joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006460
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10006485
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
add esp, 8
ret 0xc
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x100064a8
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x100064aa
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x10006525
jg 0x100064bd
test esi, esi
je 0x10006525
test eax, eax
jl 0x10006507
jg 0x100064c7
test ebp, ebp
je 0x10006507
cmp edi, eax
jg 0x100064d7
jl 0x100064d1
cmp esi, ebp
jae 0x100064d7
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [ebx + 0x30]
add esp, 0xc
mov ecx, dword [esp + 0x1c]
sub esi, ebp
sbb edi, dword [esp + 0x20]
add ecx, ebp
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
test edi, edi
jl 0x10006525
jg 0x1000650b
test esi, esi
je 0x10006525
jmp 0x1000650b
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10006525
push eax
push esi
push 1
push ecx
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc

Function at 0x10006540
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10006690
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000b520
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000b780
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret
Function at 0x1000b540
Capabilities:
Create thread
Set file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029d3b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
push esi
mov eax, dword [0x10041bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [eax], 0x8b55ff8b
je 0x1000b762
cmp dword [0x1004206c], 1
jne 0x1000b600
push 1
push 0x40
push 8
push 0x1002d05c
lea ecx, [ebp - 0x174]
call fcn.10004a20
lea eax, [ebp - 0x174]
mov dword [ebp - 4], 0
push str._nSP_Scan:
push eax
call fcn.100045b0
lea eax, [ebp - 0x174]
push 0x1002d080
push eax
call fcn.100045b0
add esp, 0x10
lea ecx, [ebp - 0x170]
call fcn.10005500
test eax, eax
jne 0x1000b5ee
push eax
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x174]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], 0xffffffff
call fcn.10005010
cmp dword [0x1004207c], 1
jne 0x1000b6df
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xc4]
mov esi, eax
push 1
push 0x40
push 8
push 0x1002d098
call fcn.10004a20
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 1
push 0x1002d09c
push eax
call fcn.100045b0
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.100045b0
lea eax, [ebp - 0xc4]
push str.SP_Scan:
push eax
call fcn.100045b0
lea eax, [ebp - 0xc4]
push 0x1002d0bc
push eax
call fcn.100045b0
lea eax, [ebp - 0xc4]
push 0x1002d0d4
push eax
call fcn.100045b0
add esp, 0x2c
lea ecx, [ebp - 0xc0]
call fcn.10005500
test eax, eax
jne 0x1000b6c7
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x1002d0fc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xc4]
call fcn.10005010
mov eax, dword [0x10042070]
push 0
cmp eax, 1
jne 0x1000b711
push 0
push 0
push 0x1000b470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000b721
push 0
push 0
push 0x1000b3f0
jmp 0x1000b6f4
cmp eax, 3
jne 0x1000b731
push 0
push 0
push 0x1000b4f0
jmp 0x1000b6f4
cmp eax, 4
jne 0x1000b70b
push 0
push 0
push 0x10027880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push str.SP_Scan
push str.Speed_Hack_detected_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000b709
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c0a0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
mov eax, dword [0x10042070]
push ebx
push ebp
push esi
push edi
cmp eax, 1
jne 0x1000c11b
mov dword [esp + 0x10], 0x1002d6c0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c0ff
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c0f9
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c0e3
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10041fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000c18c
mov dword [esp + 0x10], 0x1002d740
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c170
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c16a
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c154
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10041fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0x1002d7d8
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c1dc
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c1d6
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c1c0
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10041fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000c4f0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.1000ca30
mov eax, dword [0x10042070]
cmp eax, 1
jne 0x1000c570
mov dword [esp + 0x10], 0x1002d4d0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c554
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c54e
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c538
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10041fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1000c5e8
mov dword [esp + 0x10], 0x1002d570
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c5cc
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c5c6
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c5b0
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10041fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0x1002d618
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c63c
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c636
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c620
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10041fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000c660
Capabilities:
Check os version
Encode data using xor
Query or enumerate registry value

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x1000c67b
mov dword [0x10041f74], 1
add esp, 0xc
ret
push ebx
mov dword [esp + 4], 0x1002d988
mov ebx, dword [esp + 4]
push esi
mov esi, dword [esp + 8]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000c6d1
mov eax, dword [ebx + 0xf]
push ebp
inc eax
push edi
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1000c6c9
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x1000c6b3
mov byte [edi + ebp], 0
mov esi, edi
pop edi
pop ebp
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
pop ebx
test eax, eax
jne 0x1000c726
mov dword [esp], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0
push 0
push str.MoveImages
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000c721
mov dword [0x10041f70], 1
add esp, 0xc
ret
call fcn.1000c830
add esp, 0xc
ret

Function at 0x1000c830
Capabilities:
Create thread
Get token membership

Disassembly:
sub esp, 0x18
mov eax, dword [0x10041bd0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
xor esi, esi
mov dword [esp + 8], 0
lea eax, [esp + 4]
mov dword [esp + 4], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [esp + 0x38]
mov dword [esp + 0x38], esi
push eax
mov word [esp + 0x40], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1000c88f
lea eax, [esp + 8]
push eax
push dword [esp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1000c897
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x1000c8ae
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [esp + 4], 0
test esi, esi
jne 0x1000c92a
cmp dword [esp + 8], esi
je 0x1000c903
cmp dword [0x10041f70], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x1000c8d7
push 0
push 0
push 0
push 0x1000d010
push 0
push 0
call esi
cmp dword [0x10041f6c], 0
jne 0x1000c918
push 0
push 0
push 0
push fcn.1000c200
push 0
push 0
call esi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100282d0
add esp, 0x18
ret
push 0
push 0
push 0
push 0x1000c940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.100282d0
add esp, 0x18
ret
push 0x1003e2c8
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
call sub.VCRUNTIME140D.dll__CxxThrowException
int3
Function at 0x1000cd30
Capabilities:
Create thread
Terminate process

