joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1021bb70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov eax, 1
push esi
push edi
mov ecx, 0x3020100
mov edx, dword [ebx + 0x10c]
mov dword [ebx + 0x114], 0x3020100
add ecx, 0x4040404
mov dword [ebx + eax*4 + 0x114], ecx
inc eax
cmp eax, edx
jbe 0x1021bb91
xor esi, esi
xor edi, edi
cmp dword [esp + 0x14], esi
je 0x1021bbed
push ebp
mov ebp, dword [esp + 0x14]
movzx eax, byte [esi + ebp]
mov edx, dword [esp + 0x1c]
or edi, eax
mov ebx, edx
mov cl, byte [eax + edx + 0x114]
mov byte [esi + ebp], cl
mov byte [edx + 0x113], cl
nop
mov cl, byte [eax + ebx + 0x113]
mov edx, eax
sub eax, 1
mov byte [edx + ebx + 0x114], cl
jns 0x1021bbd0
inc esi
cmp esi, dword [esp + 0x18]
jb 0x1021bbb2
pop ebp
mov eax, dword [esp + 0x18]
shr edi, 2
mov dword [eax + 0x10c], edi
pop edi
pop esi
pop ebx
ret
Function at 0x102231d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x102231fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x102231fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x414b40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b58
mov eax, 1
add ebx, ebx
jne 0x414b7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b70
jne 0x414b8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b70
xor ecx, ecx
sub eax, 3
jb 0x414ba0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c12
mov ebp, eax
add ebx, ebx
jne 0x414bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414bdc
inc ecx
add ebx, ebx
jne 0x414bc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bbd
jne 0x414bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bbd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bed
jmp 0x414b5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bfc
add edi, ecx
jmp 0x414b5e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c1a
cmp byte [edi], 0
jne 0x414c1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c1f
lea edi, [esi + 0x12000]
Function at 0x422ca0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x41a01d
lea edi, [esi - 0x1901d]
push edi
jmp 0x422cba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x422cc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x422cb0
mov eax, 1
add ebx, ebx
jne 0x422cd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x422cc8
jne 0x422ce4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x422cc8
xor ecx, ecx
sub eax, 3
jb 0x422cf8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x422d6a
mov ebp, eax
add ebx, ebx
jne 0x422d03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x422d10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x422d34
inc ecx
add ebx, ebx
jne 0x422d20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x422d15
jne 0x422d31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x422d15
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x422d54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x422d45
jmp 0x422cb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x422d54
add edi, ecx
jmp 0x422cb6
pop esi
mov edi, esi
mov ecx, 0xb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x422d72
cmp byte [edi], 4
jne 0x422d72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x422d77
lea edi, [esi + 0x20000]
mov eax, dword [edi]
or eax, eax
je 0x422def
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x232b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x232ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x422da4
mov ecx, edi
jns 0x422dd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x232f4]
or eax, eax
je 0x422de9
mov dword [ebx], eax
add ebx, 4
jmp 0x422dc1
call dword [esi + 0x232f0]
mov ebp, dword [esi + 0x232f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1a7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x422e23
sub esp, 0xffffff80
jmp 0x401164
Function at 0x401000
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.NtDelayExecution
push esi
call edi
mov dword [0x40300c], eax
test eax, eax
jne 0x40102e
pop edi
mov eax, 0xc000007a
pop esi
ret
push str.RtlInitUnicodeString
push esi
