joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005516
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb0
push esi
push edi
push ebx
mov byte [ebp - 1], 0
push 0x400
push 0x1001e23d
push 4
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x1001e23d
call sym.dup2patcher.dll_AddMsg
lea eax, [ebp - 0x401]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push str._regpatch.reg
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_lstrcatA
mov esi, dword [ebp + 8]
test dword [esi + 5], 8
je 0x1000557a
call fcn.100040cf
mov eax, dword [esi + 1]
add eax, 0x100000
mov dword [ebp - 0x410], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x408], eax
lea eax, [esi + 9]
push dword [ebp - 0x408]
push eax
call fcn.100057a2
mov ecx, dword [ebp - 0x408]
test dword [esi + 5], 1
je 0x100055fb
mov eax, dword [esi + 1]
add eax, 0x100000
mov dword [ebp - 0x414], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x40c], eax
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
push dword [ebp - 0x408]
call fcn.100056f6
mov ecx, dword [ebp - 0x40c]
push eax
push ecx
lea eax, [ebp - 0x401]
push eax
call sym.dup2patcher.dll_write_disk_file
test eax, eax
je 0x1000569c
mov edi, 0x1000d911
push str._s__
push edi
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x401]
push eax
push edi
call sub.kernel32.dll_lstrcatA
push 0x1000d701
push edi
call sub.kernel32.dll_lstrcatA
push 0x3c
lea eax, [ebp - 0x450]
push eax
call sub.kernel32.dll_RtlZeroMemory
mov dword [ebp - 0x450], 0x3c
mov dword [ebp - 0x44c], 0x40
mov dword [ebp - 0x444], 0x1000d6f7
mov dword [ebp - 0x440], str.regedit.exe
mov dword [ebp - 0x43c], edi
mov dword [ebp - 0x434], 0
lea eax, [ebp - 0x450]
push eax
call sub.shell32.dll_ShellExecuteExA
push 0xffffffffffffffff
push dword [ebp - 0x418]
call sub.kernel32.dll_WaitForSingleObject
mov byte [ebp - 1], 1
push 0x4000
push dword [ebp - 0x410]
push dword [ebp - 0x408]
call sub.kernel32.dll_VirtualFree
test dword [esi + 5], 1
je 0x100056d1
push 0x4000
push dword [ebp - 0x414]
push dword [ebp - 0x40c]
call sub.kernel32.dll_VirtualFree
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_DeleteFileA
test dword [esi + 5], 8
je 0x100056eb
call fcn.100040fa
movzx eax, byte [ebp - 1]
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x100056f6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
push ebx
mov eax, dword [ebp + 0x10]
add eax, 0x100000
mov dword [ebp - 8], eax
push 4
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
push esi
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov esi, dword [ebp - 4]
or eax, eax
je 0x10005783
push dword [ebp + 8]
push esi
call sub.kernel32.dll_lstrcmpA
or eax, eax
je 0x10005778
mov bl, 0
jmp 0x1000576e
lodsb al, byte [esi]
cmp word [esi], 0x5b0a
jne 0x10005750
mov bl, 1
cmp al, 0x5c
jne 0x10005764
or bl, bl
jne 0x10005764
cmp byte [esi], 0x5c
je 0x10005764
cmp byte [esi - 2], 0x5c
je 0x10005764
stosb byte es:[edi], al
stosb byte es:[edi], al
cmp word [esi], 0xd5d
jne 0x1000576e
mov bl, 0
cmp byte [esi], 0
jne 0x10005746
mov byte [edi], 0
jmp 0x10005783
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrcpyA
push 0x4000
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_VirtualFree
push dword [ebp + 0xc]
call fcn.10006c90
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x10006089
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffebc0
push esi
push edi
push ebx
lea eax, [ebp - 0xc00]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x400]
push eax
push 0x400
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0xc00]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov edi, 0x1001263d
xor ebx, ebx
jmp 0x10006194
cmp byte [esi], 0x18
jne 0x10006194
push 0x10
lea eax, [ebp - 0x1440]
push eax
lea eax, [esi + 1]
push eax
call fcn.10002200
lea eax, [ebp - 0xc00]
push eax
lea eax, [ebp - 0x1400]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x1000d7eb
lea eax, [ebp - 0x1400]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x1440]
push eax
lea eax, [ebp - 0x1400]
push eax
call sub.kernel32.dll_lstrcatA
push 0x1000d7ed
lea eax, [ebp - 0x1400]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x1440]
push eax
push dword [0x1000d8a2]
call fcn.1000149b
mov edx, eax
push dword [0x1000d880]
push edx
lea eax, [ebp - 0x1400]
push eax
call sym.dup2patcher.dll_write_disk_file
or eax, eax
je 0x10006194
lea eax, [ebp - 0x1400]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x10006194
mov dword [edi + 4], eax
lea edx, [edi + 8]
lea eax, [esi + 1]
push dword [eax]
pop dword [edx]
push dword [eax + 4]
pop dword [edx + 4]
push dword [eax + 8]
pop dword [edx + 8]
push dword [eax + 0xc]
pop dword [edx + 0xc]
add edi, 0x18
inc ebx
push ebx
push dword [0x1000d8a2]
call fcn.1000149b
mov esi, eax
or esi, esi
jne 0x100060d4
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
pop ebx
pop edi
pop esi
leave
ret

