joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000155c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0xffffffff
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100015b6
jmp 0x100016c9
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2c]
call dword [eax + 4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x100015d3
jmp 0x100016c7
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x100015f3
jmp 0x100016c5
mov eax, dword [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
call dword [edx + 8]
test eax, eax
je 0x1000162c
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
je 0x10001631
jmp 0x100016c3
push 0
push 0
push 2
push 0
push 1
push 0x40000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x10001655
jmp 0x100016c1
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x10], 0
je 0x10001684
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], 0
je 0x10001694
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 0xc], 0
je 0x100016ac
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp dword [ebp - 0x18], 0xffffffff
je 0x100016bc
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
jmp 0x100016cb
jmp 0x10001674
jmp 0x10001674
jmp 0x10001674
jmp 0x10001674
jmp 0x10001674
mov esp, ebp
pop ebp
ret 8
Function at 0x10002822
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5740
push 0x100c1d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff70
push ebx
push esi
push edi
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x88], 0
mov ecx, 0x19
xor eax, eax
lea edi, [ebp - 0x84]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
cmp eax, 1
jne 0x100028b2
jmp 0x100029a8
push 0
push 0
push 3
push 0
push 7
push connect
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xffffffff
jne 0x100028df
jmp 0x100029a8
push 0
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x100028fc
jmp 0x100029a8
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x98], eax
mov edx, dword [ebp - 0x98]
mov dword [ebp - 0x8c], edx
mov eax, dword [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp - 0x8c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10002953
jmp 0x100029a8
push 0
lea eax, [ebp - 0x88]
push eax
call fcn.10021d50
add esp, 8
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
lea eax, [ebp - 0x88]
push eax
call fcn.10021daf
add esp, 0xc
lea ecx, [ebp - 0x88]
push ecx
call fcn.10022e2d
add esp, 4
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100030e0
mov dword [ebp - 0x94], 1
mov dword [ebp - 4], 0xffffffff
call fcn.100029b6
jmp 0x100029f1
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000bd4f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push edi
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov byte [ebp - 8], 0x41
cmp dword [ebp + 8], 0
je 0x1000bd93
cmp dword [ebp + 0xc], 0
je 0x1000bd93
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
je 0x1000bd93
cmp dword [ebp + 0x10], 0
jne 0x1000bd98
jmp 0x1000be6c
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
movsx edx, byte [ebp - 8]
cmp edx, 0x5a
jg 0x1000be65
mov al, byte [ebp - 8]
add al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 8]
mov byte [ebp - 0x114], cl
mov byte [ebp - 0x113], 0x3a
mov byte [ebp - 0x112], 0
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x1000be05
jmp 0x1000bda1
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1000be60
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x114]
push eax
push 0x100f91b0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
mov dword [ebp - 0xc], 1
jmp 0x1000be6a
jmp 0x1000bda1
mov eax, dword [ebp - 0xc]
jmp 0x1000be6e
jmp 0x1000be65
jmp 0x1000be65
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000c10d
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5ea0
push 0x100c1d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0x2000
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0
push 0
push 0
push 3
push 0
push 1
push connect
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffff
jne 0x1000c194
jmp 0x1000c222
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x1c]
jae 0x1000c1ac
jmp 0x1000c222
mov edx, dword [ebp - 0x1c]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
mov edx, dword [ebp - 0x38]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000c1f1
jmp 0x1000c222
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov dx, word [ecx]
cmp edx, 0x5a4d
je 0x1000c203
jmp 0x1000c222
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 0x38]
lea ecx, [eax + edx + 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1000c230
jmp 0x1000c259
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000c56d
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push 3
push 1
push 0xf01ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000c5ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x431
jne 0x1000c5bd
mov al, 1
jmp 0x1000c5e0
cmp dword [ebp - 4], 0x430
jne 0x1000c5ca
xor al, al
jmp 0x1000c5e0
xor al, al
jmp 0x1000c5e0
cmp dword [ebp - 8], 0
je 0x1000c5de
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000c667
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000c68d
xor al, al
jmp 0x1000c6b8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x1000c6a1
mov byte [ebp - 8], 1
jmp 0x1000c6a5
mov byte [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x1000c6b5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1000c6bc
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000c6e2
xor al, al
jmp 0x1000c720
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x1000c70e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x420
jne 0x1000c70a
mov al, 1
jmp 0x1000c720
xor al, al
jmp 0x1000c720
cmp dword [ebp - 8], 0
je 0x1000c71e
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x1000c724
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov byte [ebp - 0x24], 1
push 0xf01ff
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000c74e
xor al, al
jmp 0x1000c77f
lea edx, [ebp - 0x20]
push edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1000c768
mov byte [ebp - 0x24], 1
jmp 0x1000c76c
mov byte [ebp - 0x24], 0
cmp dword [ebp - 4], 0
je 0x1000c77c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x1000ca0a
Capabilities:
Encrypt data using rc4 prga
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5eb8
push 0x100c1d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x1000caa9
mov edx, dword [ebp - 0x1c]
shr edx, 0x18
and edx, 0xff
mov byte [ebp - 0x28], dl
mov eax, dword [ebp - 0x28]
and eax, 0xff
mov ecx, dword [eax*4 + 0x100f91f4]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x30]
mov al, byte [edx]
mov byte [ebp - 0x24], al
mov ecx, dword [ebp - 0x1c]
shl ecx, 8
mov edx, dword [ebp - 0x24]
and edx, 0xff
or ecx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
jmp 0x1000ca45
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], 0xffffffff
jmp 0x1000cacf
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018e90
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp + 0x10]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x10018ecb
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 8], ecx
jge 0x10018efe
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x10018eb9
mov esp, ebp
pop ebp
ret
Function at 0x10019480
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
jmp 0x100194cd
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 0xc], ecx
jge 0x100195e9
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x20000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
and edx, 0x40000000
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x2000000
test eax, eax
je 0x1001954d
push 0x4000
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100194bb
mov edx, dword [ebp - 0x18]
shl edx, 4
mov eax, dword [ebp - 0x14]
lea ecx, [edx + eax*8 + 0x10101d54]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ecx + edx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
and edx, 0x4000000
test edx, edx
je 0x1001957f
mov eax, dword [ebp - 0x28]
or ah, 2
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0
jne 0x100195bf
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x40
test ecx, ecx
je 0x100195a6
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x20], eax
jmp 0x100195bf
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
and edx, 0x80
test edx, edx
je 0x100195bf
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
jbe 0x100195e4
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100194bb
mov esp, ebp
pop ebp
ret
Function at 0x100196b7
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.XTDL
push 0x10101d98
push 0x20
lea eax, [ebp - 0x28]
push eax
call fcn.1001a990
add esp, 0x18
lea ecx, [ebp - 0x28]
push ecx
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001973b
lea edx, [ebp - 0x28]
push edx
push 0x1000
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10019734
jmp 0x100197d5
mov dword [ebp - 8], 1
push 0
push 0
push 0
push 6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x10019762
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100197d5
cmp dword [ebp - 8], 0
je 0x1001977b
push 0x1000
push 0
mov edx, dword [ebp - 0x2c]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0
jne 0x1001978d
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
jmp 0x100197bb
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
cmp dword [edx + 0x114], 0
je 0x100197af
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x114]
mov dword [ebp - 0x30], ecx
jmp 0x10019795
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp + 8]
mov dword [edx + 0x114], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 8], 0
jne 0x100197d5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x10019adb
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.XTDL
push 0x10101da4
push 0x20
lea eax, [ebp - 0x24]
push eax
call fcn.1001a990
add esp, 0x18
lea ecx, [ebp - 0x24]
push ecx
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10019b38
jmp 0x10019bc9
push 0
push 0
push 0
push 6
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x10019b5f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10019bc9
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp + 8]
jne 0x10019b7f
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x114]
mov dword [ecx], eax
jmp 0x10019bb5
cmp dword [ebp - 0x28], 0
je 0x10019bb5
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x114]
cmp edx, dword [ebp + 8]
jne 0x10019ba7
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x114]
mov dword [eax + 0x114], edx
jmp 0x10019bb5
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 0x114]
mov dword [ebp - 0x28], ecx
jmp 0x10019b7f
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x1001a86a
Capabilities:
Read file via mapping

