joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa72f84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0xa72fdf
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
sub dword [ebp + 8], 1
mov byte [edi - 1], dl
jne 0xa72fa4
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret

Function at 0xa75948
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x18]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0xfffff887
xchg dword [esp], edx
push esi
mov esi, dword [esp + 4]
lea esi, [esi + 0x7d]
xchg dword [esp + 4], esi
mov dword [esp + 4], esi
mov esi, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], edx
push edx
mov edx, dword [esp + 4]
lea edx, [edx + 0x26]
xchg dword [esp + 4], edx
mov dword [esp + 4], edx
mov edx, dword [esp]
lea esp, [esp + 4]
xchg dword [esp], edx
push ebp
mov ebp, esp
leave
popfd
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x2b]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
jmp fcn.00a72f84
Function at 0x420aa8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x420ae3
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x420ac0
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x420aff
dec esi
je 0x420af8
dec esi
jne 0x420b04
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x5402c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xbf000]
push edi
or ebp, 0xffffffff
jmp 0x5402e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5402e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5402d8
mov eax, 1
add ebx, ebx
jne 0x5402fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54030c
jne 0x54032b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54032b
dec eax
add ebx, ebx
jne 0x540318
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5402f0
add ebx, ebx
jne 0x540327
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x54037d
xor ecx, ecx
sub eax, 3
jb 0x540343
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5403b2
sar eax, 1
mov ebp, eax
jmp 0x54034e
add ebx, ebx
jne 0x54034e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54031c
inc ecx
add ebx, ebx
jne 0x54035c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54031c
add ebx, ebx
jne 0x540369
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54035e
jne 0x54037a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54035e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54039c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54038e
jmp 0x5402de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54039c
add edi, ecx
jmp 0x5402de
pop esi
mov edi, esi
mov ecx, 0x2c6b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5403ba
cmp byte [edi], 0x12
jne 0x5403ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5403bf
lea edi, [esi + 0x13d000]
mov eax, dword [edi]
or eax, eax
je 0x540437
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x142404]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x142508]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5403ec
mov ecx, edi
jns 0x54041b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14250c]
or eax, eax
je 0x540431
mov dword [ebx], eax
add ebx, 4
jmp 0x540409
call dword [esi + 0x142514]
mov ebp, dword [esi + 0x142510]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x54046b
sub esp, 0xffffff80
jmp 0x43f35a
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0xfa40c8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0xd196831
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x348bc984
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x348bcae2
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x348bcae2
mov esi, dword [ebp]
test esi, esi
je 0x348bcae2
push ebx
mov ebx, dword [esp + 0x20]
cmp ebx, 1
jne 0x348bc9c5
cmp esi, 2
jae 0x348bc9c5
pop ebx
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 0x18
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebp
push edi
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
mov dword [esp + 0x24], eax
jne 0x348bcad7
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x348bca12
cmp ebx, 1
jne 0x348bc9ff
cmp ecx, 2
je 0x348bca1b
pop ebx
pop edi
mov dword [esp + 0x1c], 0x65d
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
ret 0x18
cmp ebx, 1
jne 0x348bcad7
mov eax, dword [ebp]
cmp eax, esi
jae 0x348bca30
shr eax, 1
mov word [edi + eax*2], 0
mov ecx, dword [esp + 0x28]
jmp 0x348bca3b
mov edx, esi
shr edx, 1
mov word [edi + edx*2 - 2], 0
cmp ecx, 2
jne 0x348bcad7
push esi
call dword [sym.imp.msvcr80.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x348bca60
pop ebx
pop edi
pop esi
mov eax, 0xe
pop ebp
ret 0x18
shr esi, 1
push esi
push ebx
push edi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
test eax, eax
jbe 0x348bcab9
cmp esi, eax
lea ecx, [eax + eax]
mov dword [ebp], ecx
jae 0x348bca9b
push ebx
mov word [edi], 0
mov dword [esp + 0x28], 0xea
call dword [sym.imp.msvcr80.dll_free]
mov eax, dword [esp + 0x28]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
push esi
push edi
push ebx
call dword [sym.imp.MSO.dll_Ordinal_6877]
push ebx
call dword [sym.imp.msvcr80.dll_free]
mov eax, dword [esp + 0x28]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
mov word [edi], 0
push ebx
mov dword [ebp], 0
mov dword [esp + 0x28], 0x57
call dword [sym.imp.msvcr80.dll_free]
add esp, 4
mov eax, dword [esp + 0x24]
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 0x18

Function at 0x348d5356
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0x104
push 0x348ed640
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSO.dll_Ordinal_6818]
push 0x348ed640
call dword [sym.imp.msvcr80.dll_remove]
add esp, 4
pop ebp
ret 4
Function at 0x348dbbaa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x348dbbb9
pop dword [ebp - 0x4c]
mov eax, 0x348dbbb9
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x623d1a75
add dword [ebp - 0x5c], 0xec152ad6
mov dword [ebp - 0x58], 0xdeedd7ad
sub dword [ebp - 0x58], 0xacba8b68
mov dword [ebp - 0x54], 0x7847d71d
add dword [ebp - 0x54], 0xd4046d11
mov dword [ebp - 0x50], 0x9eee2381
sub dword [ebp - 0x50], 0x9eee2381
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xc53b2bab
sub eax, 0x90b21a97
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x408ec331
add dword [ebp - 0x5c], 0x33e3a625
mov dword [ebp - 0x58], 0xf1eb9c6d
add dword [ebp - 0x58], 0x4f80c508
mov dword [ebp - 0x54], 0x4d3d711
add dword [ebp - 0x54], 0x5e9b955b
mov dword [ebp - 0x50], 0x656c540a
add dword [ebp - 0x50], 0x9a93abf6
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x74b12e8b
sub eax, 0x40281cd7
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x4d4e1
push 0
call eax
mov ecx, 0x84da3765
add ecx, 0x7b2619be
mov ebx, eax
mov edi, 0x2bfcd257
sub edi, 0xf76db257
add edi, dword [ebp - 0x4c]
mov edx, 0xe180c8fb
add edx, 0x218474b2
mov esi, dword [edi]
sub dword [ebp - 0x34], 0x24985f5a
sub esi, edx
sub dword [ebp - 0x28], ecx
mov dword [ebx], esi
xor dword [ebp - 0x34], esi
add ebx, 4
add edi, 0x25615a64
sub edi, 0x25615a60
loop 0x348dbcd6
add eax, 0x84d5c370
sub eax, 0x84d48c11
mov ebx, eax
add eax, 0x26d304f5
sub eax, 0x26d304f0
mov ecx, 0x739efb22
add ecx, 0xc0ea04de
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x348e43b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x34892d6c]
jne 0x348e4962
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x348ec620], eax
mov dword [0x348ec61c], ecx
mov dword [0x348ec618], edx
mov dword [0x348ec614], ebx
mov dword [0x348ec610], esi
mov dword [0x348ec60c], edi
mov word [0x348ec638], ss
mov word [0x348ec62c], cs
mov word [0x348ec608], ds
mov word [0x348ec604], es
mov word [0x348ec600], fs
mov word [0x348ec5fc], gs
pushfd
pop dword [0x348ec630]
mov eax, dword [ebp]
mov dword [0x348ec624], eax
mov eax, dword [ebp + 4]
mov dword [0x348ec628], eax
lea eax, [ebp + 8]
mov dword [0x348ec634], eax
mov eax, dword [ebp - 0x320]
mov dword [0x348ec570], 0x10001
mov eax, dword [0x348ec628]
mov dword [0x348ec524], eax
mov dword [0x348ec518], 0xc0000409
mov dword [0x348ec51c], 1
mov eax, dword [0x34892d6c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x348e9be0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x348ec568], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x34892dac
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x348ec568], 0
jne 0x348e4a52
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x426120
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00426130

Function at 0x437de0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00437aa0

Function at 0x407430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40743f
pop dword [ebp - 0x18]
mov eax, 0x40743f
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x4eebe
push 0
mov eax, 0xd6c472c7
add eax, 0x2980700d
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x2c1a0f0b
add ecx, 0xd3e63103
mov edx, eax
mov esi, 0xecb8db9a
sub esi, 0xec714b9a
add esi, dword [ebp - 0x18]
mov ebx, 0xa773543a
sub ebx, 0x6aaa0fdc
xor dword [ebp - 8], 0xe6d5f772
mov edi, dword [esi]
add dword [ebp - 8], 0x981be1cb
add edi, ebx
xor dword [ebp - 8], 0xc900d5a1
mov dword [edx], edi
mov dword [ebp - 4], 0xb8018003
add edx, 0xa73f7060
add edx, 0x58c08fa4
add esi, 0x982099f
sub esi, 0x982099b
loop 0x407499
add eax, 0x20f077d6
sub eax, 0x20ef84cb
xor ebx, ebx
add ebx, eax
add eax, 0x608f9f64
add eax, 0x9f7060a1
mov ecx, 0x67909ff6
sub ecx, 0x67509ff6
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x444db9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46f748
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x444dfc
push str.SystemFunction040
push dword [0x46f748]
call edi
push str.SystemFunction041
push dword [0x46f748]
mov dword [0x46f738], eax
call edi
mov dword [0x46f73c], eax
jmp 0x444e01
mov eax, dword [0x46f73c]
cmp dword [0x46f738], 0
je 0x444e12
test eax, eax
jne 0x444eb9
push 0x46f74c
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x444ec3
push str.CryptProtectMemory
push dword [0x46f74c]
call edi
cmp dword [0x46f738], 0
mov dword [0x46f740], eax
jne 0x444e77
test eax, eax
jne 0x444e77
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444e61
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x444e68
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work35_swix_srclibsdutilcryputil.cpp
call fcn.004013b3
jmp 0x444ec3
push str.CryptUnprotectMemory
push dword [0x46f74c]
call edi
cmp dword [0x46f73c], 0
mov dword [0x46f744], eax
jne 0x444eb9
test eax, eax
jne 0x444eb9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x444ead
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x444eb4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x444e6b
mov dword [0x46f750], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0xbb14c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x938015
lea edi, [esi - 0x537015]
push edi
or ebp, 0xffffffff
jmp 0xbb14e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xbb14e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb14d8
mov eax, 1
add ebx, ebx
jne 0xbb14fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xbb150c
jne 0xbb152b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb152b
dec eax
add ebx, ebx
jne 0xbb1518
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xbb14f0
add ebx, ebx
jne 0xbb1527
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xbb157d
xor ecx, ecx
sub eax, 3
jb 0xbb1543
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xbb15b2
sar eax, 1
mov ebp, eax
jmp 0xbb154e
add ebx, ebx
jne 0xbb154e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb151c
inc ecx
add ebx, ebx
jne 0xbb155c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbb151c
add ebx, ebx
jne 0xbb1569
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xbb155e
jne 0xbb157a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xbb155e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xbb159c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xbb158e
jmp 0xbb14de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xbb159c
add edi, ecx
jmp 0xbb14de
pop esi
mov edi, esi
mov ecx, 0x1314d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xbb15ba
cmp byte [edi], 0x2b
jne 0xbb15ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xbb15bf
lea edi, [esi + 0x79b000]
mov eax, dword [edi]
or eax, eax
je 0xbb162e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7b7034]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7b705c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xbb15ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7b7064]
or eax, eax
je 0xbb1628
mov dword [ebx], eax
add ebx, 4
jmp 0xbb1609
call dword [esi + 0x7b7060]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xbb1668
cmp al, 0xef
ja 0xbb1652
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xbb1634
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
or eax, eax
jne 0xbb1641
mov eax, dword [edi]
add edi, 4
jmp 0xbb1641
mov ebp, dword [esi + 0x7b7068]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xbb169c
sub esp, 0xffffff80
jmp 0x466030
Function at 0x1000a6a4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10011dac], 0
push esi
push edi
jne 0x1000a61a
call fcn.1000a586
test eax, eax
je 0x1000a65f
mov eax, dword [0x10011dac]
cmp eax, 1
jne 0x1000a63b
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000a65f
jmp 0x1000a6a1
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000a6a1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000a663
xor eax, eax
jmp 0x1000a6a1
mov eax, dword [esi]
push dword [0x10011dac]
call edi
mov edi, eax
test edi, edi
je 0x1000a685
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000a6a1
lea edi, [esi + 0xff0]
push esi
push dword [0x10011dac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000a68b
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000a606

Function at 0x1000a812
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011c4c]
jne 0x1000a81c
repz ret
jmp fcn.1000b021

Function at 0x1000acde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000aced
pop dword [ebp - 0x50]
mov eax, 0xfeeaa665
add eax, 0x11160688
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3b98b
push 0
mov eax, 0x855c9ca1
add eax, 0x8aa4246f
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xbb919798
add ecx, 0x446ec201
mov edx, eax
mov ebx, 0x1001c600
add ebx, dword [ebp - 0x50]
mov esi, 0x2a17b260
xor dword [ebp - 0x28], eax
mov edi, dword [ebx]
sub dword [ebp - 8], 0x1d934da9
sub edi, esi
xor dword [ebp - 0x24], esi
mov dword [edx], edi
sub dword [ebp - 0x40], 0x6ef36872
add edx, 0x8089e271
add edx, 0x7f761d93
add ebx, 0xbf9c672b
sub ebx, 0xbf9c6727
loop 0x1000ad40
add eax, 0x241cdd4e
add eax, 0xdbe47be9
mov ebx, eax
add eax, 5
mov ecx, 0xf54a8b3
sub ecx, 0xff54a8b3
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x4020c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x6731c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x3ff
lea eax, [ebp - 0x407]
mov byte [ebp - 0x408], 0
push 0
push eax
mov esi, edx
mov ebx, ecx
call fcn.0058b410
add esp, 8
mov dword [ebp - 0x410], 0
mov edx, esi
mov dword [ebp - 0x40c], 0
lea ecx, [ebp - 0x410]
call fcn.00401ff0
add esp, 4
test eax, eax
jne 0x40216e
push dword [ebp - 0x410]
lea eax, [ebp - 0x408]
push ebx
push str._s___s
push eax
call fcn.0058756f
add esp, 0x10
lea eax, [ebp - 0x408]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x402150
xor esi, esi
jmp 0x402158
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 0x410]
push 0x6746d0
call dword [0x6746d4]
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00587560
mov esp, ebp
pop ebp
ret
Function at 0x402e70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
xor eax, eax
push ebx
push esi
push edi
jmp 0x402e80
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x67fd90], ecx
inc eax
cmp eax, 0x100
jb 0x402e80
cmp eax, 0x800
jae 0x402f53
lea esp, [esp]
mov edx, dword [eax*4 + 0x67f990]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x67fd90]
mov dword [eax*4 + 0x67fd90], edx
inc eax
cmp eax, 0x800
jb 0x402f30
mov dword [0x697924], 0x403080
mov dword [ebp - 4], 0x40000
pushfd
pop eax
mov edx, eax
xor eax, dword [ebp - 4]
push eax
popfd
pushfd
pop eax
xor eax, edx
push edx
popfd
and dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x403070
mov dword [ebp - 8], 0x200000
pushfd
pop eax
mov edx, eax
xor eax, dword [ebp - 8]
push eax
popfd
pushfd
pop eax
xor eax, edx
push edx
popfd
and dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x403070
lea eax, [ebp - 0x20]
xor ecx, ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
call fcn.00406e00
add esp, 0xc
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x18]
mov ecx, 1
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00406e00
mov edi, dword [ebp - 0x18]
add esp, 0xc
mov esi, edi
xor ecx, ecx
shr esi, 8
mov eax, 0x6746e8
shr edi, 4
and esi, 0xff00f
and edi, 0xf00f
xor edx, edx
mov ebx, dword [ebp - 0x24]
cmp dword [eax - 8], ebx
jne 0x40300f
mov ebx, dword [ebp - 0x20]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp - 0x1c]
jne 0x40300f
cmp dword [eax], ebx
je 0x40301e
add edx, 0xc
inc ecx
add eax, 0xc
cmp edx, 0x24
jb 0x402ff8
or ecx, 0xffffffff
sub ecx, 0
je 0x403057
dec ecx
je 0x403046
dec ecx
jne 0x403070
cmp esi, 6
jb 0x403070
jne 0x403066
cmp edi, 0xf
jb 0x403070
mov dword [0x697924], 0x403120
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 5
jb 0x403070
jne 0x403066
cmp edi, 6
jb 0x403070
cmp edi, 0xa
jmp 0x403064
cmp esi, 6
jb 0x403070
jne 0x403066
cmp edi, 0x100c
je 0x403070
mov dword [0x697924], 0x403120
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403c50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x403caf
mov dword [edi], 0
mov edx, 0x400000
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
cmp esi, 0x400000
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x403cb8
test ecx, ecx
je 0x403caf
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x403c70
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x403d2f
mov dword [edi], 0
mov edx, 0x400000
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
cmp esi, 0x400000
mov eax, esi
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x403d38
test ecx, ecx
je 0x403d2f
mov ecx, dword [ebp - 4]
mov edx, 0x400000
test esi, esi
jne 0x403cf0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret