joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e0a4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x43e141
push ebx
push esi
call fcn.0043e060
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043df9d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43e0ee
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43e140
push edi
push eax
call fcn.00436129
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43e10e
call fcn.004360ef
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43e13f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043df9d
add esp, 0x20
test eax, eax
jne 0x43e12d
push edi
call fcn.004360ef
jmp 0x43e135
push ebx
call fcn.004360ef
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x43e144
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x43e155
pop esi
ret
push ebx
push edi
push esi
call fcn.0043e060
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00436129
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x43e17d
push ebx
push esi
push edi
call fcn.00407f30
add esp, 0xc
push 0
call fcn.004360ef
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x43ea6c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043e3f2

Function at 0x4415da
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00438ee3
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x441649
cmp esi, dword [ebp - 4]
je 0x441644
cmp dword [ebp + 0xc], 0
je 0x441644
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x441621
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0044112c
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x44164b
xor eax, eax
inc eax
jmp 0x44164b
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4416b0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x462024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00438ee3
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00438ee3
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x441727
cmp word [ecx], dx
je 0x441727
mov eax, dword [0x45a7fc]
push edi
dec eax
push eax
push 0x45a6e8
call fcn.0044164f
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x44179a
cmp word [eax], dx
je 0x44179a
mov eax, dword [edi]
test eax, eax
je 0x44174b
cmp word [eax], dx
je 0x44174b
lea eax, [ebp - 0x10]
push eax
call fcn.00441032
jmp 0x441754
lea eax, [ebp - 0x10]
push eax
call fcn.004410cd
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4417c4
mov eax, dword [0x45a6e4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x45a3d8
call fcn.0044164f
add esp, 0xc
test al, al
je 0x4417c4
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x44178f
cmp word [eax], di
je 0x44178f
lea eax, [ebp - 0x10]
push eax
call fcn.00441032
pop ecx
jmp 0x4417c6
lea eax, [ebp - 0x10]
push eax
call fcn.004410cd
jmp 0x44178c
mov eax, dword [edi]
test eax, eax
je 0x4417b1
cmp word [eax], dx
je 0x4417b1
lea eax, [ebp - 0x10]
push eax
call fcn.00440fc9
pop ecx
jmp 0x4417c4
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x44188f
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004414d4
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x44188f
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x44188f
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x44188f
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x44181c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0043b0e0
test ebx, ebx
je 0x44188a
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0043b0e0
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x44188f
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x44188f
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0044a704
add esp, 0x10
xor eax, eax
inc eax
jmp 0x441891
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004065d7
leave
ret
Function at 0x448497
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x462024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x4484da
call fcn.00435ba1
mov dword [eax], 0xf
call fcn.00435bb4
mov dword [eax], 0xd
call fcn.00435a53
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004065d7
leave
ret
test eax, eax
jne 0x4484e1
inc eax
jmp 0x4484ce
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x4484cc
xor eax, eax
cmp ecx, 1
setne al
jmp 0x4484ce
Function at 0x44f1b9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x464358]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44f1f9
cmp byte [ebx], 0xa
jne 0x44f1f9
or byte [edi + eax + 0x28], 4
jmp 0x44f1fe
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x44f2fd
mov dl, byte [eax]
cmp dl, 0x1a
je 0x44f2e0
inc eax
cmp dl, 0xd
je 0x44f22a
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x44f250
cmp eax, ecx
jae 0x44f25e
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x44f212
jmp 0x44f2fd
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44f2db
cmp dword [ebp - 0x10], 0
je 0x44f2db
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x464358]
test byte [eax + edi + 0x28], 0x48
je 0x44f2b5
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x44f2a0
mov byte [esi], dl
jmp 0x44f2b1
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x464358]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x44f2fd
cmp byte [ebp - 1], 0xa
jne 0x44f2c4
cmp esi, ebx
jne 0x44f2c4
mov byte [esi], 0xa
jmp 0x44f2fc
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0044d450
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x44f2fd
mov byte [esi], 0xd
jmp 0x44f2fc
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x464358]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x44f2fa