Disassembly:
clc
xor ecx, ecx
call fcn.10187435
inc edx
jbe 0x1001a8c0
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.XTDL
push str._s__X__d
push 0x20
lea eax, [ebp - 0x24]
push eax
call fcn.1001a990
add esp, 0x18
lea ecx, [ebp - 0x24]
push ecx
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001a8c9
xor eax, eax
jmp 0x1001a97f
push 0
push 0
push 0
push 6
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x1001a8f5
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1001a97f
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0
je 0x1001a966
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [edx]
sub ecx, dword [eax + 4]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 8]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x34], edx
cmp dword [ebp + 8], 0
je 0x1001a958
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x40]
push ecx
call dword [ebp + 8]
add esp, 8
test eax, eax
jne 0x1001a958
jmp 0x1001a966
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x114]
mov dword [ebp - 0x2c], eax
jmp 0x1001a8fd
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1001bea1
Capabilities:
Encrypt data using rc4 prga
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x10]
jne 0x101cac86
pushfd
push 0x2912143b
pushfd
lea esp, [esp + 0xc]
jmp fcn.10190c89
pushal
lea esp, [esp + 0x2c]
jbe 0x101cf958
jmp loc.1018b66a
bt cx, bx
push edx
mov dword [ebp - 0x1e8], 0
pushfd
cmp dl, 0xf9
test al, 0x31
mov word [esp], 0xa2e0
mov dword [ebp - 0x1ec], 0
stc
mov word [esp], 0x1690
cmp dword [ebp - 0x1f4], 0x64
pushfd
jmp 0x101b3f8a
xchg cx, ax
rdtsc
mov ecx, dword [ebp - 0x1f4]
jmp fcn.10187273

Function at 0x1001c14f
Capabilities:
Get disk information

Disassembly:
push 0x508dd5da
call fcn.1000b75c
push ebp
mov ebp, esp
sub esp, 0x118
push edi
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov byte [ebp - 8], 0x41
cmp dword [ebp + 8], 0
je 0x1001c193
cmp dword [ebp + 0xc], 0
je 0x1001c193
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
je 0x1001c193
cmp dword [ebp + 0x10], 0
jne 0x1001c198
jmp 0x1001c26b
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
movsx edx, byte [ebp - 8]
cmp edx, 0x5a
jg 0x1001c264
mov al, byte [ebp - 8]
add al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 8]
mov byte [ebp - 0x114], cl
mov byte [ebp - 0x113], 0x3a
mov byte [ebp - 0x112], 0
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x1001c205
jmp 0x1001c1a1
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1001c25f
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x114]
push eax
push 0x1010624c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.10003120
add esp, 0x14
mov dword [ebp - 0xc], 1
jmp 0x1001c269
jmp 0x1001c1a1
mov eax, dword [ebp - 0xc]
jmp 0x1001c26d
jmp 0x1001c264
jmp 0x1001c264
pop edi
mov esp, ebp
pop ebp
ret 0xc