joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10594a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea ecx, [eax + ecx*2 - 2]
cmp eax, ecx
jae 0x10594cf
mov dx, word [ecx]
xor word [eax], dx
movzx edx, word [eax]
xor word [ecx], dx
movzx edx, word [ecx]
xor word [eax], dx
add eax, 2
sub ecx, 2
cmp eax, ecx
jb 0x10594b3
pop ebp
ret 8
Function at 0x105fbb0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
push edi
mov dword [ebp - 8], edi
call dword [sym.imp.msvcrt.dll_time]
push eax
call dword [sym.imp.msvcrt.dll_srand]
xor esi, esi
add esp, 8
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
jle 0x105fcd0
push ebx
mov ebx, dword [ebp + 0xc]
push 0x40001
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x105fcb7
lea eax, [esi - 1]
cmp eax, 4
ja case.default.0x105fc0b
lea ecx, [esi - 1]
jmp dword [ecx*4 + 0x105fcdc]
push 0x40000
push 0xff
jmp 0x105fc4a
xor esi, esi
call dword [sym.imp.msvcrt.dll_rand]
mov byte [esi + edi], al
inc esi
cmp esi, 0x40000
jb 0x105fc20
mov esi, dword [ebp - 4]
jmp case.default.0x105fc0b
push 0x40000
push 0x52
jmp 0x105fc4a
push 0x40000
push 0xad
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
test esi, esi
je 0x105fc6a
mov eax, dword [ebp + 8]
push 1
push 0
mov edx, ebx
neg edx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
xor esi, esi
test ebx, ebx
jbe 0x105fca4
mov eax, ebx
sub eax, esi
cmp eax, 0x40000
jbe 0x105fc80
mov eax, 0x40000
mov edx, dword [ebp + 8]
push 0
lea ecx, [ebp - 0xc]
push ecx
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x105fca4
add esi, dword [ebp - 0xc]
mov dword [ebp - 8], 1
cmp esi, ebx
jb 0x105fc70
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov esi, dword [ebp - 4]
inc esi
cmp esi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
jl 0x105fbe2
mov eax, dword [ebp - 8]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1060840
Capabilities:
Set http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push 0x100c07c
push ecx
call fcn.01060180
test eax, eax
je 0x10608b2
push ebx
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, eax
lea esi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1060870
sub ecx, esi
push ecx
push eax
call fcn.010600f0
mov esi, eax
test esi, esi
je 0x106089b
push 0xa0000000
push 0xffffffffffffffff
push esi
push edi
call ebx
push esi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
lea edx, [ebp + 0xc]
push edx
push 0x100c07c
push 0
call fcn.01060180
test eax, eax
jne 0x1060867
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1063ca0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
xor dl, dl
xor eax, eax
push esi
mov byte [ebp - 4], dl
test ecx, ecx
jbe 0x1063cc3
mov esi, dword [ebp + 8]
xor dl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0x1063cb8
mov byte [ebp - 4], dl
cmp dword [ebp + 0x18], 0
je 0x1063ce1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
push ecx
push edx
call fcn.0102ead0
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1063d20
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x1063d20
xor byte [esi], 0xac
add ecx, 0xffffffff
je 0x1063d20
movzx eax, dl
push edi
cdq
mov edi, 0xff
idiv edi
pop edi
lea eax, [ecx + esi]
or esi, 0xffffffff
push ebx
jmp 0x1063d10
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
dec ecx
xor byte [eax], bl
dec eax
test ecx, ecx
ja 0x1063d10
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x10646a0
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea edi, [ebx + 0x323]
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
je 0x1064711
cmp esi, 0xffffffff
je 0x1064711
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push 0
lea eax, [ebp + 8]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push ebx
call fcn.01064600
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x14
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret 0x14

Function at 0x1064820
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2dc
push ebx
push esi
push 0x9c
lea eax, [ebp - 0xa0]
push 0
mov esi, 2
push eax
mov dword [ebp - 4], esi
call sub.msvcrt.dll_memset
push 0x23c
lea ecx, [ebp - 0x2dc]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 0xc]
add esp, 0x18
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], 1
call fcn.0117bcb0
mov ebx, eax
test ebx, ebx
je 0x10648fd
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0xc], 0
mov edi, edi
lea ecx, [ebp - 0x2dc]
push ecx
push ebx
