joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100199a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x20c], 0
push 0xc
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.10013ba0
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x100199fc
xor edx, edx
je 0x100199fa
jmp 0x100199f4
jmp 0x10019a67
push 0
push str.Packages
push 0x1002a3bc
lea eax, [ebp - 0x208]
push eax
call fcn.10016f50
add esp, 0x10
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x10019a67
xor ecx, ecx
je 0x10019a2c
jmp 0x10019a26
push 1
push 1
push 0
lea edx, [ebp - 0x218]
push edx
push 0x10019920
push 5
push 1
push 0x10038870
mov eax, dword [ebp - 0x220]
push eax
call fcn.1001b870
add esp, 0x24
push 0xfffffffffffffffe
lea ecx, [ebp - 0x220]
push ecx
call fcn.10013990
add esp, 8
lea edx, [ebp - 0x208]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x10019a93
xor eax, eax
je 0x10019a91
jmp 0x10019a8b
jmp 0x10019afe
push 0
push str.LocalLow
push 0x1002a3bc
lea ecx, [ebp - 0x208]
push ecx
call fcn.10016f50
add esp, 0x10
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x10019afe
xor edx, edx
je 0x10019ac3
jmp 0x10019abd
push 1
push 1
push 0
lea eax, [ebp - 0x218]
push eax
push 0x10019920
push 5
push 1
push 0x10038870
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.1001b870
add esp, 0x24
push 0xfffffffffffffffe
lea edx, [ebp - 0x224]
push edx
call fcn.10013990
add esp, 8
push 1
push 1
push 0
lea eax, [ebp - 0x218]
push eax
push 0x10019920
push 5
push 1
push 0x10038870
push 0x1003a0de
call fcn.1001b870
add esp, 0x24
push 0
mov ecx, dword [0x10038870]
push ecx
push 0x1002a3bc
push 0x100390c0
call fcn.10016f50
add esp, 0x10
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x10019b77
mov edx, dword [ebp - 0x20c]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.10019840
add esp, 8
push 0xfffffffffffffffe
lea ecx, [ebp - 0x20c]
push ecx
call fcn.10013990
add esp, 8
xor edx, edx
je 0x10019b7d
jmp 0x10019b77
cmp dword [ebp - 0x210], 0
je 0x10019b91
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x218]
mov dword [eax], ecx
mov eax, dword [ebp - 0x210]
mov esp, ebp
pop ebp
ret
Function at 0x1001a130
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x1001a161
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
cmp dword [eax + edx], 0x4550
je 0x1001a165
xor eax, eax
jmp 0x1001a1c7
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
cmp dword [edx], 0x4550
je 0x1001a184
xor eax, eax
jmp 0x1001a1c7
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 0x14
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
movzx edx, word [ecx]
cmp edx, 0x10b
je 0x1001a1b2
xor eax, eax
jmp 0x1001a1c7
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
add ecx, 0xe0
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1001b570
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0x238], 1
xor eax, eax
je 0x1001b589
jmp 0x1001b583
push 0
push 2
call dword [0x1003aa94]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x1001b5b0
xor ecx, ecx
je 0x1001b5a8
jmp 0x1001b5a2
or eax, 0xffffffff
jmp 0x1001b65f
push 0x22c
push 0
lea edx, [ebp - 0x230]
push edx
call fcn.10013ba0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x1001b601
xor edx, edx
je 0x1001b5ed
jmp 0x1001b5e7
mov eax, dword [ebp - 0x234]
push eax
call dword [0x1003aa30]
mov eax, 0xfffffffe
jmp 0x1001b65f
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x230]
push edx
call dword [ebp + 8]
add esp, 8
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x1001b623
jmp 0x1001b63a
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1001b601
xor edx, edx
je 0x1001b640
jmp 0x1001b63a
mov eax, dword [ebp - 0x234]
push eax
call dword [0x1003aa30]
cmp dword [ebp - 0x238], 0
jne 0x1001b65d
mov eax, 1
jmp 0x1001b65f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001b870
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov dword [ebp - 4], 0
mov dword [ebp - 0x260], 0
push 0
push 0x1002f898
mov eax, dword [ebp + 8]
push eax
call fcn.10016f50
add esp, 0xc
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jne 0x1001b8b7
xor ecx, ecx
je 0x1001b8b2
jmp 0x1001b8ac
jmp 0x1001ba7b
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
je 0x1001ba6a
mov dword [ebp - 0x264], 0
cmp dword [ebp + 0x20], 0
je 0x1001b906
push 0
mov ecx, dword [ebp + 0x20]
push ecx
call dword [0x1003aae0]
cmp eax, 0x102
je 0x1001b906
jmp 0x1001ba5d
lea edx, [ebp - 0x22c]
push edx
call fcn.1001b820
add esp, 4
test eax, eax
jne 0x1001ba41
mov eax, dword [ebp - 0x258]
and eax, 0x10
je 0x1001b930
mov ecx, dword [ebp + 0x14]
and ecx, 2
jne 0x1001b943
mov edx, dword [ebp - 0x258]
and edx, 0x10
jne 0x1001b9b1
mov eax, dword [ebp + 0x14]
and eax, 4
je 0x1001b9b1
mov dword [ebp - 4], 0
jmp 0x1001b955
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0x10]
jae 0x1001b9b1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
push edx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x1001b9af
mov ecx, dword [ebp + 0x1c]
push ecx
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp + 0x18]
add esp, 0xc
test eax, eax
je 0x1001b9a3
cmp dword [ebp + 0x28], 0
je 0x1001b9a1
mov ecx, dword [ebp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001b9af
mov dword [ebp - 0x264], 1
jmp 0x1001b9b1
jmp 0x1001b94c
mov edx, dword [ebp - 0x258]
and edx, 0x10
je 0x1001ba41
mov eax, dword [ebp + 0x14]
and eax, 1
je 0x1001ba41
push 0
lea ecx, [ebp - 0x22c]
push ecx
push 0x1002a3bc
mov edx, dword [ebp + 8]
push edx
call fcn.10016f50
add esp, 0x10
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
je 0x1001ba41
cmp dword [ebp + 0x24], 0
je 0x1001ba01
mov eax, dword [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x268]
push eax
call fcn.1001b870
add esp, 0x24
push 0xfffffffffffffffe
lea ecx, [ebp - 0x268]
push ecx
call fcn.10013990
add esp, 8
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001b8e8
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [0x1003a9f8]
push 0xfffffffffffffffe
lea edx, [ebp - 0x260]
push edx
call fcn.10013990
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x1001ba80
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1001bb63
mov dx, word [0x1002a6e0]
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor ecx, ecx
je 0x1001bad2
jmp 0x1001bacc
push 0xf4240
push 1
push 0x100394fc
call fcn.100156d0
add esp, 0xc
push eax
mov edx, dword [ebp + 0xc]
push edx
push str._S._06d
push 0x207
lea eax, [ebp - 0x210]
push eax
call fcn.10013ca0
add esp, 0x14
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1001bb28
xor eax, eax
je 0x1001bb1f
jmp 0x1001bb19
mov dword [ebp - 4], 0xffffffff
jmp 0x1001bb61
xor ecx, ecx
je 0x1001bb2e
jmp 0x1001bb28
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1001bb51
xor ecx, ecx
je 0x1001bb48
jmp 0x1001bb42
mov dword [ebp - 4], 0xffffffff
jmp 0x1001bb61
xor edx, edx
je 0x1001bb57
jmp 0x1001bb51
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1001bb73
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
je 0x1001bb73
jmp 0x1001bb6d
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1001bb80
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x200
push 0
lea ecx, [ebp - 0x200]
push ecx
call fcn.10013ba0
add esp, 0xc
push 0x200
lea edx, [ebp - 0x200]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10019110
add esp, 0xc
xor ecx, ecx
je 0x1001bbcc
jmp 0x1001bbc6
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1001bbef
xor eax, eax
je 0x1001bbe0
jmp 0x1001bbda
mov eax, 1
jmp 0x1001bc95
mov dword [ebp - 0x204], 0
xor ecx, ecx
je 0x1001bbff
jmp 0x1001bbf9
push 0xffffffffffffffff
push 1
push 0x100394fc
call fcn.100156d0
add esp, 0xc
push eax
push 0x1002f8b0
push 0x20
lea edx, [ebp - 0x248]
push edx
call fcn.10013ca0
add esp, 0x10
push 0
lea eax, [ebp - 0x248]
push eax
push 0x1002a3e8
mov ecx, dword [ebp - 0x204]
push ecx
call fcn.10016f50
add esp, 0x10
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
je 0x1001bc8c
mov edx, dword [ebp - 0x204]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1001ba80
add esp, 8
mov dword [ebp - 0x24c], eax
push 0xfffffffffffffffe
lea ecx, [ebp - 0x204]
push ecx
call fcn.10013990
add esp, 8
cmp dword [ebp - 0x24c], 0
jge 0x1001bc8a
xor eax, eax
jmp 0x1001bc95
jmp 0x1001bc90
xor eax, eax
jmp 0x1001bc95
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1001bca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [ebp - 4], 0xffffffff