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x44f2fd
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x44f306
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x464358]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x44f34c
cmp word [ebx], dx
jne 0x44f34c
or byte [eax + edi + 0x28], 4
jmp 0x44f351
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x44f4b4
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x44f494
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x44f392
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x44f3c8
cmp eax, edx
jae 0x44f3d6
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x44f36d
jmp 0x44f4b4
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44f48f
cmp dword [ebp - 0x18], 0
je 0x44f48f
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x464358]
test byte [eax + edi + 0x28], 0x48
je 0x44f465
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x44f429
mov word [esi], cx
jmp 0x44f460
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x464358]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x464358]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x464358]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x44f4b4
pop eax
cmp word [ebp - 4], ax
jne 0x44f475
cmp esi, ebx
jne 0x44f475
mov word [esi], ax
jmp 0x44f4b1
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0044d450
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x44f4b4
push 0xd
pop eax
jmp 0x44f470
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x464358]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x44f4ae
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x44f4b4
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4172d8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x425458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408115
mov dword [ebp - 0x14], eax
cmp dword [0x475e88], esi
jne 0x4173cb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x417358
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4174ab
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4174ab
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4174ab
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x475e88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x475e8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x475e90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x475e98], eax
test eax, eax
je 0x4173c8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x475e94], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4173f0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4173e3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x417405
push 4
pop eax
jmp 0x4174ad
cmp dword [ebp - 0x14], esi
je 0x417405
push dword [0x475e88]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4173ea
mov eax, dword [0x475e94]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x417463
cmp dword [0x475e98], edi
je 0x417463
push eax
call ebx
push dword [0x475e98]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x417463
test eax, eax
je 0x417463
call ecx
test eax, eax
je 0x417458
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x417458
test byte [ebp - 8], 1
jne 0x417463
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x417493
mov eax, dword [0x475e8c]
cmp eax, edi
je 0x417490
push eax
call ebx
test eax, eax
je 0x417490
call eax
mov esi, eax
test esi, esi
je 0x417490
mov eax, dword [0x475e90]
cmp eax, edi
je 0x417490
push eax
call ebx
test eax, eax
je 0x417490
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x475e88]
call ebx
test eax, eax
je 0x4174ab
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4174ad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004070bf
mov esp, ebp
pop ebp
ret
Function at 0x406bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x406bcf
pop dword [ebp - 0x1c]
mov eax, 0x406bcf
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x68218b1
sub dword [ebp - 0x2c], 0xb82fd366
mov dword [ebp - 0x28], 0x6c622c75
add dword [ebp - 0x28], 0xc5d11fd0
mov dword [ebp - 0x24], 0x61408929
add dword [ebp - 0x24], 0xeb0bbb05
mov dword [ebp - 0x20], 0xbf7fc9ef
sub dword [ebp - 0x20], 0xbf7fc9ef
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x28ecfa2b
sub eax, 0x28abc98b
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x72a73aca
sub dword [ebp - 0x2c], 0xfe34d174
mov dword [ebp - 0x28], 0xf9c69e8e
sub dword [ebp - 0x28], 0xb85a3d19
mov dword [ebp - 0x24], 0xe1a40312
add dword [ebp - 0x24], 0x81cb695a
mov dword [ebp - 0x20], 0x5497e0aa
add dword [ebp - 0x20], 0xab681f56
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xe865b01e
add eax, 0x17db801e
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3aea6
push 0
call eax
mov ecx, 0x4330
mov edx, eax
mov esi, 0x8ecf2ecd
add esi, 0x71728133
add esi, dword [ebp - 0x1c]
mov ebx, 0x86154da1
sub dword [ebp - 0xc], 0x870c6a25
mov edi, dword [esi]
add dword [ebp - 0xc], eax
xor edi, ebx
sub dword [ebp - 0x18], edx
mov dword [edx], edi
mov dword [ebp - 8], 0x9f574122
add edx, 0x1379d300
add edx, 0xec862d04
add esi, 4
loop 0x406ce0
add eax, 0xff93
xor ebx, ebx
add ebx, eax
add eax, 0x1ccac0c8
add eax, 0xe3353f3d
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x410100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41011c
mov dword [eax], ecx
jmp 0x41011e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410190
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0xe00768
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe00772
pushal
call 0xe00778
pop ebp
sub ebp, 0x10
sub ebp, 0xa00768