Function at 0x100061bc
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffefc0
push esi
push edi
push ebx
lea eax, [ebp - 0x800]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
mov edi, 0x1001263d
jmp 0x10006251
push dword [edi + 4]
call sub.kernel32.dll_FreeLibrary
push 0x10
lea eax, [ebp - 0x1040]
push eax
lea eax, [edi + 8]
push eax
call fcn.10002200
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1000]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x1000d7f2
lea eax, [ebp - 0x1000]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x1040]
push eax
lea eax, [ebp - 0x1000]
push eax
call sub.kernel32.dll_lstrcatA
push str..dll
lea eax, [ebp - 0x1000]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x1000]
push eax
call sub.kernel32.dll_DeleteFileA
add edi, 0x18
cmp dword [edi + 4], 0
jne 0x100061e0
pop ebx
pop edi
pop esi
leave
ret
Function at 0x100065ae
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
jmp 0x100065f2
inc ecx
cmp ecx, dword [0x1000e519]
jne 0x100065f2
push 0x400
push 0x10021e45
push 0x16
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x10021e45
call sym.dup2patcher.dll_AddMsg
xor eax, eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x14
cmp dword [ecx + esi], 0x4550
jne 0x100065bd
add esi, ecx
mov eax, dword [ebp + 8]
add eax, dword [0x1000e519]
cmp dword [eax - 4], 0x32505564
jne 0x10006632
push 0x400
push 0x10022245
push 0x17
push dword [0x1000d8a2]
call sub.user32.dll_LoadStringA
push 0x10022245
call sym.dup2patcher.dll_AddMsg
jmp 0x100065e7
push esi
movzx eax, word [esi + 6]
dec eax
imul eax, eax, 0x28
movzx ecx, word [esi + 0x14]
add esi, 0x18
add esi, ecx
mov edi, esi
or dword [edi + 0x24], 0x80000000
add edi, eax
pop esi
mov dword [0x1000698d], 0
cmp dword [ebp + 0xc], 4
jne 0x10006667
or dword [0x1000698d], 1
test dword [ebp + 0x18], 0x40
je 0x10006677
or dword [0x1000698d], 2
mov ebx, dword [esi + 0x28]
mov dword [0x10006985], ebx
mov eax, dword [edi + 0xc]
add eax, dword [edi + 0x10]
mov dword [esi + 0x28], eax
cmp dword [ebp + 0xc], 4
jne 0x10006699
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 0x10]
add eax, ebx
jmp 0x1000669b
xor eax, eax
mov dword [0x10006991], eax
mov eax, dword [ebp + 8]
add eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
mov ecx, 0x10006730
mov ebx, 0x278
mov edx, eax
add edx, ebx
push edx
push ebx
push ecx
push eax
call sub.kernel32.dll_RtlMoveMemory
pop edx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x16]
lea ecx, [eax + ecx]
mov ebx, dword [0x1000d880]
sub ebx, eax
push ebx
push ecx
push edx
call sub.kernel32.dll_RtlMoveMemory
mov eax, dword [ebp + 0x10]
push 0x100
push eax
call fcn.10006ee0
add dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
add dword [edi + 0x10], eax
or dword [edi + 0x24], 0xe0000000
mov eax, dword [edi + 0xc]
add eax, dword [edi + 8]
mov ebx, dword [esi + 0x38]
push ebx
push eax
call fcn.10006ee0
mov dword [esi + 0x50], eax
mov ecx, dword [ebp + 8]
add ecx, dword [0x1000e529]
mov byte [ecx - 1], 0x32
mov byte [ecx - 2], 0x50
mov byte [ecx - 3], 0x55
mov byte [ecx - 4], 0x64
xor eax, eax
inc eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x14
Function at 0x10006807
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov edx, ebx
movzx eax, word [ebx + 0x3c]
add ebx, eax
mov ebx, dword [ebx + 0x78]
add ebx, edx
or edi, edi
je 0x10006866
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 0x20]
add esi, edx
push ebx
xor ebx, ebx
lodsd eax, dword [esi]
add eax, edx
push esi
push edi
xchg edi, esi
xchg edi, eax
lodsb al, byte [esi]
or al, al
jne 0x10006845
cmp byte [edi], 0
je 0x1000684e
jmp 0x1000684c
cmp byte [edi], al
jne 0x1000684c
inc edi
jmp 0x10006839
mov al, 1
pop edi
pop esi
or al, al
je 0x10006857
inc ebx
loop 0x10006831
xchg ebx, eax
pop ebx
mov esi, dword [ebx + 0x24]
add esi, edx
inc eax
shl eax, 1
add esi, eax
movzx ecx, word [esi]
mov esi, dword [ebx + 0x1c]
add esi, edx
sub ecx, dword [ebx + 0x10]
xchg ecx, eax
shl eax, 2
add esi, eax
mov eax, dword [esi]
add eax, edx
pop esi
pop edi
pop edx
pop ecx
pop ebx
leave
ret 8

Function at 0x10006d14
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.10006db0
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x10006d4c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x10006d77
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x10006f00
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x10006f45
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x10006f3e
cmp dword [ebp - 0x98], 1
jb 0x10006f3e
mov ecx, 0x101
jmp 0x10006f4a
mov ecx, 1
jmp 0x10006f4a
mov ecx, 1
lea eax, [ebp - 4]
push eax
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x10006f91
mov eax, 1
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14
Function at 0x10006fa0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x10006fe5
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x10006fde
cmp dword [ebp - 0x98], 1
jb 0x10006fde
mov ecx, 0x101
jmp 0x10006fea
mov ecx, 1
jmp 0x10006fea
mov ecx, 1
lea eax, [ebp - 4]
push eax
push ecx
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyExA
or eax, eax
jne 0x10007031
mov eax, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14

Function at 0x100070b0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
pushal
cmp dword [ebp + 8], 0
jne 0x100070f0
push 0
call sub.kernel32.dll_GetModuleHandleA
lea esi, [ebp - 0x200]
push 0x200
push esi
push eax
call sub.kernel32.dll_GetModuleFileNameA
push esi
call sub.kernel32.dll_lstrlenA
push esi
add esi, eax
jmp 0x100070e5
dec esi
cmp byte [esi], 0x5c
jne 0x100070e4
mov byte [esi], 0
pop esi
jmp 0x100070f3
mov esi, dword [ebp + 8]
push esi
call sub.kernel32.dll_SetCurrentDirectoryA
popal
leave
ret 4

Function at 0x10007170
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x100071ca
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x100071ca
cmp byte [esi], 0
je 0x100071ca
lea edi, [ebp - 0x401]
jmp 0x1000719f
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp byte [esi], 0x5c
je 0x100071a9
cmp byte [esi], 0
jne 0x1000719d
cmp al, 0x3a
je 0x1000719d
lodsb al, byte [esi]
stosb byte es:[edi], al
mov byte [edi], 0
push 0
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp byte [esi - 1], 0
jne 0x1000719b
mov byte [ebp - 1], 1
popal
movzx eax, byte [ebp - 1]
leave
ret 4