call fcn.0117e490
test eax, eax
jne 0x10648eb
cmp dword [ebp - 0xcc], 0x1400000
jae 0x10648e5
lea esi, [edi + 0x323]
push esi
push eax
push 2
push ebx
call fcn.0117e460
test eax, eax
jne 0x10648de
push 3
lea edx, [ebp - 0x1d8]
push edx
push edi
call fcn.01064600
mov dword [ebp - 4], eax
test eax, eax
je 0x10648de
mov dword [ebp + 0xc], 1
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [ebp + 0xc], 0
je 0x1064890
push ebx
call fcn.0117b1d0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10680a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
sub esp, 8
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x10680c0
mov esp, ebp
pop ebp
ret 0x14
add dword [ebp + 0x10], 5
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], ebx
mov esi, dword [ebp + 8]
lea edi, [eax + esi]
cmp edi, ebx
jae 0x10680ef
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x10680ef
inc edi
cmp edi, ebx
jb 0x10680e2
mov eax, edi
sub eax, esi
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp edi, ebx
jae 0x1068210
cmp ecx, 3
jbe 0x106810c
xor esi, esi
mov dword [ebp + 0xc], esi
jmp 0x106814f
dec ecx
shl edx, cl
and edx, 7
mov dword [ebp + 0xc], edx
je 0x106814c
mov ecx, edx
movzx edx, byte [ecx + 0x100a868]
mov esi, edi
sub esi, edx
cmp byte [ecx + 0x100a860], 0
mov dl, byte [esi + 4]
je 0x1068139
test dl, dl
je 0x1068139
cmp dl, 0xff
jne 0x106814c
and ecx, 3
add ecx, ecx
or ecx, 1
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ecx
inc eax
mov edx, ecx
jmp 0x10680d8
mov esi, dword [ebp + 0xc]
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x1068171
cmp cl, 0xff
je 0x1068171
and esi, 3
add esi, esi
or esi, 1
mov dword [ebp + 0xc], esi
inc eax
mov edx, esi
jmp 0x10680d8
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
nop
cmp dword [ebp + 0x18], 0
je 0x106819e
lea ebx, [edx + eax]
add ebx, dword [ebp + 0x10]
jmp 0x10681a5
sub edx, eax
sub edx, dword [ebp + 0x10]
mov ebx, edx
test esi, esi
je 0x10681e0
movzx esi, byte [esi + 0x100a868]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x10681ca
cmp dl, 0xff
jne 0x10681e0
mov ecx, 0x20
sub ecx, esi
mov esi, dword [ebp + 0xc]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x1068190
mov edx, ebx
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, ebx
mov ecx, ebx
shr edx, 8
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [ebp + 0xc]
mov byte [edi + 1], bl
mov ebx, dword [ebp - 8]
mov byte [edi + 3], cl
add eax, 5
jmp 0x10680d8
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x1068225
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 0x14
dec ecx
shl edx, cl
mov ecx, dword [ebp + 0x14]
and edx, 7
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x106bec0
Capabilities:
Create process memory minidump

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
push esi
push 0x118a0a8
lea eax, [ebp - 0x80c]
push 0x100f588
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x80c]
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
test esi, esi
je 0x106bf51
cmp esi, 0xffffffff
je 0x106bf51
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
neg eax
push 0
sbb eax, eax
lea edx, [ebp - 0xc]
and eax, edx
push eax
push 2
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call sub.dbghelp.dll_MiniDumpWriteDump
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x106c510
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x106c577
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x802
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x106c570
push 0x802
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x106c567
push 0x3ff
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
ret 8

Function at 0x106ccc0
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0x3ae
cmp byte [edi], 0
mov dword [ebp - 4], 0xffffffff
je 0x106cd14
xor ebx, ebx
mov esi, 0x1186ac0
mov eax, dword [esi]
test edi, edi
je 0x106ccfa
test eax, eax
je 0x106ccfe
push eax
push edi
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
je 0x106cd0c
add esi, 0x20
inc ebx
cmp esi, 0x1186c60
jl 0x106cce5
jmp 0x106cd14
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
jne 0x106cd4e
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx edi, ax
test edi, edi
je 0x106cd4e
xor esi, esi
mov edx, 0x1186acc
xor eax, eax
mov ecx, edx
lea esp, [esp]
cmp dword [ecx], edi
je 0x106cd3f
inc eax
add ecx, 4
cmp eax, 5
jl 0x106cd30
jmp 0x106cd42
mov dword [ebp - 4], esi
add edx, 0x20
inc esi
cmp edx, 0x1186c6c
jl 0x106cd28
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x106cf90
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x4064], edi
jne 0x106d05e
push ebx
lea ebx, [esi + 0x1c]
test ebx, ebx
je 0x106d05d
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [esi + 0x4060]
cmp eax, 0x1000
jge 0x106d052
mov ecx, dword [ebp + 0x10]
shl eax, 5
mov dword [eax + esi + 0x40cc], ecx
mov edx, dword [esi + 0x4060]
mov ecx, dword [ebp + 0xc]
shl edx, 5
mov dword [edx + esi + 0x40d0], 1
mov eax, dword [esi + 0x4060]
shl eax, 5
lea eax, [eax + esi + 0x40bc]
push eax
push edi
push eax
push ecx
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x106d03e
cmp edi, 0xffffffff
je 0x106d03e
mov edx, dword [esi + 0x4060]
mov dword [esi + edx*4 + 0x60], edi
mov eax, dword [esi + 0x4060]
inc eax
and eax, 0x80000fff
jns 0x106d036
dec eax
or eax, 0xfffff000
inc eax
mov dword [esi + 0x4060], eax
jmp 0x106d052
mov ecx, dword [esi + 0x4060]
shl ecx, 5
mov dword [ecx + esi + 0x40d0], 0
test ebx, ebx
je 0x106d05d
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1070130
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
mov edi, eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xcc], 0
jne 0x1070170
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x32
call ebx
call esi
sub eax, edi
cmp eax, 0x3e8
jae 0x107016f
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xcc], 0
je 0x1070154
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x1071bd0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x2a56c], 0
je 0x1071c45
mov ecx, dword [edi + 0xc]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1071c45
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x401
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1071c3e
push 0x401
push 0
push esi
call sub.msvcrt.dll_memset
mov edx, dword [edi]
mov eax, dword [edx + 0x2a56c]
add esp, 0xc
test eax, eax
je 0x1071c35
push 0x24
push eax
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
pop ebp
ret 4
Function at 0x1071c50
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1071cb7
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x401
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1071cb0
push 0x401
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [edi]
add esp, 0xc
add eax, 0x2b6f4
je 0x1071ca7
push 0x24
push eax
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
pop ebp
ret 4

Function at 0x1075790
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x25a8c]
mov eax, dword [eax + 0x1c]
push edi
push 0
push 0
push 0x147
push eax
call ebx
mov edi, dword [ebp + 0x10]
push 0
mov dword [edi + 0x1fc], eax
mov eax, dword [esi + 0x25a90]
mov ecx, dword [eax + 0x1c]
push 0
push 0x147
push ecx
call ebx
mov ebx, dword [ebp + 8]
push 0x3f
lea edx, [edi + 0x308]
mov dword [edi + 0x1f8], eax
mov eax, dword [esi + 0x25aa0]
push edx
push eax
push ebx
call fcn.01057f80
mov edx, dword [esi + 0x25a9c]
push 0x3f
lea ecx, [edi + 0x286]
push ecx
push edx
push ebx
call fcn.01057f80
push 0x3f
lea eax, [edi + 0x204]
push eax
mov eax, dword [esi + 0x25a94]
push eax
push ebx
call fcn.01057f80
lea eax, [edi + 0x204]
push eax
push esi
call fcn.010756d0
mov esi, dword [esi + 0x25a98]
test ebx, ebx
je 0x1075896
push 0x403
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x1075896
test esi, esi
je 0x1075864
mov ecx, dword [esi + 0x1c]
push 0x1ff
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ebx
call dword [sym.imp.msvcrt.dll__wtoi]
add esp, 4
cmp eax, 0xffff
mov dword [edi + 0x200], eax
jle 0x1075880
mov eax, 0xffff
push ebx
push 0
mov dword [edi + 0x200], eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x1077bb0
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
test esi, esi
je 0x1077be5
push 2
push 0x100c56c
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1077be5
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov cx, word [esi + 2]
mov ax, word [esi]
mov dx, word [esi + 4]
mov word [ebp - 6], cx
mov word [ebp - 8], ax
lea ecx, [ebp - 8]
xor eax, eax
push ecx
mov word [ebp - 4], dx
mov word [ebp - 2], ax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
jne 0x1077bdb
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1078810
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
lea eax, [ebp + 0x10]
push eax
push ecx
push 0
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], 0
