joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403464
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x40348a
mov eax, dword [ebp + 8]
lea ecx, [esi + eax]
xor edx, edx
mov eax, esi
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov al, byte [edx + eax]
xor byte [ecx], al
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x40346f
pop esi
pop ebp
ret 0x10

Function at 0x403633
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], 2
mov byte [ebp - 1], 0
mov esi, edx
mov dword [ebp - 0xc], 6
sub edi, edx
mov dword [ebp - 0x10], 3
push ebx
mov al, byte [esi]
mov cl, byte [ebp - 8]
add dword [ebp - 8], 2
mov bl, al
shr bl, cl
mov ecx, dword [ebp - 0xc]
sub dword [ebp - 0xc], 2
shl al, cl
or bl, byte [ebp - 1]
mov byte [edi + esi], bl
shr al, 2
inc esi
dec dword [ebp - 0x10]
mov byte [ebp - 1], al
jne 0x40365c
mov al, byte [edx + 2]
mov edx, dword [ebp + 8]
and al, 0x3f
mov byte [edx + 3], al
xor esi, esi
pop ebx
lea ecx, [esi + edx]
mov al, byte [ecx]
cmp al, 0x19
ja 0x40369f
add al, 0x41
jmp 0x4036b5
cmp al, 0x1a
jb 0x4036ab
cmp al, 0x33
ja 0x4036ab
add al, 0x47
jmp 0x4036b5
cmp al, 0x34
jb 0x4036b9
cmp al, 0x3d
ja 0x4036b9
sub al, 4
mov byte [ecx], al
jmp 0x4036c9
cmp al, 0x3e
jne 0x4036c2
mov byte [ecx], 0x2b
jmp 0x4036c9
cmp al, 0x3f
jne 0x4036c9
mov byte [ecx], 0x2f
inc esi
cmp esi, 4
jl 0x403692
pop edi
pop esi
leave
ret 4