Disassembly:
push 0
push 0
push 0
push 0x1000cd60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1000d550
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x10041bd0]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x10042094], 1
jne 0x1000d590
push 0
push 0
push 0
push 0x1000d9e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100282d0
add esp, 0x20
ret
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000d632
lea eax, [esp + 4]
push eax
push 0x1002de9c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1000d632
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
push 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x14]
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1000d632
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000d632
push 0
push 0
push 0
push 0x1000d110
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100282d0
add esp, 0x20
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
xor ecx, esp
call fcn.100282d0
add esp, 0x20
ret
Function at 0x1000da60
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000e5a0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1000e5c0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1000e390
push 0
push 0
call esi
pop esi
ret
Function at 0x1000f8f0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000fab0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x1000f910
Capabilities:
Capture public ip
Create http request
Encode data using xor
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a2c0
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x10041bd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x80000000
push 0
push 0
push str.http:__icanhazip.com_
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
mov dword [ebp - 0x4c], edi
test edi, edi
je 0x1000fa9e
lea eax, [ebp - 0x48]
push eax
push 0x2f
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x48]
cmp eax, 0x2f
jae 0x1000faa3
push 1
push 0x40
push 8
push 0x1002e8b4
lea ecx, [ebp - 0xfc]
mov byte [ebp + eax - 0x40], 0
call fcn.10004a20
lea eax, [ebp - 0xfc]
mov dword [ebp - 4], 0
push str._nPublic_IP:
push eax
call fcn.100045b0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.100045b0
mov dword [ebp - 0x44], 0x1002e8d0
add esp, 0x10
mov ebx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x44]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1000fa32
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [ebx + 0xf]
xor edx, edx
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1000fa29
sub esi, edi
nop dword [eax]
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x44]
cmp edx, eax
jb 0x1000fa10
mov byte [eax + edi], 0
mov esi, edi
mov edi, dword [ebp - 0x4c]
lea eax, [ebp - 0xfc]
push esi
push eax
call fcn.100045b0
add esp, 8
lea ecx, [ebp - 0xf8]
call fcn.10005500
test eax, eax
jne 0x1000fa6b
push eax
mov eax, dword [ebp - 0xfc]
lea ecx, [ebp - 0xfc]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call fcn.1000fba0
lea ecx, [ebp - 0xfc]
call fcn.10005010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100282d0
mov esp, ebp
pop ebp
ret
call fcn.1000f580
call fcn.10028470
int3
Function at 0x10010190
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a3ab
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x10041bd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x14
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x100102e4
push 1
push 0x40
push 8
push 0x1002e938
lea ecx, [ebp - 0x1a0]
call fcn.10004a20
lea eax, [ebp - 0x1a0]
mov dword [ebp - 4], 0
push str._nComputer_Username:
push eax
call fcn.100045b0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.100045b0
add esp, 0x10
lea ecx, [ebp - 0x19c]
call fcn.10005500
test eax, eax
jne 0x10010242
push eax
mov eax, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1a0]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x100102d4
push 1
push 0x40
push 8
push 0x1002e918
lea ecx, [ebp - 0xf0]
call fcn.10004a20
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 1
push str._nComputer_Name:
push eax
call fcn.100045b0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.100045b0
add esp, 0x10
lea ecx, [ebp - 0xec]
call fcn.10005500
test eax, eax
jne 0x100102c2
push eax
mov eax, dword [ebp - 0xf0]
lea ecx, [ebp - 0xf0]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
call fcn.1000f910
lea ecx, [ebp - 0xf0]
call fcn.10005010
jmp 0x100102d9
call fcn.1000f910
lea ecx, [ebp - 0x1a0]
call fcn.10005010
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100282d0
mov esp, ebp
pop ebp
ret
Function at 0x10010720
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x10042070]
cmp eax, 1
je 0x1001076c
cmp eax, 4
je 0x1001076c
push 0
cmp eax, 2
jne 0x1001075c
push 0
push 0
push 0x100107a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x10010756
push 0
push 0
push 0x10010800
jmp 0x1001073f
push 0
push 0
push 0
push 0x100107d0
jmp 0x1001073f

Function at 0x10010780
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10010630
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10010830
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
cmp dword [0x10041f84], 0xb7
jne 0x10010998
mov eax, dword [0x10042070]
push ebx
push ebp
push esi
push edi
cmp eax, 1
jne 0x100108bb
mov dword [esp + 0x10], 0x1002f228
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1001089f
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x10010899
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x10010883
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10041fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1001092c
mov dword [esp + 0x10], 0x1002f278
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x10010910
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x1001090a
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x100108f4
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10041fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp + 0x10], 0x1002f2d8
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
add esi, 0x14
cmp byte [ebx + 0x13], 0
je 0x1001097c
mov eax, dword [ebx + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ebp, dword [ebx + 0xf]
add esp, 4
xor edx, edx
mov edi, eax
test ebp, ebp
je 0x10010976
sub esi, edi
mov eax, edx
lea ecx, [edx + edi]
and eax, 7
inc edx
mov al, byte [eax + ebx + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
cmp edx, ebp
jb 0x10010960
mov byte [edi + ebp], 0
mov esi, edi
push 0x200030
push dword [0x10041fec]
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
pop ecx
ret

Function at 0x100109e0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10010e30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret