp + 0x370]
xor edx, edx
push eax
lea eax, [esp + 0x11c]
lea ecx, [esi + 4]
mov word [esp + 0x120], dx
call fcn.10005f80
add esp, 4
test eax, eax
je 0x1000264e
mov esi, 1
lea eax, [esp + 0x578]
mov ecx, ebp
call fcn.10005d90
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, eax
je 0x1000269e
lea ecx, [esp + 0x578]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x1000269e
test al, 6
je 0x1000269e
push str.New_Heur.FFD_FakeDir_
mov edi, dword [esp + 0x14]
push 0x10016040
mov ecx, 0x40
call fcn.100010c0
add esp, 8
mov eax, 0x25
jmp 0x10002747
cmp edi, 1
jne 0x10002732
lea edx, [esp + 0x14]
push str._recycle.
push edx
mov eax, 0x104
call fcn.10005b20
add esp, 8
test eax, eax
jne 0x10002728
lea eax, [esp + 0x14]
push str.RECYCLER
push eax
mov eax, 0x104
call fcn.10005b20
add esp, 8
test eax, eax
jne 0x10002728
lea ecx, [esp + 0x14]
push 0x100160c0
push ecx
mov eax, 0x104
call fcn.10005b20
add esp, 8
test eax, eax
jne 0x10002728
lea edx, [esp + 0x14]
push str.RECYCLER
push edx
mov eax, 0x104
call fcn.10005b20
add esp, 8
test eax, eax
jne 0x10002728
push ebp
call ebx
test esi, esi
je 0x10002745
test al, 6
je 0x10002745
push str.New_Heur.FFD_Hidden_root_
jmp 0x1000267e
push str.New_Heur.FFD_Recycler_
jmp 0x1000267e
cmp edi, 4
jne 0x10002745
test esi, esi
je 0x10002745
push str.New_Heur.FFD_Link_
jmp 0x1000267e
xor eax, eax
mov ecx, dword [esp + 0x780]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100065f6
add esp, 0x774
ret
Function at 0x100027f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002878
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea edx, [esp + 0x10]
mov ecx, esi
mov ebx, eax
call fcn.10004d10
mov edi, dword [esp + 0x14]
add edi, 0xc00
lea ecx, [edi + 0x1000]
cmp ebx, ecx
jb 0x10002871
push 0
mov ecx, edi
mov edx, esi
call fcn.100028a0
mov edx, dword [ebp + 8]
add esp, 4
mov dword [edx], eax
test eax, eax
je 0x10002871
push 1
mov ecx, edi
mov edx, esi
call fcn.100028a0
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ecx], eax
test eax, eax
jne 0x10002881
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002b50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x1001803c]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [0x1001a334]
push esi
push 0
mov esi, ecx
mov ecx, dword [eax + edi*4]
push 0
push ecx
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10002bdd
push 0
lea edx, [esp + 8]
push edx
push 0x20
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002bdd
cmp dword [esp + 4], 0x20
jne 0x10002bdd
mov edx, dword [0x1001a0c0]
mov eax, dword [edx + edi*4]
lea edx, [esp + 8]
mov ecx, 0x20
sub edx, eax
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x10002bdd
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x10002bb6
mov eax, 1
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100065f6
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
pop esi
xor ecx, esp
xor eax, eax
call fcn.100065f6
add esp, 0x28
ret
Function at 0x10003ff0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x1001803c]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, 0x100000
cmp eax, 0x100000
ja 0x10004023
mov edi, eax
push edi
call fcn.1000667a
add esp, 4
push 0
push 0
push 0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10004044
xor ebp, ebp
jmp 0x1000406d
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000405c
xor ebp, ebp
jmp 0x1000406d
mov edi, dword [esp + 0x10]
mov edx, ebx
call fcn.10005910
mov dword [esp + 0x10], eax
mov ebp, ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
cmp eax, 0x20
jb 0x100041ce
cmp eax, 0x400
jb 0x1000408d
mov eax, 0x400
push eax
push ebp
mov ebx, 0x1001641c
call fcn.10005ab0
mov edx, dword [esp + 0x18]
xor esi, esi
add esp, 8
cmp eax, esi
jbe 0x100040ff
lea ecx, [eax + 0x201]
cmp ecx, edx
ja 0x100040ff
mov ecx, 1
add eax, ebp
cmp byte [eax + ecx], 0x22
