joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100174b0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x100174cf
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10017519
xor eax, eax
add esp, 0x14
ret
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
add esp, 0x14
ret

Function at 0x100175b0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebp
xor ebp, ebp
push esi
push ebp
push 0xa
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10017625
push ebx
lea eax, [esp + 0xc]
push edi
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10017611
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x34]
push ecx
push edi
call ebx
test eax, eax
je 0x1001760c
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10017611
jmp 0x100175ef
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret

Function at 0x10017b70
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x128
test eax, eax
jne 0x10017b87
xor al, al
add esp, 0x128
ret
push ebx
push ebp
push 0
push 0xa
xor bl, bl
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10017c0d
lea eax, [esp + 8]
mov dword [esp + 8], 0x128
push eax
push ebp
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10017c06
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [esp + 0x13c]
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10017bf5
mov eax, dword [esp + 0x18]
mov bl, 1
push eax
push 0
push 0x1f0fff
call esi
test eax, eax
je 0x10017bf5
push 1
push eax
call edi
test eax, eax
setne bl
lea ecx, [esp + 0x10]
push ecx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10017bc0
pop edi
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebp
pop ebx
add esp, 0x128
ret
Function at 0x10017fd0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x110]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x110]
push esi
mov edx, ecx
push edi
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [esp + 0x10], 0
and ecx, 3
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
rep stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push str.ProgramFiles
call esi
call fcn.10016430
test eax, eax
je 0x1001805a
mov al, byte [esp + 0x120]
test al, al
je 0x1001805a
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push str.ProgramFiles_x86_
call esi
lea edx, [esp + 0x10]
push edx
push str._sGatewaySSLVPN
push ebx
push ebp
call fcn.1000f0c0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x10018460
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov edx, dword [esp + 0x214]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x218]
mov dword [esp + 4], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov edx, dword [esp + 0x21c]
lea eax, [esp + 8]
push edx
push eax
push 0x100c047c
lea ecx, [esp + 0x118]
push 0x104
push ecx
call fcn.1000f0c0
lea edx, [esp + 0x120]
push 0
push edx
call fcn.10011120
add esp, 0x1c
xor eax, eax
pop edi
add esp, 0x20c
ret

Function at 0x10018510
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov edx, dword [esp + 0x214]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x218]
mov dword [esp + 4], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [esp + 0x21c]
mov edx, dword [esp + 0x220]
pop edi
test eax, eax
push edx
je 0x100185c2
push eax
lea eax, [esp + 0xc]
push eax
push str._s_s_s.lnk
lea ecx, [esp + 0x118]
push 0x104
push ecx
call fcn.1000f0c0
add esp, 0x18
lea edx, [esp + 0x108]
push edx
call fcn.100116c0
add esp, 0x210
ret
lea eax, [esp + 8]
lea ecx, [esp + 0x10c]
push eax
push str._s_s.lnk
push 0x104
push ecx
call fcn.1000f0c0
add esp, 0x14
lea edx, [esp + 0x108]
push edx
call fcn.100116c0
add esp, 0x210
ret
Function at 0x10018600
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
mov ebp, dword [esp + 0x218]
test ebp, ebp
je 0x1001871a
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x1001871a
mov eax, dword [esp + 0x220]
test eax, eax
je 0x1001871a
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x21c]
mov dword [esp + 0xc], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 0x17
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x114]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [esp + 0x114]
push ebp
push eax
push 0x100c04a4
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.1000f0c0
add esp, 0x14
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esp + 0x224]
lea ecx, [esp + 0x10]
push eax
push ebp
push 0x100c04ac
push 0x104
push ecx
call fcn.1000f0c0
mov edx, dword [esp + 0x248]
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x240]
push edx
mov edx, dword [esp + 0x240]
push eax
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push 0x17
push esi
call fcn.100181d0
add esp, 0x30
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
or eax, 0xffffffff
pop ebp
add esp, 0x20c
ret

