joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x28007302
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x345a3ba1
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40895f
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
sub ebx, 1
call fcn.00408982
xor dword [edx], esi
add edx, 1
sub ecx, 1
cmp edx, edi
jne fcn.0040895f
ret
Function at 0xdee710
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdee71a
pushal
call 0xdee720
pop ebp
sub ebp, 0x10
sub ebp, 0x9ee710
jmp 0xdee736
mov eax, 0x9ee710
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b9
mov edx, 0xcc8e1abd
xor byte [eax], dl
inc eax
dec ecx
jne 0xdee74d
jmp 0xdee760
jo 0xdee799
xor al, 0x81
mov ebp, 0x7c3cbdbd
inc ebp
mov ebp, 0x70bebdbd
add eax, 0xbdbdbdb5
pop es
xchg ebp, eax
mov ebp, 0x5f4abdbd
mov esi, 0xb13c3675
mov ebp, 0x78bebdbd
xor cl, bl
cdq
inc ecx
xor al, 0xb9
cdq
xor cl, bl
cdq
inc ecx
xor al, 0xb9
cdq
aad 0x39
imul ebx, dword [ebp - 0x50ce2a43], 0x91bcbdc3
cdq
aad 0xd0
nop
nop
cwde
push ebp
mov eax, 0x54bdbdbd
xchg ebp, eax
mov ebp, 0x36e8bdbd
push ecx
cmp byte ss:[ebp + 0x36bdbdbd], dh
sub byte [ecx + 0x36bdbdbd], dh
xor byte [ebp + 0x7cbdbdbd], ch
push esp
mov edi, 0x7f3ebf8c
mov ecx, 0x4938b2f4
inc edx
inc edx
inc edx
loopne 0xdee855
aad 0x31
scasd eax, dword es:[edi]
ret
mov cl, 0xbd
xor dword ss:[ecx - 0x42424247], ebx
aad 0x39
imul ebx, dword [ebp - 0x50ce2a43], 0x91bcbdc3
cdq
in al, dx
push ebp
mov eax, 0x54bdbdbd
idiv byte [edi - 0x26cf4243]
cdq
inc ecx
xor al, 0x91
cdq
push ecx
inc edx
enter 0x42b1, 0xffffffffffffffc8
mov ch, 0x55
lds edi, [ebp + 0x36bdbd]
mov ch, 0xbd
mov ebp, 0x3c748ebd
dec edi
adc dword [esi], ebx
xor byte [ecx + 0x1e114f3c], dh
xor byte [ecx + 0x553e6f8e], dh
mov eax, 0xf339b2f5
mov ebp, 0x35b2bdbd
cmc
mov ebp, 0x36dbbdbd
mov eax, dword [0x55463d84]
mov dl, 0x39
cmpsd dword [esi], dword es:[edi]
mov ebp, 0x463dbdbd
push esp
mov dl, 0x39
lodsb al, byte [esi]
mov ebp, 0x3cdbbdbd
inc esi
inc edx
cwde
mov dl, 0x39
test al, 0xbd
mov ebp, 0x7154fcbd
inc edx
inc edx
inc edx
xchg esp, eax
int1
test byte [esi + edi + 0x553eb87c], bh
mov ecx, 0x42420054
inc edx
xchg esp, eax
jmp 0x7d1da7f1
Function at 0x408866
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410204
push 0x4101fc
push str.FlsGetValue
push 0x21
call fcn.00408723
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40889d
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4088a5
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41020c
push 0x410204
push str.FlsSetValue
push 0x22
call fcn.00408723
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4088df
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40e150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x40a0b2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.00409dbe
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40a0e7
invalid
invalid
je 0x40a0e4

Function at 0x40a1f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00409e09
push eax
push esi
push dword [ebp + 8]
call fcn.00409dbe
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00409e09
push eax
push esi
push dword [ebp + 8]
call fcn.00409dbe
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00409df9
inc edx
call 0x9dc91393
jl 0x40a27e
invalid
invalid
Function at 0x40d5a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d5cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d5cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x71e5691d
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x203b5335
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x18008565
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call fcn.1800703b
push eax
lea ecx, [ebp - 8]
call fcn.1800774f
mov edi, dword [ebp - 8]
xor ecx, ecx
inc ecx
mov edx, 0x104
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or ecx, eax
jge 0x180085b0
push edx
lea ecx, [ebp - 8]
call fcn.180077dc
mov edi, dword [ebp - 8]
and dword [ebp - 0xc], 0
call fcn.1800703b
push eax
lea ecx, [ebp - 0xc]
call fcn.1800774f
call fcn.180170be
test al, al
jne 0x180085e2
call fcn.18014e5a
test al, al
jne 0x180085e2
mov dword [ebp - 0x10], 0x1c
mov esi, 0x1819a068
jmp 0x180085ee
mov dword [ebp - 0x10], 0x23
mov esi, str.MicrosoftEdgeUpdateLog
push esi
call fcn.18131ac0
pop ecx
push eax
push esi
lea ecx, [ebp - 0xc]
call fcn.1800768d
push edi
xor eax, eax
push eax
push eax
push dword [ebp - 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1800863b
push 0x1816db7c
mov ecx, ebx
call fcn.1800759a
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.18007012
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.18009f73
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
jmp 0x18008680
mov esi, dword [ebp - 0xc]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x18008658
push 0x1816db7c
mov ecx, ebx
call fcn.1800759a
jmp 0x18008668
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.1800a175
add eax, 0x10
mov dword [ebx], eax
lea ecx, [esi - 0x10]
call fcn.18007012
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.18009f73
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret 4
Function at 0x18009815
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 0x80
push 5
push ebx
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esi + 0x18], 0xffffffff
mov edi, eax
jne 0x18009850
xor al, al
jmp 0x18009874
cmp byte [esi + 0xb], bl
je 0x1800986b
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 2
push 0x1816eff8
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret

Function at 0x1800990b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x18
mov dword [ebp - 0x7c], ecx
lea edi, [ebp - 0x68]
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlSession_Manager
lea eax, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
push 0x80000002
movsw word es:[edi], word [esi]
mov dword [ebp - 0x78], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18009a3b
push 7
pop esi
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], ebx
push eax
push ebx
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], esi
push eax
push ebx
mov edi, str.PendingFileRenameOperations
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18009a3b
cmp dword [ebp - 0x6c], esi
jne 0x18009a3b
push dword [ebp - 0x74]
call fcn.181196a8
push dword [ebp - 0x74]
mov esi, eax
push ebx
push esi
mov dword [ebp - 0x80], esi
call fcn.1812da70
add esp, 0x10
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18009a30
mov edi, dword [ebp - 0x74]
shr edi, 1
lea eax, [edi - 2]
cmp eax, 0xffffd
ja 0x18009a30
cmp word [esi + edi*2 - 4], bx
jne 0x18009a30
cmp word [esi + edi*2 - 2], bx
jne 0x18009a30
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x70]
add eax, 0x14
mov dword [ebp - 0x70], ebx
push eax
mov edx, 0x1819a7bc
call fcn.18009ced
mov esi, dword [ebp - 0x70]
pop ecx
test edi, edi
je 0x18009a1c
mov eax, dword [ebp - 0x80]
push esi
lea eax, [eax + ebx*2]
push eax
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18009a1f
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc ebx
add ebx, eax
cmp ebx, edi
jb 0x180099f7
or ebx, 0xffffffff
cmp ebx, 0xffffffff
lea ecx, [esi - 0x10]
setne bl
call fcn.18007012
mov esi, dword [ebp - 0x80]
push esi
call fcn.18119673
pop ecx
mov al, bl
jmp 0x18009a3d
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret
Function at 0x18009bfe
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x18009c0b
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18009c44
cmp eax, 0x80
je 0x18009c44
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.18011617
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x18009c07
mov al, 1
pop esi
ret

Function at 0x1800a928
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x1800a95e
lea esi, [edi + 4]
test esi, esi
je 0x1800a95e
call fcn.1800a888
test al, al
je 0x1800a95e
mov ecx, edi
call fcn.1800a888
test al, al
je 0x1800a95e
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x1800a960
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x1800ca80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
push esi
push edi
mov esi, ecx
call fcn.1800703b
push eax
lea ecx, [ebp - 8]
call fcn.1800774f
mov eax, dword [ebp - 8]
xor edx, edx
inc edx
mov edi, 0x104
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, edi
or edx, ecx
jge 0x1800cac9
push edi
lea ecx, [ebp - 8]
call fcn.180077dc
mov eax, dword [ebp - 8]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
mov esi, eax
call fcn.18009f73
test esi, esi
jne 0x1800caeb
mov edi, 0x80004005
jmp 0x1800cb93
push ebx
push ecx
push ecx
lea ecx, [ebp - 8]
call fcn.1800fc53
push 0
push 0x5c
lea ecx, [ebp - 8]
call fcn.1800faf0
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1800cb11
mov ecx, dword [ebp - 8]
mov eax, dword [ecx - 0xc]
jmp 0x1800cb13
mov eax, ebx
and dword [ebp - 0xc], 0
lea ecx, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1800f9ed
mov esi, dword [ebp - 0xc]
mov ecx, esi
call fcn.18010903
test al, al
jne 0x1800cb52
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800cb52
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.18010903
test al, al
je 0x1800cb71
cmp ebx, 0xffffffff
je 0x1800cb88
lea eax, [ebx + 1]
push eax
push 0x5c
lea ecx, [ebp - 8]
call fcn.1800faf0
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.18007012
jmp 0x1800cb04
test edi, edi
jle 0x1800cb7e
movzx edi, di
or edi, 0x80070000
lea ecx, [esi - 0x10]
call fcn.18007012
jmp 0x1800cb92
lea ecx, [esi - 0x10]
call fcn.18007012
xor edi, edi
pop ebx
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.18007012
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.18118dc8
leave
ret
Function at 0x180109a4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x181c900c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, ebx
push edi
mov edi, edx
call fcn.1800f933
and dword [ebp - 0xc], 0
mov edx, esi
push ecx
push ecx
lea ecx, [ebp - 0xc]
call 0x18012d8c
push 0x250
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.1812da70
push edi
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x268]
call fcn.18009d3c
add esp, 0x18
lea ecx, [ebp - 0x264]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x268]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.18007012
cmp esi, 0xffffffff
jne 0x18010a2a
call fcn.1801ba7c
mov edi, eax
jmp 0x18010a8d
cmp dword [ebp - 0x264], 0x80
je 0x18010a3f
test byte [ebp - 0x264], 0x10
jne 0x18010a6c
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x238]
push eax
lea edx, [ebp - 0xc]
lea ecx, [ebp - 0x10]
call fcn.18009d3c
pop ecx
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.18009c74
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.18007012
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18010a2a
call fcn.1801ba7c
mov edi, eax
cmp edi, 0x80070012
je 0x18010a94
cmp esi, 0xffffffff
je 0x18010a9d
jmp 0x18010a96
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.18007012
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18118dc8
leave
ret

Function at 0x18010ab9
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
call fcn.180108c7
test al, al
je 0x18010af5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18010aea
test al, 1
je 0x18010aea
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x18010aea
pop esi
jmp fcn.1801ba7c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x18010ae4
xor eax, eax
pop esi
ret

Function at 0x18010f00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
clc
div ecx
test edx, edx
je 0x18010f0e
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.18010c20
dec ecx
push 0x458d367b
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x18010f8b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
call 0x15e97e1
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
rol esi, cl
inc ebp
stc

Function at 0x18011321
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x180112f7
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x18011315
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x18011373
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1801135a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x18011363
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1801136d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1801134f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x180112d9
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x180113c0
dec eax
je 0x180113b7
sub eax, 3
je 0x180113ae
mov dword [ebp - 4], 0x40
jmp 0x180113dd
mov dword [ebp - 4], 4
jmp 0x180113c3
mov dword [ebp - 4], 0x20
jmp 0x180113c3
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1801140f
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1801138f
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.18010c20
mov ebx, 0xff500adc
jne 0x1801141a
push 1
push esi
call edi
mov eax, esi
jmp 0x1801141b
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x18011b9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
invalid

Function at 0x18012c9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.18010be5
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x18012cc1
jmp fcn.18012cc6
jmp fcn.180125c2
Function at 0x18012f2b
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
jle 0x18013047
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp edi, 2
jle 0x18012faa
sub edx, 4
js 0x18013047
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, dword [ebp + 0x10]
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [ebx + 2]
movzx ecx, byte [ebx + 1]
shr eax, 6
and ecx, 0xf
add eax, dword [ebp + 0x10]
mov al, byte [eax + ecx*4]
mov ecx, dword [ebp + 0x10]
mov byte [esi + 2], al
movzx eax, byte [ebx + 2]
add ebx, 3
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
sub edi, 3
jmp 0x18012f46
sub edi, 1
je 0x1801300a
sub edi, 1
jne 0x18013040
sub edx, 3
js 0x18013047
movzx eax, byte [ebx]
mov edi, dword [ebp + 0x10]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
add ecx, edi
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [ebx + 1]
and eax, 0xf
mov al, byte [edi + eax*4]
mov byte [esi + 2], al
add esi, 3
cmp byte [ebp + 0x14], 0
je 0x18013040
lea eax, [edx - 1]
test eax, eax
js 0x18013047
mov byte [esi], 0x3d
inc esi
jmp 0x18013040
sub edx, 2
js 0x18013047
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [ebx]
and eax, 3
add eax, eax
mov al, byte [ecx + eax*8]
mov byte [esi + 1], al
add esi, 2
cmp byte [ebp + 0x14], 0
je 0x18013040
lea eax, [edx - 2]
test eax, eax
js 0x18013047
mov word [esi], 0x3d3d
add esi, 2
sub esi, dword [ebp + 8]
mov eax, esi
jmp 0x18013049
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1a6363c3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2a81ed9
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219