Function at 0x100071e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x1000724e
push esi
call sub.kernel32.dll_lstrlenA
or eax, eax
je 0x1000724e
mov ebx, eax
push 0
call sub.user32.dll_OpenClipboard
cmp eax, 1
jne 0x1000724e
add ebx, 2
push ebx
push 0x2042
call sub.kernel32.dll_GlobalAlloc
or eax, eax
je 0x10007249
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
or eax, eax
je 0x10007249
mov edi, eax
push esi
push edi
call sub.kernel32.dll_lstrcpyA
call sub.user32.dll_EmptyClipboard
cmp eax, 1
jne 0x10007249
push edi
call sub.kernel32.dll_GlobalUnlock
push ebx
push 1
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
popal
movzx eax, byte [ebp - 1]
leave
ret 4
Function at 0x1000a578
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
mov dword [0x100227b0], eax
xor eax, eax
mov dword [0x100227b4], eax
mov edi, 0x10022760
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov eax, 0x100227a0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop edi
ret

Function at 0x1000a6f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a72f
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegDeleteValueA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0xc

Function at 0x1000a740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push dword [ebp + 0x14]
pop dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a78f
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x10

Function at 0x1000a7a0
Capabilities:
Check os version
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
cmp dword [ebp + 0x18], 1
jne 0x1000a7e5
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x9c], 5
jb 0x1000a7de
cmp dword [ebp - 0x98], 1
jb 0x1000a7de
mov ecx, 0x101
jmp 0x1000a7ea
mov ecx, 1
jmp 0x1000a7ea
mov ecx, 0xf003f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push ecx
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x1000a834
push dword [ebp + 0x14]
call sub.kernel32.dll_lstrlenA
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x14

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x7c5b08f3
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x3f2c1f1a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x9ee740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9ee78c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9ee752
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9ee7f0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9ee842
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9ee848
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0xa06d37
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a069f7

Function at 0xa0bb31
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a0b9b0

Function at 0xa110e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa1110d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa1110d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x49934546
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x81f56d0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40e490
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
sub esp, 0x438
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push edi
call fcn.00406890
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
jne 0x4339ce
mov eax, dword [0x4a56fc]
test eax, eax
je 0x4339e7
mov byte [esp + 0xf], 0
mov esi, 0x4a6888
cmp eax, 1
je 0x4339fb
push 0x4a56fc
lea ecx, [esp + 0x13]
mov eax, 0x4a5714
call fcn.0040fd70
test al, al
je 0x433a1c
mov dl, byte [0x4a6888]
mov bl, byte [0x4a6889]
push 0x4a56f8
lea eax, [esp + 0x234]
push eax
push 0x104
push 0x4a5714
mov byte [0x4a5700], dl
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
mov ecx, dword [0x4a56fc]
push ecx
push 0x4a5714
call fcn.0040dc60
test eax, eax
jne 0x433a30
cmp bl, 1
je 0x433a54
call fcn.00411490
call fcn.00411680
cmp byte [0x4a5700], 0
jne 0x40e568
mov esi, 0x4a5ec0
call fcn.0040ed40
push 1
mov ecx, 0x4a5920
call fcn.004043c0
cmp byte [0x4a5700], 0
jne 0x40e587
mov ecx, 0x4a5ec0
call fcn.0040ee40
mov ebx, 0x4a6888
call fcn.0040f550
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x438
ret
push 0x10
push 0x4856d6
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40e59c
lea ecx, [esp + 0x20]
mov dword [0x494c9c], 0xffffffff
push ecx
jmp 0x40e596
mov edx, dword [0x4a5704]
push 0xffffffffffffffff
push edx
push 1
xor bl, bl
call fcn.00411240
mov al, byte [0x494c90]
mov byte [0x4a688b], al
jmp 0x40e529
lea ecx, [esp + 0x20]
mov dword [0x494c9c], 1
push ecx
jmp 0x40e596
mov ebx, 0x4a6888
call fcn.0040f550
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov dword [0x494c9c], 1
jmp 0x40e59c
call fcn.00438130
test al, al
jne 0x40e54b
push 0x104
lea eax, [esp + 0x234]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
cmp byte [esp + 0xf], 0
je 0x433ad5
mov edi, 0x485740
lea esi, [esp + 0x10]
call fcn.00405a50
mov edi, 0x4a5714
mov eax, esi
call fcn.0040d6c0
mov edi, 0x485740
mov eax, esi
call fcn.0040d6c0
mov edx, dword [esp + 0x10]
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
lea eax, [esp + 0x23c]
push eax
push 0x485744
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.004059c0
jmp 0x40e587
push 1
lea ecx, [esp + 0x24]
push ecx
push edi
lea edx, [esp + 0x23c]
push edx
push 0x485744
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40e587