Function at 0x100188c0
Capabilities:
Delete directory
Get common file path

Disassembly:
sub esp, 0x20c
push esi
mov esi, dword [esp + 0x218]
test esi, esi
push edi
jne 0x100188df
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x20c
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jae 0x100188fe
pop edi
mov eax, 0xfffffffe
pop esi
add esp, 0x20c
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x218]
mov dword [esp + 8], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0x17
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 8]
lea edx, [esp + 0x110]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea ecx, [esp + 0x110]
push esi
push ecx
push 0x100c057c
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.1000f0c0
push 0
lea eax, [esp + 0x24]
push esi
push eax
call fcn.100116e0
add esp, 0x20
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret
Function at 0x1001b410
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x814
push ebp
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x421]
mov byte [esp + 0x420], 0
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x21]
mov esi, dword [esp + 0x824]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
push esi
call fcn.10011540
lea ecx, [esp + 0x28]
push ecx
push esi
push str.file__s__md5:_s
push 4
call fcn.1000eeb0
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1001b4ae
mov edi, dword [esp + 0x828]
push 0x100c1230
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
xor ebp, ebp
add esp, 8
cmp esi, ebp
jne 0x1001b4ba
push edi
push str.open__s_failed
push 4
call fcn.1000eeb0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x814
ret
push ebx
push 2
push ebp
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push esi
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_rewind]
push esi
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x43c]
push ebx
lea edx, [esp + 0x440]
push 1
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov al, byte [esp + 0x3b]
mov edi, str._____BEGIN_RSA_PUBLIC_KEY______nMIGHAoGBAME8ZU8rAEgC0CMj4RZhR8XDlLTuf4xJyttYoYFA3hVwsU0RBI1oGIi_nwCyZpqsw7n8h9iioJWmcIO_cWFiJ7_a6lVfKu3oHF6D2IQmyVwCQQS2DL8aERK_nipE0SjKtMP_Qm6ot7ioOHI51DLiJBYEiKR4N5PSPs0Z6IcPeIgpAgED_n_____END_RSA_PUBLIC_KEY_____
mov byte [esp + 0x3c], al
or ecx, 0xffffffff
xor eax, eax
add esp, 0x28
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov ebp, ecx
push 1
push ebp
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x1001b55c
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
mov esi, str._____BEGIN_RSA_PUBLIC_KEY______nMIGHAoGBAME8ZU8rAEgC0CMj4RZhR8XDlLTuf4xJyttYoYFA3hVwsU0RBI1oGIi_nwCyZpqsw7n8h9iioJWmcIO_cWFiJ7_a6lVfKu3oHF6D2IQmyVwCQQS2DL8aERK_nipE0SjKtMP_Qm6ot7ioOHI51DLiJBYEiKR4N5PSPs0Z6IcPeIgpAgED_n_____END_RSA_PUBLIC_KEY_____
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x424]
push ecx
push ebx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.1001b360
mov bl, al
mov eax, dword [esp + 0x28]
add esp, 0x10
test eax, eax
je 0x1001b59e
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x1001b595
cmp al, 0xff
je 0x1001b595
dec al
mov byte [ecx], al
jmp 0x1001b59e
push ecx
call fcn.10084060
add esp, 4
test bl, bl
pop ebx
je 0x1001b4ae
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x814
ret
Function at 0x1001bb20
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x1001d300
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
add esp, 0x190
ret
Function at 0x1001d9a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
call dword [eax + 0x1c]
test eax, eax
jne 0x1001da77
cmp dword [esi + 0x10], 0xffffffff
je 0x1001da77
mov ecx, dword [esi + 8]
push ebx
mov dword [esi + 0x54], edi
call fcn.1001cc30
mov ecx, dword [esi + 8]
mov ebx, eax
call fcn.1001c880
mov ecx, dword [esi + 8]
add ebx, eax
mov dword [esp + 0x18], ebx
call fcn.1001c880
mov ecx, dword [esi + 8]
mov ebx, eax
call fcn.1001c780
sub eax, ebx
lea ecx, [esi + 0x14]
mov dword [esp + 0x14], eax
push edi
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x14]
push edx
mov edx, dword [esi + 0x10]
push eax
lea ecx, [esp + 0x24]
push 1
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSARecv]
xor ecx, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, edi
mov dword [esi + 0x50], eax
je 0x1001da46
mov edx, dword [esp + 0xc]
mov ecx, dword [esi + 8]
push edx
call fcn.1001c900
mov eax, dword [esi + 0x24]
push eax
call ebx
cmp dword [esi + 0x50], edi
jne 0x1001da6c
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x3e5
je 0x1001da6c
mov dword [esi + 0xc], 1
call edi
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x54], eax
push ecx
call ebx
mov eax, dword [esp + 0xc]
pop ebx
pop edi
pop esi
add esp, 0x10
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
Function at 0x1001dbd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [esp + 8], 0
mov eax, dword [esi]
call dword [eax + 0x1c]
test eax, eax
jne 0x1001dce5
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x1001dce5
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
lea edi, [esi + 0x14]
mov dword [esp + 0x10], edx
push 0
lea ecx, [esp + 0x10]
push edi
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x20]
push 1
push ecx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
je 0x1001dc49
mov edx, dword [esi + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x1001dc74
mov edx, dword [esi + 0x24]
mov dword [esp + 8], 0xfffffffe
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1001dcac
cmp eax, 0x102
jne 0x1001dccf
mov edx, dword [esi + 0x24]
mov dword [esp + 8], 0xfffffffc
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret 0xc
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ecx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
jne 0x1001dccf
mov dword [esp + 8], 0xfffffffd
mov edx, dword [esi + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret 0xc
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x10
ret 0xc
Function at 0x1001dcf0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x20]
mov dword [esp + 8], 0
test eax, eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x1001de03
test ecx, ecx
jbe 0x1001de03
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x1001de03
test eax, eax
je 0x1001de03
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x1001dd4f
pop edi
mov eax, 0xfffffffe
pop esi
add esp, 0x10
ret 0xc
lea edi, [esi + 0x28]
push 0
push edi
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x20]
push 1
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x1001ddd4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x1001dd8d
mov dword [esi + 0xc], 1
mov dword [esp + 8], 0xfffffffe
jmp 0x1001ddd4
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0x38]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1001ddb1
cmp eax, 0x102
jne 0x1001ddd4
mov dword [esp + 8], 0xfffffffc
jmp 0x1001ddd4
mov edx, dword [esi + 0x10]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push edx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
jne 0x1001ddd4
mov dword [esp + 8], 0xfffffffd
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esp + 8]
test ecx, ecx
jle 0x1001ddf9
mov edi, dword [esi + 0x48]
mov eax, ecx
cdq
add edi, eax
mov dword [esi + 0x48], edi
mov eax, dword [esi + 0x4c]
adc eax, edx
mov dword [esi + 0x4c], eax
pop edi
mov eax, ecx
pop esi
add esp, 0x10
ret 0xc
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x10
ret 0xc