Function at 0x4036d5
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov dword [ebp - 4], 2
xor edx, edx
lea ecx, [edx + edi]
mov al, byte [ecx]
cmp al, 0x41
jb 0x4036f8
cmp al, 0x5a
ja 0x4036f8
sub al, 0x41
jmp 0x40370e
cmp al, 0x61
jb 0x403704
cmp al, 0x7a
ja 0x403704
sub al, 0x47
jmp 0x40370e
cmp al, 0x30
jb 0x403712
cmp al, 0x39
ja 0x403712
add al, 4
mov byte [ecx], al
jmp 0x40372b
cmp al, 0x2b
jne 0x40371b
mov byte [ecx], 0x3e
jmp 0x40372b
cmp al, 0x2f
jne 0x403724
mov byte [ecx], 0x3f
jmp 0x40372b
cmp al, 0x3d
jne 0x40372b
mov byte [ecx], 0
inc edx
cmp edx, 4
jl 0x4036e7
mov eax, dword [ebp + 8]
lea ecx, [edi + 1]
mov edx, ecx
sub edi, ecx
sub edx, eax
mov dword [ebp + 8], 3
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 2
lea esi, [edx + eax]
mov bl, byte [esi + edi]
shl bl, cl
mov cl, 8
sub cl, byte [ebp - 4]
mov byte [eax], bl
mov bl, byte [esi]
shr bl, cl
or byte [eax], bl
inc eax
dec dword [ebp + 8]
jne 0x403744
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41f60a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x41f619
pop dword [ebp - 0x34]
mov eax, 0x41f619
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x3c2b0798
add dword [ebp - 0x44], 0x12273db3
mov dword [ebp - 0x40], 0x65728bd3
sub dword [ebp - 0x40], 0x333f3f8e
mov dword [ebp - 0x3c], 0x5b42d39d
add dword [ebp - 0x3c], 0xf1097091
mov dword [ebp - 0x38], 0x9c6670c8
sub dword [ebp - 0x38], 0x9c6670c8
lea eax, [ebp - 0x44]
push eax
mov eax, 0x7d5f277c
sub eax, 0x7d1cf708
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x9397e9d5
add dword [ebp - 0x44], 0xe0da7f81
mov dword [ebp - 0x40], 0xc9905ed9
add dword [ebp - 0x40], 0x77dc029c
mov dword [ebp - 0x3c], 0x7a0b2273
sub dword [ebp - 0x3c], 0x169bb607
mov dword [ebp - 0x38], 0x1808c1d5
add dword [ebp - 0x38], 0xe7f73e2b
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3a043
push 0
call eax
mov ecx, 0x3954
mov ebx, eax
mov esi, 0x30df76f3
sub esi, 0x309c32f3
add esi, dword [ebp - 0x34]
mov edx, 0xe3fc7983
sub edx, 0x6bc46aa0
sub dword [ebp - 0x24], 0xf0ab0974
mov edi, dword [esi]
sub edi, edx
xor dword [ebp - 0x24], 0x5b9b39e9
mov dword [ebx], edi
sub dword [ebp - 0x30], 0x17cf9656
add ebx, 0x8345e60c
add ebx, 0x7cba19f8
add esi, 0xf7b84e2d
sub esi, 0xf7b84e29
loop 0x41f72b
add eax, 0x612cb3a
add eax, 0xf9ee0ce9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7df8f5af
add ecx, 0x82470a51
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10005170
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100059a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x100052c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10040cf8]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10005382
cmp byte [esi + 0x3d], 0
je 0x10005382
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000536f
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10005333
sub eax, 1
je 0x10005337
sub eax, 2
jne 0x1000536f
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10026c20
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x10005357
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000536f
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10026c20
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10026c20
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.10026c20
add esp, 0x28
ret
Function at 0x10005a30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x10040cf8]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10005a60
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10026c20
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10005a91
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10005a91
call dword [sym.imp.MSVCP140D.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10026c20
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10005b9b
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10005aba
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10005aef
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.ucrtbased.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10026c20
add esp, 0x30
ret 4
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1d]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10005b57
sub eax, 1
je 0x10005b57
sub eax, 2
jne 0x10005b9b
push dword [esi + 0x4c]
push dword [esp + 0x10]
call fcn.100048b0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10026c20
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x10005b77
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10005b9b
lea eax, [esp + 0xc]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
je 0x10005b9b
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10026c20
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10026c20
add esp, 0x30
ret 4
Function at 0x100062f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x10]
test eax, eax
jg 0x1000630f
jl 0x10006306
test ebp, ebp
jne 0x1000630f
pop ebp
xor eax, eax
xor edx, edx
pop ebx
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10006326
push eax
push ebp
push dword [esp + 0x14]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebp
pop ebx
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x10006366
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10006366
mov edi, dword [esp + 0x14]
cmp eax, ebp
mov esi, ebp
cmovb esi, eax
push esi
push ecx
push edi
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x20], edi
add esp, 0xc
mov edi, ebp
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
mov esi, dword [esp + 0x14]
je 0x100063dc
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10006393
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.ucrtbased.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x100063c8
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x100063ee
cmp edi, eax
mov eax, dword [sym.imp.ucrtbased.dll_fread]
ja 0x100063a2
test ecx, ecx
je 0x100063dc
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov edx, dword [esp + 0x1c]
sub ebp, ecx
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
ret 0xc
mov edx, dword [esp + 0x1c]
sub ebp, edi
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
ret 0xc
Function at 0x10006400
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10006425
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
add esp, 8
ret 0xc
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10006448
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1000644a
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100064c5
jg 0x1000645d
test esi, esi
je 0x100064c5
test eax, eax
jl 0x100064a7
jg 0x10006467
test ebp, ebp
je 0x100064a7
cmp edi, eax
jg 0x10006477
jl 0x10006471
cmp esi, ebp
jae 0x10006477
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [ebx + 0x30]
add esp, 0xc
mov ecx, dword [esp + 0x1c]
sub esi, ebp
sbb edi, dword [esp + 0x20]
add ecx, ebp
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
test edi, edi
jl 0x100064c5
jg 0x100064ab
test esi, esi
je 0x100064c5
jmp 0x100064ab
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100064c5
push eax
push esi
push 1
push ecx
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x100064e0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10006630
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000b4c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000b720
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000b4e0
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002868b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10040cf8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [eax], 0x8b55ff8b
je 0x1000b702
cmp dword [0x1004118c], 1
jne 0x1000b5a0
push 1
push 0x40
push 8
push 0x1002c05c
lea ecx, [ebp - 0x174]
call fcn.100049c0
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nSP_Scan:
push eax
call fcn.10004550
lea eax, [ebp - 0x174]
push 0x1002c080
push eax
call fcn.10004550
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.100054a0
test eax, eax
jne 0x1000b58e
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10004fb0
cmp dword [0x1004119c], 1
jne 0x1000b67f
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x1002c098
call fcn.100049c0
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x1002c09c
push eax
call fcn.10004550
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push str.SP_Scan:
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push 0x1002c0bc
push eax
call fcn.10004550
lea eax, [ebp - 0xc4]
push 0x1002c0d4
push eax
call fcn.10004550
add esp, 0x2c
lea ecx, [ebp - 0xc0]
call fcn.100054a0
test eax, eax
jne 0x1000b667
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x1002c0fc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10004fb0
mov eax, dword [0x10041190]
push 0
cmp eax, 1
jne 0x1000b6b1
push 0
push 0
push 0x1000b410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000b6c1
push 0
push 0
push 0x1000b390
jmp 0x1000b694
cmp eax, 3
jne 0x1000b6d1
push 0
push 0
push 0x1000b490
jmp 0x1000b694
cmp eax, 4
jne 0x1000b6ab
push 0
push 0
push 0x10026220
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.SP_Scan
push 0x1002c108
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000b6a9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c040
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
mov eax, dword [0x10041190]
push ebx
push ebp
push esi
push edi
cmp eax, 1
jne 0x1000c0bb
mov dword [esp + 0x10], 0x1002c6c0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c09f
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c099
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c083
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x1004110c]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000c12c
mov dword [esp + 0x10], 0x1002c740
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c110
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c10a
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c0f4
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x1004110c]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0x1002c7d8
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c17c
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c176
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c160
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x1004110c]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000c490
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.1000c9d0
mov eax, dword [0x10041190]
cmp eax, 1
jne 0x1000c510
mov dword [esp + 0x10], 0x1002c4d0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c4f4
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c4ee
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c4d8
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x1004110c]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000c588
mov dword [esp + 0x10], 0x1002c570
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c56c
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c566
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c550
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x1004110c]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0x1002c618
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c5dc
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c5d6
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c5c0
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x1004110c]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000c600
Capabilities:
Check os version
Encode data using xor
Query or enumerate registry value

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x1000c61b
mov dword [0x10041094], 1
add esp, 0xc
ret
push ebx
mov dword [esp + 4], 0x1002c988
mov ebx, dword [esp + 4]
push esi
mov esi, dword [esp + 8]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c671
mov eax, dword [ebx + 0xf]
push ebp
inc eax
push edi
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c669
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c653
mov byte [edi + ebp], 0
mov esi, edi
pop edi
pop ebp
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
pop ebx
test eax, eax
jne 0x1000c6c6
mov dword [esp], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0
push 0
push str.MoveImages
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000c6c1
mov dword [0x10041090], 1
add esp, 0xc
ret
call fcn.1000c7d0
add esp, 0xc
ret

Function at 0x1000c7d0
Capabilities:
Create thread
Get token membership

Disassembly:
sub esp, 0x18
mov eax, dword [0x10040cf8]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
xor esi, esi
mov dword [esp + 8], 0
lea eax, [esp + 4]
mov dword [esp + 4], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [esp + 0x38]
mov dword [esp + 0x38], esi
push eax
mov word [esp + 0x40], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1000c82f
lea eax, [esp + 8]
push eax
push dword [esp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1000c837
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x1000c84e
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [esp + 4], 0
test esi, esi
jne 0x1000c8ca
cmp dword [esp + 8], esi
je 0x1000c8a3
cmp dword [0x10041090], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x1000c877
push 0
push 0
push 0
push 0x1000cfb0
push 0
push 0
call esi
cmp dword [0x1004108c], 0
jne 0x1000c8b8
push 0
push 0
push 0
push fcn.1000c1a0
push 0
push 0
call esi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10026c20
add esp, 0x18
ret
push 0
push 0
push 0
push 0x1000c8e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10026c20
add esp, 0x18
ret
push 0x1003cae8
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
call sub.VCRUNTIME140D.dll__CxxThrowException
int3