joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41593c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
call fcn.00415460
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004040ec
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4159a4
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [0x417538]
mov dl, 1
mov eax, dword [0x41533c]
call fcn.0040aa18
call fcn.004036b0
mov esp, ebp
pop ebp
ret 8

Function at 0x4159ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004040ec
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x415a0e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [0x41763c]
mov dl, 1
mov eax, dword [0x41533c]
call fcn.0040aa18
call fcn.004036b0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
call fcn.004154b0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8
Function at 0x10001050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov al, 0x45
push ebx
mov byte [esp + 0x21], al
mov byte [esp + 0x24], al
mov al, 0x73
push ebp
mov byte [esp + 0x3c], al
mov byte [esp + 0x3d], al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x38]
push edi
lea ecx, [esp + 0x2c]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x34], 0x4b
mov byte [esp + 0x36], 0x52
mov byte [esp + 0x37], 0x4e
mov byte [esp + 0x39], 0x4c
mov byte [esp + 0x3a], 0x33
mov byte [esp + 0x3b], 0x32
mov byte [esp + 0x3c], 0x2e
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x6c
mov byte [esp + 0x40], 0
mov byte [esp + 0x44], 0x47
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], 0x50
mov byte [esp + 0x48], 0x72
mov byte [esp + 0x49], 0x6f
mov byte [esp + 0x4a], 0x63
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4e], 0x48
mov byte [esp + 0x4f], bl
mov byte [esp + 0x50], 0x61
mov byte [esp + 0x51], 0x70
mov byte [esp + 0x52], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
lea edx, [esp + 0x20]
lea eax, [esp + 0x2c]
push edx
push eax
mov byte [esp + 0x28], 0x48
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x70
mov byte [esp + 0x2c], 0x52
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x41
mov byte [esp + 0x2f], 0x6c
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x63
mov byte [esp + 0x33], 0
call esi
push eax
call edi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2c]
push ecx
push edx
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0x48
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], 0x61
mov byte [esp + 0x1f], 0x70
mov byte [esp + 0x20], 0x41
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x6c
mov byte [esp + 0x23], 0x6f
mov byte [esp + 0x24], 0x63
mov byte [esp + 0x25], 0
call esi
push eax
call edi
mov esi, eax
mov eax, dword [esp + 0x50]
test eax, eax
je 0x100011ad
mov ecx, dword [esp + 0x54]
push ecx
push eax
push 0
call ebp
push eax
call dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov edx, dword [esp + 0x54]
push edx
push 0
call ebp
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x100011d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov al, 0x45
push ebx
mov byte [esp + 0x11], al
mov byte [esp + 0x14], al
mov al, 0x6c
push ebp
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x1c]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x24], 0x4b
mov byte [esp + 0x26], 0x52
mov byte [esp + 0x27], 0x4e
mov byte [esp + 0x29], 0x4c
mov byte [esp + 0x2a], 0x33
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], 0x2e
mov byte [esp + 0x2d], 0x64
mov byte [esp + 0x30], 0
mov byte [esp + 0x18], 0x48
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0x61
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1c], 0x46
mov byte [esp + 0x1d], 0x72
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
mov al, 0x73
mov byte [esp + 0x34], al
mov byte [esp + 0x35], al
lea edx, [esp + 0x2c]
lea eax, [esp + 0x1c]
push edx
push eax
mov byte [esp + 0x34], 0x47
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], 0x50
mov byte [esp + 0x38], 0x72
mov byte [esp + 0x39], 0x6f
mov byte [esp + 0x3a], 0x63
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3e], 0x48
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0x61
mov byte [esp + 0x41], 0x70
mov byte [esp + 0x42], 0
call esi
push eax
call edi
mov ecx, dword [esp + 0x40]
push ecx
push 0
call eax
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x10001560
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x34]
push ebp
push edi
xor ecx, ecx
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebp, [ecx + eax + 0x18]
jbe 0x100016bc
push ebx
push esi
add ebp, 0x10
mov bl, 0x6c
jmp 0x1000159c
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
mov byte [esp + 0x30], 0x4b
mov byte [esp + 0x31], 0x45
mov byte [esp + 0x32], 0x52
mov byte [esp + 0x33], 0x4e
mov byte [esp + 0x34], 0x45
mov byte [esp + 0x35], 0x4c
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0
mov byte [esp + 0x20], 0x56
mov byte [esp + 0x21], 0x69
mov byte [esp + 0x22], 0x72
mov byte [esp + 0x23], 0x74
mov byte [esp + 0x24], 0x75
mov byte [esp + 0x25], 0x61
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x41
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x6f
mov byte [esp + 0x2b], 0x63
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp]
test ecx, ecx
jne 0x1000166b
mov ecx, dword [esp + 0x40]
mov esi, dword [ecx + 0x38]
test esi, esi
jle 0x1000169a
mov edx, dword [ebp - 4]
push 4
push 0x1000
add edx, edi
push esi
push edx
call eax
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebp - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x1000169a
push 4
push 0x1000
push ecx
mov ecx, dword [ebp - 4]
add ecx, edi
push ecx
call eax
mov ecx, dword [ebp]
mov esi, dword [ebp + 4]
mov edi, dword [esp + 0x3c]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 8], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
inc eax
add ebp, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x10001598
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x28
ret
Function at 0x100016d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x4c]
mov al, 0x45
mov byte [esp + 0x29], al
mov byte [esp + 0x2c], al
mov eax, dword [edi]
xor ecx, ecx
mov byte [esp + 0x28], 0x4b
mov byte [esp + 0x2a], 0x52
mov byte [esp + 0x2b], 0x4e
mov byte [esp + 0x2d], 0x4c
mov byte [esp + 0x2e], 0x33
mov byte [esp + 0x2f], 0x32
mov byte [esp + 0x30], 0x2e
mov byte [esp + 0x31], 0x64
mov byte [esp + 0x32], 0x6c
mov byte [esp + 0x33], 0x6c
mov byte [esp + 0x34], 0
mov cx, word [eax + 0x14]
lea edx, [esp + 0x1c]
mov bl, 0x74
lea esi, [ecx + eax + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
mov byte [esp + 0x24], 0x56
mov byte [esp + 0x25], 0x69
mov byte [esp + 0x26], 0x72
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], 0x75
mov byte [esp + 0x29], 0x61
mov byte [esp + 0x2a], 0x6c
mov byte [esp + 0x2b], 0x46
mov byte [esp + 0x2c], 0x72
mov byte [esp + 0x2d], 0x65
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, dword [edi]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
cmp word [ebp + 6], 0
jbe 0x10001890
add esi, 0x24
mov eax, dword [esi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov edi, eax
and ecx, 1
and edx, 1
shr edi, 0x1f
test eax, 0x2000000
je 0x100017cc
mov ecx, dword [esi - 0x14]
mov edx, dword [esi - 0x1c]
push 0x4000
push ecx
push edx
call dword [esp + 0x20]
jmp 0x10001870
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [edi + ecx*2]
mov edi, dword [edx*4 + 0x1002d030]
je 0x100017e6
or edi, 0x200
mov ecx, dword [esi - 0x14]
test ecx, ecx
jne 0x100017ff
test al, 0x40
je 0x100017f6
mov ecx, dword [ebp + 0x20]
jmp 0x100017fd
test al, al
jns 0x10001870
mov ecx, dword [ebp + 0x24]
test ecx, ecx
jbe 0x10001870
lea eax, [esp + 0x38]
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x40], 0x56
mov byte [esp + 0x41], 0x69
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], bl
mov byte [esp + 0x44], 0x75
mov byte [esp + 0x45], 0x61
mov byte [esp + 0x46], 0x6c
mov byte [esp + 0x47], 0x50
mov byte [esp + 0x48], 0x72
mov byte [esp + 0x49], 0x6f
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], 0x65
mov byte [esp + 0x4c], 0x63
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esi - 0x14]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esi - 0x1c]
push edi
push ecx
push edx
call eax
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
xor edx, edx
inc eax
mov ebp, dword [ecx]
add esi, 0x28
mov dword [esp + 0x10], eax
mov dx, word [ebp + 6]
cmp eax, edx
jl 0x10001798
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x10001d90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, 0x5ab
and eax, 0xff
push esi
cdq
idiv ecx
mov esi, dword [esp + 0xc]
add dl, 0x3d
test esi, esi
jbe 0x10001dbd
mov eax, dword [esp + 8]
mov cl, byte [eax]
xor cl, dl
add cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x10001db1
pop esi
ret

Function at 0x10001dc0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push 0x400
push 0x26000
push 0x10007030
call fcn.10001d90
push 0x10007030
call fcn.100012d0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10001e05
mov eax, dword [esp + 0x10]
push eax
push ebx
call fcn.10001ad0
add esp, 8
test eax, eax
jne 0x10001e09
push ebx
call fcn.10001b70
add esp, 4
pop edi
pop esi
pop ebx
ret
sub esp, 0x2a8
mov ecx, 0xaa
mov esi, str.a___ii_gUQfQl_ohW
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call eax
push ebx
call fcn.10001b70
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x70abc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x21b000]
push edi
jmp 0x70abda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x70abe1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70abd0
mov eax, 1
add ebx, ebx
jne 0x70abf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x70ac04
jne 0x70ac23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70ac23
dec eax
add ebx, ebx
jne 0x70ac10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x70abe8
add ebx, ebx
jne 0x70ac1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x70ac75
xor ecx, ecx
sub eax, 3
jb 0x70ac3b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x70acaa
sar eax, 1
mov ebp, eax
jmp 0x70ac46
add ebx, ebx
jne 0x70ac46
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70ac14
inc ecx
add ebx, ebx
jne 0x70ac54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70ac14
add ebx, ebx
jne 0x70ac61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x70ac56
jne 0x70ac72
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x70ac56
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x70ac94
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x70ac86
jmp 0x70abd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x70ac94
add edi, ecx
jmp 0x70abd6
pop esi
mov edi, esi
mov ecx, 0x1933
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x70acb2
cmp byte [edi], 0xa
jne 0x70acb2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x70acb7
lea edi, [esi + 0x305000]
mov eax, dword [edi]
or eax, eax
je 0x70ad2f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x330b34]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x330ce8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x70ace4
mov ecx, edi
jns 0x70ad13
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x330cf0]
or eax, eax
je 0x70ad29
mov dword [ebx], eax
add ebx, 4
jmp 0x70ad01
call dword [esi + 0x330cec]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x70ad60
cmp al, 0xef
ja 0x70ad53
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x70ad35
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x70ad42
mov ebp, dword [esi + 0x330cf4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x70ad94
sub esp, 0xffffff80
jmp 0x416f1c
Function at 0x9e7440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9e748c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9e7452
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9e74f0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9e7542
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9e7548
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9ffa35
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009ff6f5