je 0x100040ff
inc ecx
cmp ecx, 0x200
jbe 0x100040b7
push ebp
call fcn.10006605
push str.VBS.Encrypted.B
mov edi, dword [esp + 0x1c]
push 0x10016040
mov ecx, 0x40
call fcn.100010c0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0x24
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.100065f6
add esp, 0x10
ret
push edx
push ebp
mov ecx, str.CreateObject
call fcn.10003cd0
add esp, 8
test al, al
je 0x1000411f
push ebp
call fcn.10006605
push str.VBS.Encrypted.C
jmp 0x100040d1
xor edi, edi
mov dword [esp + 0x18], esi
cmp dword [0x1001a3fc], esi
jbe 0x10004190
lea ecx, [ecx]
cmp edi, 0x12c
jae 0x10004172
mov edx, dword [esp + 0x10]
mov ebx, dword [esi*4 + 0x10019f28]
push edx
push ebp
call fcn.10005ab0
add esp, 8
test eax, eax
je 0x10004161
cmp esi, 1
ja 0x1000415a
inc dword [esp + 0x18]
add edi, dword [esi*4 + 0x10019d98]
inc esi
cmp esi, dword [0x1001a3fc]
jb 0x10004130
cmp edi, 0x12c
jb 0x10004190
cmp dword [esp + 0x28], 3
je 0x10004180
cmp dword [esp + 0x18], 2
jne 0x10004190
push ebp
call fcn.10006605
push str.VBS.VirusCode
jmp 0x100040d1
mov eax, dword [esp + 0x10]
push eax
push ebp
mov ecx, str.execute
call fcn.10003cd0
add esp, 8
test al, al
jne 0x100041be
mov ecx, dword [esp + 0x10]
push ecx
push ebp
mov ecx, str.execute_
call fcn.10003cd0
add esp, 8
test al, al
je 0x100041ce
push ebp
call fcn.10006605
push str.VBS.Encrypted.A
jmp 0x100040d1
push ebp
call fcn.10006605
mov ecx, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100065f6
add esp, 0x10
ret
Function at 0x10006410
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push eax
push 0x1001420c
push 1
push 0
push 0x1001421c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x1000649d
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x1001422c
push eax
mov eax, dword [ecx]
call eax
mov esi, eax
test esi, esi
jl 0x10006491
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
test esi, esi
setge al
pop esi
add esp, 8
ret

Function at 0x100065f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001803c]
jne 0x10006600
repz ret
jmp fcn.10006c2c
Function at 0x1000dfd6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10008d0e
and dword [ebp - 4], 0
cmp dword [0x10019cb8], 0
mov ebx, eax
jne 0x1000e087
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000e138
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000e138
push eax
call fcn.10008c9c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10019cb8], eax
call esi
push eax
call fcn.10008c9c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10019cbc], eax
call esi
push eax
call fcn.10008c9c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10019cc0], eax
call esi
push eax
call fcn.10008c9c
pop ecx
mov dword [0x10019cc8], eax
test eax, eax
je 0x1000e087
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10008c9c
pop ecx
mov dword [0x10019cc4], eax
mov eax, dword [0x10019cc4]
cmp eax, ebx
je 0x1000e0df
cmp dword [0x10019cc8], ebx
je 0x1000e0df
push eax
call fcn.10008d17
push dword [0x10019cc8]
mov esi, eax
call fcn.10008d17
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000e0df
test edi, edi
je 0x1000e0df
call esi
test eax, eax
je 0x1000e0d6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000e0d6
test byte [ebp - 0xc], 1
jne 0x1000e0df
or dword [ebp + 0x10], 0x200000
jmp 0x1000e118
mov eax, dword [0x10019cbc]
cmp eax, ebx
je 0x1000e118
push eax
call fcn.10008d17
pop ecx
test eax, eax
je 0x1000e118
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000e118
mov eax, dword [0x10019cc0]
cmp eax, ebx
je 0x1000e118
push eax
call fcn.10008d17
pop ecx
test eax, eax
je 0x1000e118
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10019cb8]
call fcn.10008d17
pop ecx
test eax, eax
je 0x1000e138
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000e13a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret