joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405280
Capabilities:
Encode data using xor

Disassembly:
push 0x405334
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
pushal
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov ebx, 0x93ecd7ec
xor al, 0xfa
inc ebp
stosb byte es:[edi], al
adc eax, edi
pop esi
pushal
jg 0x40529c
mov al, byte [pe_dos_header]
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub eax, 0x30303043
sub eax, 0x63656f72
bound esp, qword [esi + 0x76]
push 0x69
jbe 0x4052c7
jge 0x4052ed
xor ch, byte [esi]
cmp dword [eax], esi
cmp dword [ebx], esi
xor al, 0x30
xor dh, byte [ebx]
cmp byte [ebx + esi], dh
cmp dword [edx], esi
cmp byte [0x36353334], dh
xor eax, 0x34353634
add byte ss:[edi + ebp*2 + 0x6c], ah
xor ch, byte gs:[esi]
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
adc byte [eax + eax*2], al
add bh, bh
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], dl
test byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x1001018f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x100101b3
cmp word [eax], 0x5a4d
jne 0x100101b3
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x100101b3
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jmp 0x100101bb
mov esp, ebp
pop ebp
ret 4

Function at 0x10012651
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x10012704
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x10034813
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x50
call fcn.1005b74b
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x14
rep stosd dword es:[edi], eax
push 0x100852e3
mov ebx, dword [ebp + 0x14]
push dword [ebx]
call fcn.100021c0
add esp, 8
cmp eax, 0
jne 0x100348e9
push reloc.WS2_32.dll_bind
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x1008585c
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x10034887
mov eax, 0x100852e3
push eax
push 4
mov ebx, 0x14c
call fcn.1005f340
add esp, 0x34
push 0x80000301
push 0
push eax
push reloc.WS2_32.dll_connect
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x100348b7
mov eax, 0x100852e3
push eax
push 2
mov ebx, 0x134
call fcn.1005cd00
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x100348e3
push ebx
call fcn.1005b745
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 0x1c]
push dword [ebx]
push dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0
push 0
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10034942
push 0x8e
push 0x402304b
push 6
call fcn.1005b751
add esp, 0xc
cmp dword [ebp + 0x20], 0
jne 0x100349bb
mov ebx, dword [ebp + 0x1c]
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp - 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10034982
push 0x11e
push 0x402304b
push 6
call fcn.1005b751
add esp, 0xc
mov ebx, dword [ebp + 0x1c]
mov ebx, dword [ebx]
add ebx, 4
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp - 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100349bb
push 0x141
push 0x402304b
push 6
call fcn.1005b751
add esp, 0xc
mov ebx, dword [ebp + 0x1c]
mov ebx, dword [ebx]
add ebx, 8
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
jmp 0x100349d0
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.1005b745
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100349e4
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
push 0x1008
call fcn.1005b74b
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x10152b70
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x400
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jne 0x10034a41
mov eax, 0
jmp 0x10034bcf
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0xc]
push eax
push 0x800
mov ebx, dword [ebp - 8]
call fcn.1000274b
push ebx
xor eax, eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10034a7c
push 0x80
push 0x4022fed
push 6
call fcn.1005b751
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10034bc7
fild dword [ebp - 0xc]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fdiv qword [0x1014dc4b]
fstp qword [ebp - 0x24]
mov dword [ebp - 0x2c], 1
fld qword [ebp - 0x24]
call fcn.10002600
cmp eax, 0
jge 0x10034ac6
push 0xe4
push 0x4022fed
push 0xa
call fcn.1005b751
add esp, 0xc
mov dword [ebp - 0x28], eax
lea ebx, [ebp - 0x2c]
call fcn.1000274b
push ecx
shl ecx, 2
add ecx, 8
push ecx
call fcn.1005b74b
add esp, 4
mov edi, eax
mov dword [edi], 1
add edi, 4
pop ecx
push eax
push ecx
lea esi, [ebp - 0x28]
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov ebx, dword [ebp - 8]
call fcn.1000274b
pop edx
mov eax, ecx
cmp ecx, edx
jle 0x10034b05
mov ecx, edx
sub eax, ecx
sub edx, ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
test edx, edx
je 0x10034b1b
mov ecx, edx
xor eax, eax
rep stosd dword es:[edi], eax
push dword [ebp - 8]
call fcn.1005b745
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
call fcn.10002732
xor ecx, ecx
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x10034bc4
mov ebx, dword [ebp - 8]
call fcn.1000274b
push ebx
push ecx
mov eax, dword [ebp - 0x10]
dec eax
jns 0x10034b70
push 0x14e
push 0x4022fed
push 4
call fcn.1005b751
add esp, 0xc
pop ecx
pop ebx
cmp eax, ecx
jl 0x10034b8d
push 0x14e
push 0x4022fed
push 1
call fcn.1005b751
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x18]
cmp dword [ebx], eax
jne 0x10034baa
mov dword [ebp - 0x14], 1
push 0
mov ebx, 0x350
call fcn.1005cdb0
add esp, 4
pop eax
pop ebx
pop ecx
jmp 0x10034b3b
add esp, 0xc
mov eax, dword [ebp - 0x14]
jmp 0x10034bcf
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.1005b745
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10034be3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
nop
nop
cmp dword [ebp - 4], esp
je 0x10034c1a
push 0x24
push 0x4023047
push 6
call fcn.1005b751
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
mov eax, 0
sete al
jmp 0x10034c2e
mov esp, ebp
pop ebp
ret 4
Function at 0x1003feca
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov edi, eax
mov eax, dword [esi + 4]
bswap eax
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp + 8], eax
mov eax, dword [ebx + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x1003fee9
mov ebx, dword [ebp + 8]
mov edx, 0xe3779b90
mov esi, 0x10
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shr ecx, 5
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
lea edx, [edx + 0x61c88647]
sub edi, ecx
sub esi, 1
jne 0x1003ff05
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10042827
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov dword [ebp + 8], eax
mov ebx, dword [esi + 4]
bswap ebx
mov edi, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x10042844
mov edi, dword [ebp + 8]
xor edx, edx
lea esi, [edx + 0x10]
mov ecx, ebx
lea edx, [edx - 0x61c88647]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x1004285b
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10046e52
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x14
mov eax, dword [edx]
push ebx
mov dword [esp + 0x14], ecx
mov ebx, 0x10
mov ecx, dword [esp + 0x1c]
push ebp
push esi
mov esi, dword [edx + 4]
mov edx, dword [ecx + 4]
mov dword [esp + 0xc], edx
mov edx, dword [ecx]
mov ebp, dword [esp + 0xc]
mov dword [esp + 0x10], edx
mov edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
push edi
bswap esi
bswap eax
mov edi, 0x9e3779b9
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov edx, esi
mov ecx, esi
shr edx, 5
shl ecx, 4
add edx, ebp
add ecx, dword [esp + 0x14]
xor edx, ecx
lea ecx, [esi + edi]
xor edx, ecx
add eax, edx
mov edx, eax
mov ecx, eax
shl edx, 4
add edx, dword [esp + 0x18]
shr ecx, 5
add ecx, dword [esp + 0x1c]
xor edx, ecx
lea ecx, [eax + edi]
xor edx, ecx
lea edi, [edi - 0x61c88647]
add esi, edx
dec ebx
jne 0x10046e93
mov ebp, dword [esp + 0x20]
bswap esi
pop edi
bswap eax
mov dword [ebp + 4], esi
mov dword [ebp], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x10051bbb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
bswap eax
mov dword [ebp + 8], eax
mov ebx, dword [esi + 4]
bswap ebx
mov edi, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [edi + esi*4]
bswap eax
mov dword [ebp + esi*4 - 0x10], eax
inc esi
cmp esi, 4
jl 0x10051bd8
mov edi, dword [ebp + 8]
xor edx, edx
lea esi, [edx + 0x20]
mov ecx, ebx
lea edx, [edx + 0x57e89147]
shr ecx, 5
mov eax, ebx
add ecx, dword [ebp - 0xc]
shl eax, 4
add eax, dword [ebp - 0x10]
xor ecx, eax
lea eax, [edx + ebx]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
add ecx, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 8]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add ebx, ecx
sub esi, 1
jne 0x10051bef
bswap edi
mov esi, dword [ebp + 0x10]
mov dword [esi], edi
bswap ebx
pop edi
mov dword [esi + 4], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1005f500
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1005f51e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1005f513
pop esi
ret

Function at 0x10060610
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.10075d5d
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x1006067a
push esi
lea edi, [eax + 0x400]
call fcn.10075d86
push edi
call fcn.10075d5d
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x1006064a
push esi
xor edi, edi
call dword [0x10156d40]
add esp, 4
test eax, eax
je 0x10060696
push eax
push esi
call fcn.10061ca0
add esp, 8
mov edi, eax
push esi
call fcn.10075d86
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x100606b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10060719
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.1005bc90
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret
Function at 0x10060740
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x100608d0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x100608e6
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
ret
or eax, 0xffffffff
ret

Function at 0x100608f0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push eax
push 0x202
xor esi, esi
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x10060941
mov ecx, dword [esp + 0x19c]
push ecx
call fcn.100608d0
add esp, 4
cmp eax, 0xffffffff
je 0x1006093c
push eax
call sub.WS2_32.dll_inet_ntoa
mov esi, eax
push esi
call dword [0x10156d40]
push eax
push esi
call fcn.10061ca0
add esp, 0xc
mov esi, eax
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x10061520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x10061541
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x1006159b
inc edi
cmp edi, esi
jl 0x10061535
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x100615d0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x1006158a
cmp byte [eax], bl
je 0x100615a5
cmp byte [eax + 1], bl
je 0x100615ae
cmp byte [eax + 2], bl
je 0x100615b8
cmp byte [eax + 3], bl
je 0x100615c4
add eax, 4
cmp eax, edi
jb 0x10061561
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x1007933d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1007937f
call fcn.1007be00
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1007937f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10079376
xor eax, eax
jmp 0x10079387
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1007938d
pop edi
pop esi
pop ebx
ret 4
Function at 0x402f0f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408010]
jne 0x404450
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x409368], eax
mov dword [0x409364], ecx
mov dword [0x409360], edx
mov dword [0x40935c], ebx
mov dword [0x409358], esi
mov dword [0x409354], edi
mov word [0x409380], ss
mov word [0x409374], cs
mov word [0x409350], ds
mov word [0x40934c], es
mov word [0x409348], fs
mov word [0x409344], gs
pushfd
pop dword [0x409378]
mov eax, dword [ebp]
mov dword [0x40936c], eax
mov eax, dword [ebp + 4]
mov dword [0x409370], eax
lea eax, [ebp + 8]
mov dword [0x40937c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4092b8], 0x10001
mov eax, dword [0x409370]
mov dword [0x40926c], eax
mov dword [0x409260], 0xc0000409
mov dword [0x409264], 1
mov eax, dword [0x408010]
mov dword [ebp - 0x328], eax
mov eax, dword [0x408014]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x4092b0], eax
push 1
call fcn.00406093
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x401d80
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x4092b0], 0
jne 0x40453c
push 1
call fcn.00406093
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x403533
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403542
pop dword [ebp - 0x3c]
mov eax, 0x403542
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x43ff8db
sub dword [ebp - 0x4c], 0xb5edb390
mov dword [ebp - 0x48], 0x14b05e3a
sub dword [ebp - 0x48], 0xe27d11f5
mov dword [ebp - 0x44], 0xee172792
add dword [ebp - 0x44], 0x5e351c9c
mov dword [ebp - 0x40], 0x924859b2
sub dword [ebp - 0x40], 0x924859b2
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xf228b0d8
sub eax, 0xf1e8a0bc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xbe1fe205
sub dword [ebp - 0x4c], 0x49ad78af
mov dword [ebp - 0x48], 0xfbb3ed9f
sub dword [ebp - 0x48], 0xba478c2a
mov dword [ebp - 0x44], 0xb84f6973
sub dword [ebp - 0x44], 0x54dffd07
mov dword [ebp - 0x40], 0x37069d15
add dword [ebp - 0x40], 0xc8f962eb
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x5ebf8764
add eax, 0xa18088c0
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3bd46
push 0
call eax
mov ecx, 0x57c9
xor esi, esi
add esi, eax
mov edi, 0x433800
add edi, dword [ebp - 0x3c]
mov ebx, 0x1ef05329
xor dword [ebp - 0x2c], esi
mov edx, dword [edi]
sub dword [ebp - 0x1c], edi
xor edx, ebx
mov dword [esi], edx
add dword [ebp - 8], ebx
add esi, 0x56908753
add esi, 0xa96f78b1
add edi, 0x5349161b
add edi, 0xacb6e9e9
loop 0x40364f
add eax, 0xb22f3b3a
add eax, 0x4dd216bd
mov ebx, eax
add eax, 0x41e58de
sub eax, 0x41e58d9
mov ecx, 0x4dfa44dd
sub ecx, 0x4dba44dd
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x40d730
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
jmp 0x40d74a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40d751
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40d740
mov eax, 1
add ebx, ebx
jne 0x40d763
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40d758
jne 0x40d774
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d758
xor ecx, ecx
sub eax, 3
jb 0x40d788
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40d7fa
mov ebp, eax
add ebx, ebx
jne 0x40d793
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40d7a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40d7c4
inc ecx
add ebx, ebx
jne 0x40d7b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40d7a5
jne 0x40d7c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d7a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40d7e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40d7d5
jmp 0x40d746
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40d7e4
add edi, ecx
jmp 0x40d746
pop esi
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40d84c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd554]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd610]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40d801
mov ecx, edi
jns 0x40d830
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd618]
or eax, eax
je 0x40d846
mov dword [ebx], eax
add ebx, 4
jmp 0x40d81e
call dword [esi + 0xd614]
mov ebp, dword [esi + 0xd61c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40d880
sub esp, 0xffffff80
jmp 0x403946
Function at 0x401040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40dd20
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x443064]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
mov eax, dword [0x443064]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 0x440b3e
lea ecx, [esp + 0x48]
mov dword [esp + 0x10], str.accept:_text_html_application_xhtmlxml_application_xml_q0.9_image_avif_image_webp_image_apng___q0.8_application_signed_exchange_vb3_q0.9
mov dword [esp + 0x14], str.sec_fetch_dest:_document
mov dword [esp + 0x18], str.sec_fetch_mode:_navigate
mov dword [esp + 0x1c], str.sec_fetch_site:_none
mov dword [esp + 0x20], str.sec_fetch_user:__1
mov dword [esp + 0x24], str.upgrade_insecure_requests:_1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
call fcn.004013b0
mov dword [esp + 0x68], ebx
push ebx
push 0x440b3e
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.004013b0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x28]
lea edx, [esp + 0xc]
mov byte [esp + 0x6c], 1
call fcn.00402220
add esp, 4
cmp dword [esp + 0x3c], 0x10
jb 0x401115
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00402923
add esp, 4
cmp dword [esp + 0x58], 0x10
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
jb 0x401139
mov edx, dword [esp + 0x44]
push edx
call fcn.00402923
add esp, 4
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004027ab
add esp, 0x64
ret

Function at 0x401160
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x443064]
xor eax, esp
mov dword [esp + 0x114], eax
call fcn.00401d20
test eax, eax
je 0x40118b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401870
test eax, eax
jne 0x401233
call fcn.00401870
push 0
lea eax, [esp + 8]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SOFTWAREMicrosoftwfplwfs
push 0x80000001
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4011d8
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00401040
push 0x103
lea edx, [esp + 0xd]
push 0
push edx
mov byte [esp + 0x14], 0
call fcn.00403de0
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.wfplwfs.exe
lea ecx, [esp + 0xc]
push 0x104
push ecx
call fcn.004029a3
add esp, 0xc
lea eax, [esp + 8]
call fcn.00401e30
lea edx, [esp + 8]
push edx
call fcn.00401e80
add esp, 4
call fcn.00401d90
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.004027ab
mov esp, ebp
pop ebp
ret