Function at 0xa0482f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a046ae

Function at 0xa09de0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa09e0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa09e0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x18506a84
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x60c63105
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x405b08
Capabilities:
Encode data using xor

Disassembly:
call fcn.00405a11
xor ecx, ecx
sub ecx, 0xffffffa1
call 0x405b08
rcr byte [esi - 0x7f], 0x76
push cs
mov edx, 0x83fbccbe
xor dword [esi + 0xe], 0xfbccbeba
sub esi, 0xfffffffc
out dx, al
cld
loop 0x405b0b
xchg ecx, eax
ja 0x405b69
adc bl, byte [0x45043356]
inc ecx
or al, 0xa5
cmp ecx, eax
ret 0xde3
sahf
dec ecx
daa
leave
stosb byte es:[edi], al
jge 0x405b13

Function at 0x40a940
Capabilities:
Encode data using xor

Disassembly:
push ebp
xchg ebp, eax
in al, dx
or byte [ebp - 0xc], al
fmul qword [ebx + 0x871850c]
inc ecx
sbb al, 0x8f
pop dword [ebp + 0x4108e4]
adc ecx, ecx
jne 0x40a970
mov eax, dword [eax*4 + 0x4047f4]
push eax
call dword [0x759e18]
popal
invalid
mov eax, dword [ebp + 0x73]
test eax, eax
mov edi, 0x50638b0d
push ecx
call dword [0xe7c01c]

Function at 0x10001016
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
push edi
push 0x10003010
push 0x65
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10001061
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x10001065
xor eax, eax
jmp 0x100010a7
push ebx
mov ebx, dword [esi]
push 0
push 4
push 2
push 0
push 2
push 0x40000000
push 0x10003038
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100010a3
lea eax, [esp + 0xc]
push 0
push eax
add esi, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x100010ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
xor edx, edx
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], edx
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push 0x8000000
push edx
push edx
push edx
push 0x10003038
push edx
mov word [ebp - 0x24], dx
mov dword [ebp - 0x28], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x10001110
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x10]
call esi
pop esi
xor eax, eax
leave
ret
Function at 0x402300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40232c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x402354
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40235a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x4023c2
jg 0x402371
test esi, esi
je 0x4023c2
test ecx, ecx
jl 0x4023bd
jg 0x40237b
test eax, eax
je 0x4023bd
cmp edi, ecx
jg 0x40238f
jl 0x402385
cmp esi, eax
jae 0x40238f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x4023c5
mov ecx, dword [ebp + 8]
jmp 0x4023cf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x4023e9
jg 0x4023cf
test esi, esi
je 0x4023e9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4023e9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc