joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100024e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x11183058
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_jc]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x11183058], cl
inc eax
cmp eax, 0x100
jb 0x10002500
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x11183058
push 0
mov ecx, 0x10125528
call fcn.1000acc0
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x11182af0], ecx
mov dword [ebp - 4], 0
jbe 0x100025f8
mov edi, dword [0x101254e0]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x100025ab
mov eax, dword [0x101254dc]
cmp eax, ebx
ja 0x100025ab
mov ecx, ebx
sub ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x101254e4]
jne 0x1000259a
mov ecx, 0x101254dc
call fcn.10003010
mov edi, dword [0x101254e0]
mov eax, dword [0x101254dc]
lea edx, [esi + esi*8]
lea esi, [eax + edx*8]
test edi, edi
je 0x100025d6
jmp 0x100025c9
cmp edi, dword [0x101254e4]
jne 0x100025c3
mov ecx, 0x101254dc
call fcn.10003010
mov edi, dword [0x101254e0]
test edi, edi
je 0x100025d9
mov esi, ebx
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x101254e0]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x48
mov dword [0x101254e0], edi
movzx ecx, byte [esi + 8]
inc eax
add ebx, 0x48
mov dword [ebp - 4], eax
cmp eax, ecx
jl 0x10002560
pop edi
pop esi
mov dword [0x11182ae0], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002610
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x11183058
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x1001e260]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x11183058], cl
inc eax
cmp eax, 0x100
jb 0x10002630
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x11183058
push 0
mov ecx, 0x10125528
call fcn.1000acc0
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x11182af4], ecx
mov dword [ebp - 4], 0
jbe 0x1000272f
mov edi, dword [0x101254f0]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x100026dc
mov eax, dword [0x101254ec]
cmp eax, ebx
ja 0x100026dc
mov ecx, ebx
sub ecx, eax
mov eax, 0x3e0f83e1
imul ecx
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x101254f4]
jne 0x100026ca
mov ecx, 0x101254ec
call fcn.10003080
mov edi, dword [0x101254f0]
imul esi, esi, 0x108
add esi, dword [0x101254ec]
test edi, edi
je 0x10002707
jmp 0x100026fa
cmp edi, dword [0x101254f4]
jne 0x100026f4
mov ecx, 0x101254ec
call fcn.10003080
mov edi, dword [0x101254f0]
test edi, edi
je 0x1000270a
mov esi, ebx
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x101254f0]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x108
mov dword [0x101254f0], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x108
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x10002690
pop edi
pop esi
mov dword [0x11182ae4], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002740
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x11183058
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_j_]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x11183058], cl
inc eax
cmp eax, 0x100
jb 0x10002760
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x11183058
push 0
mov ecx, 0x10125528
call fcn.1000acc0
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x11182af8], ecx
mov dword [ebp - 4], 0
jbe 0x10002860
mov edi, dword [0x10125500]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x1000280c
mov eax, dword [0x101254fc]
cmp eax, ebx
ja 0x1000280c
mov ecx, ebx
sub ecx, eax
mov eax, 0x7d8c42b3
imul ecx
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x10125504]
jne 0x100027fa
mov ecx, 0x101254fc
call fcn.100030f0
mov edi, dword [0x10125500]
imul esi, esi, 0x105
add esi, dword [0x101254fc]
test edi, edi
je 0x10002838
jmp 0x1000282a
cmp edi, dword [0x10125504]
jne 0x10002824
mov ecx, 0x101254fc
call fcn.100030f0
mov edi, dword [0x10125500]
test edi, edi
je 0x1000283b
mov esi, ebx
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x10125500]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x105
mov dword [0x10125500], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x105
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x100027c0
pop edi
pop esi
mov dword [0x11182ae8], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002880
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x11183058
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_jv]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x11183058], cl
inc eax
cmp eax, 0x100
jb 0x100028a0
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x11183058
push 0
mov ecx, 0x10125528
call fcn.1000acc0
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x11182afc], ecx
mov dword [ebp - 4], 0
jbe 0x1000299d
mov edi, dword [0x10125510]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x1000294f
mov eax, dword [0x1012550c]
cmp eax, ebx
ja 0x1000294f
mov ecx, ebx
sub ecx, eax
mov eax, 0x7e07e07f
imul ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x10125514]
jne 0x1000293a
mov ecx, 0x1012550c
call fcn.10003160
mov edi, dword [0x10125510]
mov eax, esi
shl eax, 6
add eax, dword [0x1012550c]
add eax, esi
test edi, edi
je 0x1000297b
mov esi, eax
jmp 0x1000296d
cmp edi, dword [0x10125514]
jne 0x10002967
mov ecx, 0x1012550c
call fcn.10003160
mov edi, dword [0x10125510]
test edi, edi
je 0x1000297e
mov esi, ebx
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x10125510]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x41
mov dword [0x10125510], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x41
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x10002900
pop edi
pop esi
mov dword [0x11182aec], 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100029b0
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x100
push 0
push 0x11183058
mov esi, eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + str.r_jj]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x11183058], cl
inc eax
cmp eax, 0x100
jb 0x100029d0
movzx edx, byte [esi + 4]
push edx
push 0x11183058
push 0
mov ecx, 0x10125528
call fcn.1000acc0
movzx eax, byte [esi + 4]
add esp, 0xc
cmp eax, 0xd
ja case.0x10002a10.11
jmp dword [eax*4 + 0x10002ab0]
add esi, 5
push esi
push 2
mov eax, 0x1012f628
call fcn.10013bd0
add esp, 8
pop esi
ret
push 0x3c
push 0
push 0x11182a2c
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0xf1
push 0xc1
mov eax, 0x404b90
mov ecx, 0x11182a2c
call eax
push 2
mov edx, 0x4050d0
mov ecx, 0x11182a2c
call edx
push 2
mov eax, 0x4050d0
mov ecx, 0x11182a2c
call eax
push 0
push 1
mov ecx, 0x11182a2c
call dword [0x11182a70]
push 0x3c
push 0
push 0x11182a2c
call sub.MSVCR100.dll_memset
add esp, 0xc
pop esi
ret
mov ecx, 0x15
call fcn.1000b270
push eax
push 2
mov eax, 0x1012f628
call fcn.10013bd0
add esp, 8
pop esi
ret
Function at 0x10002af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
cmp dword [0x11182b14], 1
push edi
je 0x10002b98
mov ecx, dword [0x101254dc]
mov dword [0x11182adc], ebx
mov dword [0x11182ae0], ebx
mov dword [0x11182ae4], ebx
mov dword [0x11182ae8], ebx
mov dword [0x11182aec], ebx
mov dword [0x11182af0], ebx
mov dword [0x11182af4], ebx
mov dword [0x11182af8], ebx
mov dword [0x11182afc], ebx
cmp ecx, dword [0x101254e0]
je 0x10002b5c
mov dword [0x101254e0], ecx
mov ecx, dword [0x101254ec]
cmp ecx, dword [0x101254f0]
je 0x10002b70
mov dword [0x101254f0], ecx
mov ecx, dword [0x101254fc]
cmp ecx, dword [0x10125500]
je 0x10002b84
mov dword [0x10125500], ecx
mov ecx, dword [0x1012550c]
cmp ecx, dword [0x10125510]
je 0x10002b98
mov dword [0x10125510], ecx
mov dword [0x1012f38c], ebx
mov dword [0x1012f394], ebx
mov word [ebp - 0x3c], 0x38c1
call dword [sym.imp.MSVCR100.dll_rand]
and eax, 0x800000ff
jns 0x10002bbe
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [0x1012f37c]
mov edx, dword [str.1.7.0]
mov byte [ebp - 0x3a], al
mov eax, dword [0x11182b14]
mov dword [ebp - 0x38], eax
mov eax, dword [0x1001f8a4]
mov byte [ebp - 0x39], bl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
call fcn.10013d80
push 0x100
mov esi, eax
push ebx
mov ecx, 9
lea edi, [ebp - 0x28]
push 0x11183058
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x1001e560]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x11183058], cl
inc eax
cmp eax, 0x100
jb 0x10002c10
mov ecx, dword [ebp - 0x34]
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x30]
push eax
push ecx
push edx
push 0x11183058
push ebx
mov ecx, 0x10125528
call fcn.1000acc0
movzx ecx, byte [ebp - 0x3b]
add esp, 0x18
lea edx, [ebp - 0x3c]
call fcn.100019b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018a26
mov esp, ebp
pop ebp
ret
Function at 0x10003a10
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
mov eax, dword [0x1012fe14]
test eax, eax
je 0x10003abe
mov ecx, dword [eax]
cmp ecx, dword [0x1012fe28]
jne 0x10003a37
mov dl, byte [0x1012fe2c]
cmp dl, byte [eax + 4]
je 0x10003abe
push 0x100
push 0
push 0x11183058
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x1001d560]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x11183058], cl
inc eax
cmp eax, 0x100
jb 0x10003a50
push 0x11183058
push 0
mov ecx, 0x10125528
call fcn.1000acc0
xor eax, eax
add esp, 8
push eax
mov dword [0x11182e08], eax
mov dword [0x11182e0c], eax
mov dword [0x11182e10], eax
mov dword [0x11182e14], eax
mov dword [0x11182e18], eax
mov dword [0x11182e1c], eax
mov dword [0x11182e20], eax
mov dword [0x11182e24], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov eax, dword [0x1012fe10]
test eax, eax
je 0x10003ae3
mov edx, dword [eax]
cmp edx, dword [0x1012fe20]
jne 0x10003adc
mov cl, byte [0x1012fe24]
cmp cl, byte [eax + 4]
je 0x10003ae3
mov eax, 0x10
jmp 0x10003b06
mov eax, dword [0x1012fe0c]
test eax, eax
je 0x10003b20
mov edx, dword [eax]
cmp edx, dword [0x1012fe18]
jne 0x10003b01
mov cl, byte [0x1012fe1c]
cmp cl, byte [eax + 4]
je 0x10003b20
mov eax, 0x11
call fcn.100154d0
push eax
push 0
mov ecx, 0x10125528
call fcn.1000acc0
add esp, 8
call fcn.10015730
pop ecx
ret
Function at 0x10003ec0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov byte [0x11183174], 0
test esi, esi
jne 0x10003f3e
mov ecx, 0x5f
xor eax, eax
mov dl, byte [eax + 0x1001f954]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x20], dl
inc eax
and ecx, 0xff
cmp eax, 0x17
jb 0x10003ee7
xor eax, eax
push eax
mov dword [0x11182e08], eax
mov dword [0x11182e0c], eax
mov dword [0x11182e10], eax
mov dword [0x11182e14], eax
mov dword [0x11182e18], eax
mov dword [0x11182e1c], eax
mov dword [0x11182e20], eax
mov dword [0x11182e24], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
lea eax, [ebp - 0x38]
push eax
mov ebx, 0x33
mov eax, esi
mov dword [ebp - 0x38], 0xccccccc3
mov dword [ebp - 0x34], 0xcccccccc
mov dword [ebp - 0x30], 0xcccccccc
mov dword [ebp - 0x2c], 0xcccccccc
mov dword [ebp - 0x28], 0xcccccccc
mov dword [ebp - 0x24], 0xcccccccc
mov dword [ebp - 0x20], 0xcccccccc
mov dword [ebp - 0x1c], 0xff8bcccc
mov dword [ebp - 0x18], 0xffff8904
mov dword [ebp - 0x14], 0x8bffffff
mov dword [ebp - 0x10], 0xff8908ff
mov dword [ebp - 0xc], 0xffffffff
mov word [ebp - 8], 0xff8b
mov byte [ebp - 6], 0xc
call fcn.10015630
add esp, 4
test eax, eax
je 0x10004031
lea esi, [eax + 0x1e]
mov dword [0x11182a28], 0x70
mov dword [0x111829e0], esi
call fcn.10017be0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.100180c0
push 0x10003e80
push 0x111829e0
call fcn.10017690
call fcn.10017c50
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x3c]
push ecx
push 0x40
push 5
push esi
call edi
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x40]
push eax
push ecx
mov edx, 0x10003e90
sub edx, esi
push 5
sub edx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], edx
call edi
mov byte [0x11183174], 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a26
mov esp, ebp
pop ebp
ret
mov ecx, 0x4f
xor eax, eax
inc ecx
inc eax
and ecx, 0xff
cmp eax, 0x20
jb 0x10004038
call fcn.10015730
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018a26
mov esp, ebp
pop ebp
ret

Function at 0x100040c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5b55ea