call edi
mov dword [0x403030], eax
test eax, eax
je 0x401026
push str.NtWaitForSingleObject
push esi
call edi
mov dword [0x40301c], eax
test eax, eax
je 0x401026
push str.NtOpenFile
push esi
call edi
mov dword [0x403008], eax
test eax, eax
je 0x401026
push str.NtReadFile
push esi
call edi
mov dword [0x403004], eax
test eax, eax
je 0x401026
push str.NtOpenDirectoryObject
push esi
call edi
mov dword [0x403010], eax
test eax, eax
je 0x401026
push str.NtQueryInformationProcess
push esi
call edi
mov dword [0x403024], eax
test eax, eax
je 0x401026
push str.NtQueryInformationFile
push esi
call edi
mov dword [0x403028], eax
test eax, eax
je 0x401026
push str.NtSetInformationFile
push esi
call edi
mov dword [0x40302c], eax
test eax, eax
je 0x401026
push str.NtAllocateVirtualMemory
push esi
call edi
mov dword [0x403038], eax
test eax, eax
je 0x401026
push str.NtFreeVirtualMemory
push esi
call edi
mov dword [0x40303c], eax
test eax, eax
je 0x401026
push str.NtOpenSection
push esi
call edi
mov dword [0x403018], eax
test eax, eax
je 0x401026
push str.NtMapViewOfSection
push esi
call edi
mov dword [0x403034], eax
test eax, eax
je 0x401026
push str.NtUnmapViewOfSection
push esi
call edi
mov dword [0x403020], eax
test eax, eax
je 0x401026
push str.NtClose
push esi
call edi
mov dword [0x403014], eax
neg eax
sbb eax, eax
and eax, 0x3fffff86
pop edi
add eax, 0xc000007a
pop esi
ret
Function at 0x401460
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push ebp
push esi
mov dword [eax], 0
push edi
mov dword [ecx], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [esp + 0x2c]
push esi
push 0
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [esp + 0x28]
mov edx, dword [ebp]
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
mov edi, eax
mov eax, dword [ebp + 4]
push edi
mov dword [esp + 0x20], edx
lea edx, [esp + 0x28]
push edx
push 0
push 0
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x40]
push 0
push eax
call dword [0x403004]
test eax, eax
jne 0x401529
mov ecx, dword [esp + 0x1c]
add dword [esp + 0x10], ecx
movzx esi, byte [edi + 7]
movzx edx, byte [edi + 6]
movzx eax, byte [edi + 5]
movzx ecx, byte [edi + 4]
shl esi, 8
push ebx
movzx ebx, byte [edi + 0xf]
or esi, edx
movzx edx, byte [edi + 0xe]
shl esi, 8
or esi, eax
mov eax, dword [esp + 0x10]
push edi
push 0
shl esi, 8
shl ebx, 8
push eax
or esi, ecx
or ebx, edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
mov dword [ebp], ecx
mov ecx, dword [esp + 0x38]
mov dword [ebp + 4], edx
mov dword [eax], esi
mov dword [ecx], ebx
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 0x14

Function at 0x401760
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp word [ebx + esi*2 - 2], 0x22
jne 0x4017df
cmp word [ebx + esi*2 - 0xc], 0x22
lea edi, [esi - 6]
je 0x401793
sub edi, 1
je 0x4017df
cmp word [ebx + edi*2], 0x22
jne 0x401787
or eax, 0xffffffff
inc edi
sub eax, edi
add esi, eax
lea ecx, [esi + esi + 2]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor edx, edx
xor ecx, ecx
mov word [eax], dx
test esi, esi
je 0x4017c5
lea edx, [ebx + edi*2]
mov di, word [edx]
mov word [eax + ecx*2], di
inc ecx
add edx, 2
cmp ecx, esi
jne 0x4017b6
xor edx, edx
mov word [eax + ecx*2], dx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ecx], eax
pop edi
mov dword [edx], esi
pop esi
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
mov eax, 0xc0000001
pop ebx
ret 8
Function at 0x402634
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
call esi
cmp eax, 0xffffffff
je 0x402655
push dword [ebp + 8]
call esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
pop esi
jne 0x402682
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x402682
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x402682
push 4
push eax
lea eax, [ebp - 4]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x402689
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
and dword [ebp - 4], 0
imul edx, edx, 0x9e3779b9
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
je 0x4026fe
mov esi, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp - 4]
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp - 4]
xor ebx, ecx
sub dword [ebp - 4], 0x61c88647
add ebx, eax
lea eax, [ebx + edi]
mov edi, eax
mov ebx, eax
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp - 4]
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp - 4]
xor ebx, eax
add ebx, ecx
cmp dword [ebp - 4], edx
lea ecx, [ebx + edi]
jne 0x4026ac
mov esi, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
leave
ret

Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40c7d0
nop
mov ecx, 0x6b575726
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x7c4c7617
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4070fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x407144
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x407113
jmp 0x407144
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x407134
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x407cd6
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x407d0b
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x407d35
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x407d35
test edi, edi
je 0x407d02
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x407d02
test edi, edi
je 0x407d3d
mov eax, edi
jmp 0x407d04
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x407d04
int3
Function at 0x40ade0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestPair.exe_gMozillaPoisonSize], eax
call fcn.00407cd6
pop ecx
mov ecx, dword [sym.TestPair.exe_gMozillaPoisonSize]
mov dword [sym.TestPair.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40ae18
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestPair.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x40ea38
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40eb0d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40eb28
push ebx
push 0x40eb38
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40eab8
mov al, 0x6a
call fcn.0040e658
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040ea0c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40eac1
call fcn.0040ea0c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eb14
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40ec28
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ecf3
jmp 0x40ece7
cmp dword [esi + 0x10], 0x1000
jne 0x40ecd3
test byte [esi + 0x15], 1
jne 0x40ecd3
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40ec84
cmp ebp, 2
je 0x40ec84
cmp ebp, 0x10
je 0x40ec84
cmp ebp, 0x20
jne 0x40eca0
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40eca0
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ecb1
mov eax, dword [esi]
add eax, ebx
call fcn.0040ec20
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40eca4
cmp byte [esp + 4], 0
je 0x40ecd3
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ecf3
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ec59
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x405d20
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ecx, dword [eax - 0x17a8a092]
cmc
add dword [eax], eax
add byte [ebp - 0x29df040], al
fild word [eax]
add byte [ebx + 0x2608dc3d], al
add bh, bl
jl 0x405e2e
test dword [esp + edx*2 - 0x3f2affbf], 0x4850f
add byte [esi], bl
mov dword [0x41c4f9], 0x33000001
call dword [fcn.00403a5c]
add eax, esi
invalid
mov byte [0x8b645fee], al
in eax, 0xcc
ret 0xc00c
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401c66
pop dword [ebp - 0x1c]
mov eax, 0x289e16ed
add eax, 0xd7a20579
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x3a5e527e
sub dword [ebp - 0x2c], 0xec0c0d33
mov dword [ebp - 0x28], 0xabba47e
sub dword [ebp - 0x28], 0xd8885839
mov dword [ebp - 0x24], 0xb67d4f64
add dword [ebp - 0x24], 0x95cef4ca
mov dword [ebp - 0x20], 0x8fc3cc96
sub dword [ebp - 0x20], 0x8fc3cc96
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xd181664c
sub eax, 0xd14135f8
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xc938e8d4
sub dword [ebp - 0x2c], 0x54c67f7e
mov dword [ebp - 0x28], 0xcc8bcca1
sub dword [ebp - 0x28], 0x8b1f6b2c
mov dword [ebp - 0x24], 0xecec2f58
sub dword [ebp - 0x24], 0x897cc2ec
mov dword [ebp - 0x20], 0x7bcab2de
sub dword [ebp - 0x20], 0x7bcab2de
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x336be
push 0
call eax
mov ecx, 0x3bc3
xor ebx, ebx
add ebx, eax
mov edi, 0x407000
add edi, dword [ebp - 0x1c]
mov edx, 0x28f6462c
add edx, 0xc3d146bd
sub dword [ebp - 0x14], 0x25db8bf1
mov esi, dword [edi]
sub dword [ebp - 0x14], 0xf9ac601e
add esi, edx
add dword [ebp - 0x18], 0xb5af65d9
mov dword [ebx], esi
xor dword [ebp - 4], 0xd1b8b552
add ebx, 0x94040352
sub ebx, 0x9404034e
add edi, 4
loop 0x401d79
add eax, 0xe1df
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x10001114
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
push 0x54
mov eax, 0x1000d0cc
call fcn.10001930
xor esi, esi
mov dword [ebp - 0x40], 0x505c3a43
push esi
push 0x80
push 3
push esi
push esi
push 0xc0000000
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], 0x72676f72
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0x61446d61
push eax
mov dword [ebp - 0x34], 0x505c6174
mov dword [ebp - 0x30], 0x616b6361
mov dword [ebp - 0x2c], 0x6d5c6567
mov dword [ebp - 0x28], 0x65756e65
mov dword [ebp - 0x24], 0x6e692e78
mov dword [ebp - 0x20], 0x69
mov dword [ebp - 0x1c], esi
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x44], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100010cb
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.100015f5
pop ecx
push 0
mov esi, eax
lea eax, [ebp - 0x44]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x60]
mov word [esi], 0x5a4d
call fcn.10001119
and dword [ebp - 4], 0
lea ecx, [ebp - 0x60]
push edi
push esi
call fcn.100014e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.10001126
xor eax, eax
call fcn.10001921
ret
jmp section..text

Function at 0x100011c5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x40
push esi
mov esi, ecx
jae 0x100011d5
xor eax, eax
jmp 0x1000124c
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
mov dword [esi + 0xc], ecx
cmp word [ecx], ax
jne 0x100011d1
mov edx, dword [ecx + 0x3c]
lea eax, [edx + 0xf8]
cmp dword [ebp + 0xc], eax
jb 0x100011d1
lea eax, [edx + ecx]
mov dword [esi + 0x10], eax
cmp dword [eax], 0x4550
jne 0x100011d1
movzx ecx, word [eax + 0x16]
test ecx, 0x2000
je 0x100011d1
test cl, 2
je 0x100011d1
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x100011d1
push edi
lea edi, [eax + 0xf8]
xor edx, edx
mov dword [esi + 0x14], edi
movzx esi, word [eax + 6]
test esi, esi
jle 0x10001248
mov ecx, edx
mov eax, dword [ecx + edi + 0x14]
add eax, dword [ecx + edi + 0x10]
cmp eax, dword [ebp + 0xc]
ja 0x10001251
inc edx
add ecx, 0x28
cmp edx, esi
jl 0x10001233
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 8
xor eax, eax
jmp 0x1000124b
Function at 0x100014e6
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x100014f9
xor eax, eax
jmp 0x100015ca
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100011c5
test eax, eax
je 0x100014f2
push ebx
mov ecx, esi
call fcn.1000114a
mov ebx, eax
test ebx, ebx
je 0x100015c9
push edi
push 0x40
push 0x3000
push ebx
push 0
mov dword [esi + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x100015bc
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.10001255
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xa0], 0
jbe 0x10001560
cmp dword [eax + 0xa4], 0
jbe 0x10001560
push edi
mov ecx, esi
call fcn.100012eb
push edi
mov ecx, esi
call fcn.10001374
test eax, eax
jne 0x1000157b
push 0x8000
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100015bc
lea eax, [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push ebx
push 1
push edi
mov dword [eax + 0x34], edi
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x28]
add eax, edi
mov dword [esi + 4], eax
call eax
test eax, eax
jne 0x100015c0
push ebx
push ebx
push edi
call dword [esi + 4]
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 4], ebx
xor eax, eax
jmp 0x100015c8
xor eax, eax
mov dword [esi + 8], edi
inc eax
mov dword [esi], eax
pop edi
pop ebx
pop esi
pop ebp
ret 8