Function at 0x1001f400
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc0
lea eax, [esp + 0x9c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0xb4], 1
je 0x1001f49a
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x26
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
mov dword [esp + 8], 0x9c
push ecx
call esi
test eax, eax
pop edi
jne 0x1001f463
lea edx, [esp + 4]
mov dword [esp + 4], 0x94
push edx
call esi
mov eax, 1
pop esi
add esp, 0xc0
ret
mov eax, dword [esp + 0x14]
mov ecx, 2
cmp eax, ecx
jne 0x1001f49a
mov eax, dword [esp + 8]
cmp eax, 5
jb 0x1001f49a
jne 0x1001f49a
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x1001f49a
cmp word [esp + 0x98], cx
jae 0x1001f49a
mov eax, 1
pop esi
add esp, 0xc0
ret
xor eax, eax
pop esi
add esp, 0xc0
ret
Function at 0x10027860
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
lea ecx, [eax - 1]
mov eax, dword [esp + 0x18]
push edi
mov edi, dword [esi + 4]
mov ebp, dword [eax + 4]
mov edx, edi
shr ecx, 0x1f
dec ecx
xor edx, ebp
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
mov ebx, dword [eax + 4]
xor ebx, edx
mov dword [eax + 4], ebx
mov ebx, dword [esp + 0x20]
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x1002789c
jmp dword [edx*4 + 0x100279cc]
mov edi, 0xa
cmp ebx, edi
jle case.0x1002789c.10
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
mov ebp, dword [ebx + edi*4]
lea ebx, [ebx + edi*4]
xor ebp, edx
mov edx, dword [esp + 0x20]
inc edi
mov dword [ebx], ebp
cmp edi, edx
jl 0x100278ac
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
pop edi
pop esi
mov ecx, dword [eax]
pop ebp
xor ecx, edx
pop ebx
mov dword [eax], ecx
ret
Function at 0x10027fb0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.10084230
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x1002801c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1002801c
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x104]
push 0x100
push edx
call sub.MSVCRT.dll__vsnprintf
add esp, 0x10
test eax, eax
jge 0x10027ffc
mov eax, 0x100
lea ecx, [ebp - 4]
push 0
push ecx
lea edx, [ebp - 0x104]
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x104]
push 0xff
push edx
call sub.MSVCRT.dll__vsnprintf
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10028099
call fcn.10027ea0
test eax, eax
jle 0x10028099
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x100280af
lea ecx, [ebp - 4]
push 0
push ecx
push 0
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
lea edx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100280f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 4
call fcn.10084230
push edi
mov edi, dword [esp + 0x14]
xor cl, cl
test edi, edi
mov byte [esp + 4], cl
jbe 0x10028128
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
dec edi
jne 0x10028115
pop esi
mov byte [esp + 8], cl
pop ebx
mov eax, dword [esp + 4]
pop edi
and eax, 0xff
pop ecx
ret