call fcn.0102d840
mov esi, dword [ebp - 4]
test esi, esi
je 0x1078939
lea eax, [eax + eax + 0x864]
test eax, eax
je 0x1078929
push ebx
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x1078928
push edi
push 9
push esi
call fcn.0102c030
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x10788cf
mov eax, dword [ebp - 4]
mov esi, edi
sub esi, eax
sar esi, 1
push esi
push eax
push ebx
call fcn.0102bc50
cmp esi, 0x31
jl 0x1078896
mov esi, 0x31
cmp esi, 0x32
jge 0x10788c0
mov eax, 0x20
movzx edx, ax
mov eax, edx
shl edx, 0x10
mov ecx, 0x32
sub ecx, esi
or eax, edx
shr ecx, 1
lea edi, [ebx + esi*2]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 8]
add edi, 2
push edi
push ebx
call fcn.0102bbe0
mov esi, dword [ebp - 4]
jmp 0x10788df
push 0x103
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
cmp word [ebx], 0
mov eax, ebx
pop edi
je 0x10788f9
jmp 0x10788f0
add eax, 2
cmp word [eax], 0
jne 0x10788f0
sub eax, ebx
push 0
sar eax, 1
lea ecx, [ebp - 0xc]
push ecx
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x30900]
push edx
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10795e0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0x281
push 8
mov dword [ebp - 4], 0x280
call esi
mov ebx, dword [sym.imp.KERNEL32.DLL_HeapAlloc]
push eax
call ebx
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x10797e9
lea eax, [ebp - 4]
push eax
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x107964b
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10797e9
inc eax
push eax
push 8
call esi
push eax
call ebx
mov dword [ebp - 8], eax
mov edi, eax
test edi, edi
je 0x10797e9
lea ecx, [ebp - 4]
push ecx
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x10797dd
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.msvcrt.dll_strncpy]
mov edi, edi
mov eax, dword [esi + 0x2e664]
cmp eax, 8
jge 0x10797d4
imul eax, eax, 0x360
push 0x103
lea edx, [edi + 0x10c]
push edx
lea eax, [eax + esi + 0x2cc69]
push eax
call ebx
mov edx, dword [esi + 0x2e664]
imul edx, edx, 0x360
push 0x103
lea ecx, [edi + 8]
push ecx
lea eax, [edx + esi + 0x2cb64]
push eax
call ebx
mov eax, dword [edi + 0x190]
add esp, 0x18
cmp eax, 0x41
jb 0x10796cd
mov eax, 0x41
mov ecx, dword [esi + 0x2e664]
imul ecx, ecx, 0x360
mov dword [ecx + esi + 0x2cdb0], eax
mov edx, dword [esi + 0x2e664]
imul edx, edx, 0x360
mov ecx, dword [edx + esi + 0x2cdb0]
lea eax, [edx + esi]
push ecx
lea edx, [edi + 0x194]
push edx
add eax, 0x2cd6e
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x2e664]
mov ecx, dword [edi + 0x1a0]
imul eax, eax, 0x360
mov dword [eax + esi + 0x2cec0], ecx
mov eax, dword [esi + 0x2e664]
imul eax, eax, 0x360
push 0x3f
lea edx, [edi + 0x1b0]
push edx
lea ecx, [eax + esi + 0x2cdb4]
push ecx
call ebx
mov eax, dword [esi + 0x2e664]
imul eax, eax, 0x360
push 0x3f
lea edx, [edi + 0x1c0]
push edx
lea ecx, [eax + esi + 0x2cdf5]
push ecx
call ebx
mov eax, dword [esi + 0x2e664]
imul eax, eax, 0x360
push 0x3f
lea edx, [edi + 0x1d8]
push edx
lea ecx, [eax + esi + 0x2ce36]
push ecx
call ebx
add esp, 0x30
cmp dword [edi + 0x1a4], 0
je 0x10797c4
mov edx, dword [esi + 0x2e664]
imul edx, edx, 0x360
mov dword [edx + esi + 0x2ce78], 1
mov ecx, dword [esi + 0x2e664]
imul ecx, ecx, 0x360
push 0x3f
lea eax, [edi + 0x200]
push eax
lea edx, [ecx + esi + 0x2ce7c]
push edx
call ebx
add esp, 0xc
inc dword [esi + 0x2e664]
mov edi, dword [edi]
test edi, edi
jne 0x1079670
mov edi, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1079d80
Capabilities:
List user accounts

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
push 2
push 2
push edi
call sub.NETAPI32.dll_NetUserEnum
mov ebx, eax
cmp ebx, edi
je 0x1079dc0
cmp ebx, 0xea
jne 0x1079df9
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x1079e0d
cmp dword [ebp - 8], edi
jbe 0x1079dfc
lea esi, [eax + 0x24]
nop
mov ecx, dword [esi - 0x18]
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
mov edx, dword [esi - 0x1c]
push eax
mov eax, dword [esi - 0x24]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call fcn.01079cf0
inc edi
add esi, 0x60
cmp edi, dword [ebp - 8]
jb 0x1079dd0
mov eax, dword [ebp - 4]
xor edi, edi
cmp eax, edi
je 0x1079e0d
push eax
call sub.NETAPI32.dll_NetApiBufferFree
xor eax, eax
mov dword [ebp - 4], eax
cmp ebx, 0xea
je 0x1079d96
cmp eax, edi
pop edi
pop esi
pop ebx
je 0x1079e22
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov esp, ebp
pop ebp
ret 4