call esi
mov ecx, 0x10004060
mov byte [0x5b55ea], 0xe9
sub ecx, 0x5b55ef
lea edx, [ebp - 8]
push edx
mov dword [0x5b55eb], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push 0x5b55ea
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x5a3c70
call esi
mov edx, 0x100040a0
mov byte [0x5a3c70], 0xe9
sub edx, 0x5a3c75
lea eax, [ebp - 8]
push eax
mov dword [0x5a3c71], edx
mov ecx, dword [ebp - 4]
push ecx
push 5
push 0x5a3c70
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009520
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xf0
xor ecx, ecx
jmp 0x10009530
mov al, byte [edi + ecx + 0x79ddc0fb]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x1e
jb 0x10009530
mov byte [esi + 0x1e], 0
mov eax, esi
ret

Function at 0x10009550
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x82
xor ecx, ecx
jmp 0x10009560
mov al, byte [edi + ecx + 0x2e62e9b2]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x19
jb 0x10009560
mov byte [esi + 0x19], 0
mov eax, esi
ret

Function at 0x10009580
Capabilities:
Encode data using xor

Disassembly:
mov edx, 9
xor ecx, ecx
jmp 0x10009590
mov al, byte [edi + ecx - 0x7bd60ae8]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x1a
jb 0x10009590
mov byte [esi + 0x1a], 0
mov eax, esi
ret

Function at 0x10009620
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x3f
xor ecx, ecx
jmp 0x10009630
mov al, byte [edi + ecx + 0x4e70b2ed]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xb
jb 0x10009630
mov byte [esi + 0xb], 0
mov eax, esi
ret
Function at 0x1000aba0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10125740]
push ebx
push esi
push edi
test eax, eax
js 0x1000aca9
cmp eax, 1
jge 0x1000aca9
mov esi, eax
imul esi, esi, 0x214
push ecx
add esi, 0x1012552c
inc eax
lea edi, [esi + 4]
push 0x100
mov dword [0x10125740], eax
push edi
mov dword [esi], 1
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
cmp dword [esi], 0
je 0x1000aca9
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0x14]
push eax
push ecx
push edx
push edi
lea ebx, [esi + 0x110]
push str.._s_04d__02d__02d.log
push ebx
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
mov dword [esi + 0x10c], edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x1000ac84
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a26
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1000aca9
mov ecx, dword [esi + 0x210]
push ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018a26
mov esp, ebp
pop ebp
ret
Function at 0x1000acc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
js 0x1000aeb7
cmp eax, dword [ecx + 0x218]
jge 0x1000aeb7
imul eax, eax, 0x214
cmp dword [eax + ecx + 4], 0
lea esi, [eax + ecx + 4]
je 0x1000aeb7
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x812]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp ecx, dword [esi + 0x104]
jne 0x1000ad46
movzx edx, word [ebp - 0x816]
cmp edx, dword [esi + 0x108]
jne 0x1000ad46
movzx eax, word [ebp - 0x818]
cmp eax, dword [esi + 0x10c]
je 0x1000ae03
mov ecx, dword [esi + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [ebp - 0x812]
movzx ecx, word [ebp - 0x816]
movzx edx, word [ebp - 0x818]
push eax
push ecx
push edx
mov dword [esi + 0x10c], edx
lea edx, [esi + 4]
push edx
lea edi, [esi + 0x110]
push str.._s_04d__02d__02d.log
push edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
call ebx
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x1000adcd
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a26
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1000ae03
mov eax, dword [esi + 0x210]
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a26
mov esp, ebp
pop ebp
ret
push 0x3ff
lea ecx, [ebp - 0x807]
push 0
push ecx
mov byte [ebp - 0x808], 0
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
lea ecx, [ebp - 0x808]
push 0x400
push ecx
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
push 0x3ff
lea edx, [ebp - 0x407]
push 0
push edx
mov byte [ebp - 0x408], 0
call sub.MSVCR100.dll_memset
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
lea eax, [ebp - 0x808]
push eax
movzx eax, word [ebp - 0x810]
push ecx
push edx
push eax
lea ecx, [ebp - 0x408]
push str._02d:_02d:_02d__s_r_n
push ecx
call ebx
lea eax, [ebp - 0x408]
add esp, 0x40
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000ae90
mov ecx, dword [esi + 0x210]
sub eax, edx
push 0
lea edx, [ebp - 0x81c]
push edx
push eax
lea eax, [ebp - 0x408]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018a26
mov esp, ebp
pop ebp
ret

Function at 0x1000af00
Capabilities:
Create thread

Disassembly:
cmp dword [0x11182b08], 0
je 0x1000af46
mov eax, dword [0x111829e4]
push 0x11182e18
mov dword [0x10125748], eax
xor eax, eax
push eax
push 0x10125744
push 0x1000b030
push eax
push eax
mov dword [0x10125750], eax
mov dword [0x10125754], eax
mov dword [0x10125758], eax
mov dword [0x1012575c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1012574c], eax
ret
Function at 0x1000af50
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x11182b28], 0
je 0x1000af6d
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x11182b28]
cmp eax, dword [ecx]
jne case.0x1000afa3.0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi*4 + 0x10125750]
cmp eax, 0x1388
jb 0x1000af98
call edi
mov dword [esi*4 + 0x10125750], eax
mov dword [esi*4 + 0x10125758], 0
mov eax, dword [0x11182b0c]
pop edi
cmp eax, 5
ja case.default.0x1000afa3
jmp dword [eax*4 + 0x1000b010]
inc dword [esi*4 + 0x10125758]
cmp dword [esi*4 + 0x10125758], 0x19
jmp 0x1000affd
inc dword [esi*4 + 0x10125758]
cmp dword [esi*4 + 0x10125758], 0x14
jmp 0x1000affd
inc dword [esi*4 + 0x10125758]
cmp dword [esi*4 + 0x10125758], 0xf
jmp 0x1000affd
inc dword [esi*4 + 0x10125758]
cmp dword [esi*4 + 0x10125758], 0xa
jmp 0x1000affd
inc dword [esi*4 + 0x10125758]
cmp dword [esi*4 + 0x10125758], 5
jbe case.0x1000afa3.0
push 0
push 9
xor ecx, ecx
call fcn.10002c70
add esp, 8
ret
Function at 0x1000b3c0
Capabilities:
Create process on windows
Encode data using xor
Get process image filename
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x580
mov eax, dword [0x10025018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x40
lea eax, [ebp - 0x48]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x560]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x208
lea edx, [ebp - 0x358]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000b5b9
push 0x104
lea eax, [ebp - 0x560]
push eax
push edi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1000b5b2
lea ecx, [ebp - 0x358]
push ecx
lea ecx, [ebp - 0x560]
call fcn.10013890
add esp, 4
test al, al
je 0x1000b5b2
push 0x40
lea edx, [ebp - 0x48]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea esi, [ebp - 0x560]
mov word [ebp - 0x57c], 0x5325
mov byte [ebp - 0x57a], 0
call fcn.10013ae0
push eax
lea eax, [ebp - 0x57c]
push eax
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x358]
call fcn.1000a750
test al, al
jne 0x1000b542
mov ecx, 0xdd
xor eax, eax
nop
mov dl, byte [eax + 0x10020010]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x578], dl
inc eax
and ecx, 0xff
cmp eax, 0x16
jb 0x1000b4c0
push ebx
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x150]
push ecx
mov byte [ebp - 0x562], 0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea eax, [ebp - 0x150]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a26
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x358]
push ecx
lea ecx, [ebp - 0x48]
call fcn.1000aa60
test al, al
jne 0x1000b57c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 2
lea ecx, [ebp - 0x48]
call fcn.10002c70
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a26
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x358]
call fcn.10003860
test al, al
jne 0x1000b5b2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 5
lea ecx, [ebp - 0x48]
call fcn.10002c70
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a26
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10018a26
mov esp, ebp
pop ebp
ret