jmp 0xe0078e
mov eax, 0xa00768
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c6
mov edx, 0x7c33c827
xor byte [eax], dl
inc eax
dec ecx
jne 0xe007a5
jmp 0xe007b8
lodsb al, byte [esi]
ljmp 0x2727
Function at 0x1005fe20
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x37c8
call fcn.10090560
mov eax, dword [0x100cc8ec]
xor eax, esp
mov dword [esp + 0x37c4], eax
push ebx
push ebp
mov ebp, dword [esp + 0x37d4]
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x14], ebp
xor edi, edi
jmp 0x1005fe50
push edi
lea eax, [esp + 0x28]
push str..PhysicalDrive_d
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
cmp dword [ebp], ebx
jne 0x10060000
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1005fe8d
push eax
jmp 0x1005fffa
xor eax, eax
push 0x2710
lea edx, [esp + 0x10c8]
push ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
lea eax, [esp + 0x14]
push eax
push 0x2710
lea ecx, [esp + 0x10d0]
push ecx
push 0xc
lea edx, [esp + 0x2c]
push edx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1005fff3
push 0x3e7
lea eax, [esp + 0x129]
push ebx
push eax
mov byte [esp + 0x130], bl
call sub.MSVCR80.dll_memset
mov edx, dword [esp + 0x10dc]
lea ecx, [esp + 0xce8]
push ecx
push ebx
push edx
lea eax, [esp + 0x10dc]
push eax
call fcn.1005fca0
mov edx, dword [esp + 0x10f0]
lea ecx, [esp + 0x528]
push ecx
push ebx
push edx
lea eax, [esp + 0x10ec]
push eax
call fcn.1005fca0
mov edx, dword [esp + 0x1104]
lea ecx, [esp + 0x920]
push ecx
push ebx
push edx
lea eax, [esp + 0x10fc]
push eax
call fcn.1005fca0
mov edx, dword [esp + 0x1118]
lea ecx, [esp + 0x160]
push ecx
push 1
push edx
lea eax, [esp + 0x110c]
push eax
call fcn.1005fca0
add esp, 0x4c
cmp byte [ebp + 4], bl
jne 0x1005ffb6
movsx ecx, byte [esp + 0x124]
push ecx
call dword [sym.imp.MSVCR80.dll_isalnum]
add esp, 4
test eax, eax
jne 0x1006002d
movsx edx, byte [esp + 0x137]
push edx
call dword [sym.imp.MSVCR80.dll_isalnum]
add esp, 4
test eax, eax
jne 0x1006002d
push 0x2710
lea eax, [esp + 0x10c8]
push ebx
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
lea ecx, [esp + 0x14]
push ecx
push 0x2710
lea edx, [esp + 0x10d0]
push edx
push ebx
push ebx
push 0x700a0
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10060000
jmp 0x1005fff9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 1
add ebp, 0x84
cmp edi, 4
jl 0x1005fe50
xor eax, eax
mov ecx, dword [esp + 0x37d4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10090524
add esp, 0x37c8
ret
mov eax, dword [esp + 0x14]
imul edi, edi, 0x84
add edi, eax
push 0x80
lea ebp, [edi + 4]
push ebx
push ebp
call sub.MSVCR80.dll_memset
push 0x7f
lea ecx, [esp + 0x134]
push ecx
push ebp
call dword [sym.imp.MSVCR80.dll_strncpy]
add esp, 0x18
push esi
mov dword [edi], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x10060014
Function at 0x10060cf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10060cf5
sub eax, edx
mov edx, eax
xor eax, eax
xor ecx, ecx
test edx, edx
jle 0x10060d2b
push edi
jmp 0x10060d10
movsx edi, byte [ecx + esi]
add edi, eax
imul edi, edi, 0x401
mov eax, edi
shr edi, 6
add ecx, 1
xor eax, edi
cmp ecx, edx
jl 0x10060d10
pop edi
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
Function at 0x10061ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009a819
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100cc8ec]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov eax, dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
push eax
push ecx
push 6
push 0x1c
add edi, 0x1c
push edi
lea edx, [esi + 0x1c]
push edx
mov dword [esp + 0x30], 0
call fcn.100909aa
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x1007c650
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push esi
push 0
push 0x1007c600
call dword [sym.imp.MSVCR80.dll__beginthread]
add esp, 0xc
mov dword [esi + 4], eax
pop esi
ret
Function at 0x10090524
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100cc8ec]
jne 0x1009052e
repz ret
jmp fcn.10090e62

Function at 0x4071bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4071ca
pop dword [ebp - 0x10]
mov eax, 0x4071ca
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xea0f0531
sub dword [ebp - 0x20], 0x9bbcbfe6
mov dword [ebp - 0x1c], 0x5fa9fd51
add dword [ebp - 0x1c], 0xd2894ef4
mov dword [ebp - 0x18], 0xa609ab63
sub dword [ebp - 0x18], 0x59bd6735
mov dword [ebp - 0x14], 0x6e9f14a1
add dword [ebp - 0x14], 0x9160eb5f
lea eax, [ebp - 0x20]
push eax
mov eax, 0xe14dabfa
sub eax, 0xe10b7b86
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xab71b934
sub dword [ebp - 0x20], 0x36ff4fde
mov dword [ebp - 0x1c], 0x12c6d470
add dword [ebp - 0x1c], 0x2ea58d05
mov dword [ebp - 0x18], 0xb7635b6b
sub dword [ebp - 0x18], 0x53f3eeff
mov dword [ebp - 0x14], 0x4f00379
add dword [ebp - 0x14], 0xfb0ffc87
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xddc50245
add eax, 0x227d2edf
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3d944
push 0
call eax
mov ecx, 0xd9a4a5b8
sub ecx, 0xd9a45ec5
xor edi, edi
add edi, eax
mov ebx, 0x201d45f
sub ebx, 0x1be905f
add ebx, dword [ebp - 0x10]
mov esi, 0xb253d97f
add esi, 0xb13f7a32
xor dword [ebp - 4], edx
mov edx, dword [ebx]
mov dword [ebp - 0xc], 0xd46d038d
sub edx, esi
xor dword [ebp - 0xc], 0x3c5bf336
mov dword [edi], edx
add edi, 0xc51f1c90
sub edi, 0xc51f1c8c
add ebx, 0x1b66bfb5
sub ebx, 0x1b66bfb1
loop 0x4072e9
add eax, 0xb379b0b4
add eax, 0x4c875deb
xor ebx, ebx
add ebx, eax
add eax, 0xeee5629e
sub eax, 0xeee56299
mov ecx, 0x6dc81c2
add ecx, 0xf9637e3e
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c