setne cl
mov dword [ebp - 8], ecx
xor edx, edx
je 0x1001bccc
jmp 0x1001bcc6
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1001bce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0xffffffff
setne al
mov esp, ebp
pop ebp
ret

Function at 0x1001bd00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x1001bd2a
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x1001bd2a
mov dword [ebp - 8], 1
jmp 0x1001bd31
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1001bd40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov ax, word [0x1002a6e0]
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x214], 0
push 0x10
call fcn.10013960
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001be4b
push 0x264d
call fcn.10015230
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x1001bde9
push 0x207
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1001bdda
xor ecx, ecx
je 0x1001bdda
jmp 0x1001bdd4
lea edx, [ebp - 0x214]
push edx
call fcn.10015460
add esp, 4
xor eax, eax
je 0x1001bdef
jmp 0x1001bde9
push 0x1003a2e8
call fcn.10016c90
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
lea edx, [ebp - 0x210]
push edx
call fcn.10016c90
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
push 0x1003a0de
call fcn.10016c90
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
push 0x100390c0
call fcn.10016c90
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
cmp dword [ebp + 8], 0
je 0x1001be4b
mov edx, dword [ebp + 8]
mov dword [edx], 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001cdf3
Capabilities:
Schedule task via itaskscheduler
Schedule task via itaskservice

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10038aa4], 5
jbe 0x1001ce05
pop ebp
jmp fcn.1001cbaf
pop ebp
jmp fcn.1001ca10
Function at 0x1001d810
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 5
push 8
call fcn.1001d630
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001d856
xor eax, eax
jmp 0x1001d917
lea eax, [ebp - 0x10]
push eax
push 2
mov ecx, dword [ebp - 8]
push ecx
call fcn.1001d6a0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001d876
jmp 0x1001d8f6
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call dword [0x1003aad8]
test eax, eax
jne 0x1001d8a5
xor ecx, ecx
je 0x1001d8a3
jmp 0x1001d89d
jmp 0x1001d8f6
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
jmp 0x1001d8be
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax]
jae 0x1001d8ec
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax*8 + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1001d8ea
mov dword [ebp - 0x20], 1
jmp 0x1001d8ec
jmp 0x1001d8b5
mov eax, dword [ebp - 0xc]
push eax
call dword [0x1003aa78]
mov ecx, dword [ebp - 8]
push ecx
call dword [0x1003aa30]
cmp dword [ebp - 4], 0
je 0x1001d914
push 0
lea edx, [ebp - 4]
push edx
call fcn.10013990
add esp, 8
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret

Function at 0x1001d920
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 5
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x12
push 1
lea ecx, [ebp - 0xc]
push ecx
call dword [0x1003aad8]
test eax, eax
jne 0x1001d973
xor edx, edx
je 0x1001d96f
jmp 0x1001d969
xor eax, eax
jmp 0x1001d991
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
push edx
call dword [0x1003aa78]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1001ddf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
movzx edx, word [ebp + 0xc]
push edx
call fcn.1001dea0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1001de34
xor eax, eax
jmp 0x1001de95
xor eax, eax
je 0x1001de3a
jmp 0x1001de34
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
add eax, 8
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001de69
xor eax, eax
je 0x1001de67
jmp 0x1001de61
jmp 0x1001de80
xor ecx, ecx
je 0x1001de6f
jmp 0x1001de69
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [ebp - 8], 1
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.10013990
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1001e900
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
xor eax, eax
mov word [ebp - 4], ax
cmp dword [0x10038b40], 0
je 0x1001e920
mov ecx, 9
mov word [ebp - 4], cx
jmp 0x1001e932
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x28]
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
cmp ecx, 9
jne 0x1001e943
xor edx, edx
je 0x1001e941
jmp 0x1001e93b
jmp 0x1001e959
movzx eax, word [ebp - 4]
test eax, eax
jne 0x1001e953
xor ecx, ecx
je 0x1001e951
jmp 0x1001e94b
jmp 0x1001e959
xor edx, edx
je 0x1001e959
jmp 0x1001e953
mov ax, word [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001f510
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
cmp dword [0x10038b40], 0
je 0x1001f56a
mov dword [ebp - 0x14], 0x72d
mov dword [ebp - 0x1c], 0xa90
mov dword [ebp - 0x18], 0x26c0
jmp 0x1001f57f
mov dword [ebp - 0x14], 0xabc
mov dword [ebp - 0x1c], 0xb34
mov dword [ebp - 0x18], 0x149b
mov eax, dword [0x1003a748]
and eax, 0x200
jne 0x1001f5c6
mov ecx, dword [0x1003a748]
and ecx, 0x10
jne 0x1001f5c6
mov edx, dword [0x1003a748]
and edx, 2
jne 0x1001f5c6
mov eax, dword [0x1003a748]
and eax, 0x100
jne 0x1001f5c6
mov ecx, dword [0x1003a748]
and ecx, 0x80
jne 0x1001f5c6
mov edx, dword [0x1003a748]
and edx, 0x40
je 0x1001f5da
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
jmp 0x1001f5ec
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
shl eax, 2
push eax
call fcn.10013960
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1001f612
xor eax, eax
jmp 0x1001f692
mov dword [ebp - 8], 0
jmp 0x1001f624
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jae 0x1001f687
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x28]
push ecx
call fcn.10015230
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x1001f685
push 0x104
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
je 0x1001f661
jmp 0x1001f65b
lea edx, [ebp - 0x2c]
push edx
call fcn.10015460
add esp, 4
lea eax, [ebp - 0x240]
push eax
call fcn.10016c90
add esp, 4
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [edx + ecx*4], eax
jmp 0x1001f61b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x1001f7f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x1001f819
xor edx, edx
je 0x1001f812
jmp 0x1001f80c
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001feb0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x1001fe70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
jne 0x1001ff04
push 2
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, 1
jmp 0x1001ff06
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10020390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + 0x100]
mov byte [ebp - 2], cl
mov edx, dword [ebp + 0x10]
mov al, byte [edx + 0x101]
mov byte [ebp - 1], al
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
jmp 0x100203c7
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jge 0x1002048b
movzx ecx, byte [ebp - 2]
add ecx, 1
and ecx, 0x800000ff
jns 0x100203ea
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 2], cl
movzx edx, byte [ebp - 2]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
movzx edx, byte [ebp - 1]
add ecx, edx
and ecx, 0x800000ff
jns 0x1002040e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [ebp - 1], cl
movzx eax, byte [ebp - 2]
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + eax]
mov byte [ebp - 9], dl
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov al, byte [esi + eax]
mov byte [edx + ecx], al
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x10]
mov al, byte [ebp - 9]
mov byte [edx + ecx], al
movzx ecx, byte [ebp - 2]
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + ecx]
movzx ecx, byte [ebp - 1]
mov edx, dword [ebp - 0x10]
movzx ecx, byte [edx + ecx]
add eax, ecx
and eax, 0x800000ff
jns 0x10020465
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0xa], al
movzx edx, byte [ebp - 0xa]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov byte [ecx], al
jmp 0x100203be
mov edx, dword [ebp + 0x10]
mov al, byte [ebp - 2]
mov byte [edx + 0x100], al
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp - 1]
mov byte [ecx + 0x101], dl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100204b0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x5c], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x60], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x64], 0
pop ebp
ret