joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x10074200]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x49869764
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
sub eax, 0xd044d266
je 0x100010e8
jmp 0x1000104b
mov eax, dword [ebp - 0x24]
sub eax, 0xfe968beb
je 0x10001136
jmp 0x1000105e
mov eax, dword [ebp - 0x24]
sub eax, 0xf05a487
je 0x100011ba
jmp 0x10001071
mov eax, dword [ebp - 0x24]
sub eax, 0x49738f7e
je 0x100011a9
jmp 0x10001084
mov eax, dword [ebp - 0x24]
sub eax, 0x49869764
je 0x1000109c
jmp 0x10001097
jmp 0x100011c1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
not byte [edi]
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
add byte [edi], 0x82
sub byte [edi], 0x44
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
imul byte [edi]
inc edi
loop 0x100010b9
mov dword [ebp - 0x18], 0xd044d266
jmp 0x100011c1
mov eax, dword [0x10075548]
mov ecx, dword [0x10075544]
mov edx, eax
sub edx, 0xaa2ee3c5
sub edx, 1
add edx, 0xaa2ee3c5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf05a487
mov ecx, 0xfe968beb
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x100011c1
mov ecx, dword [0x10075548]
mov eax, dword [0x10075544]
mov edx, ecx
add edx, 0x4a25215c
sub edx, 1
sub edx, 0x4a25215c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf05a487
mov ecx, 0x49738f7e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x100011c1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10015ec0
add esp, 0x1c
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x18], 0xfe968beb
jmp 0x10001035
Function at 0x10007f00
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using base64
Execute anti-debugging instructions
Execute shellcode via indirect call
Hide graphical window
Parse credit card information
Parse pe header

Disassembly:
jmp 0x1000a571
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x11c], 0xfa8150d7
push ebp
sar eax, 0xb2
mov ebp, esp
push ebx
cmovbe eax, edi
push edi
shr al, cl
rol ah, cl
nop
push esi
movsx eax, ax
sub esp, 0x114
mov eax, dword [0x10074200]
jmp 0x100099bc

Function at 0x10019293
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100192d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100192d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100192d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100192d2
cmp dword [ecx + 0x74], 0xe
jbe 0x100192d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001bf52
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001bfef
push ebx
push esi
call fcn.1001bf1b
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001beaf
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001bf9c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001bfee
push edi
push eax
call fcn.1001cf0d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001bfbc
call fcn.1001a9f7
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001bfed
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001beaf
add esp, 0x20
test eax, eax
jne 0x1001bfdb
push edi
call fcn.1001a9f7
jmp 0x1001bfe3
push ebx
call fcn.1001a9f7
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001c25c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023cb8
push 0x10023cb0
push str.FlsAlloc
push 0x1f
call fcn.1001c178
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c290
push dword [ebp + 8]
mov ecx, esi
call dword [0x10022140]
call esi
jmp 0x1001c296
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001c2da
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023cc8
push 0x10023cc0
push str.FlsGetValue
push 0x21
call fcn.1001c178
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c311
push dword [ebp + 8]
mov ecx, esi
call dword [0x10022140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001c319
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023cd0
push 0x10023cc8
push str.FlsSetValue
push 0x22
call fcn.1001c178
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c353
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10022140]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100219e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10021a0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10021a0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x464c3ce5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x73dd66b2
nop
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x478770
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x260
push ebx
push ebp
mov ebp, dword [esp + 0x270]
push esi
push edi
mov edi, dword [esp + 0x280]
test edi, edi
mov esi, ecx
jne 0x4787b2
mov eax, dword [esp + 0x27c]
mov ecx, dword [esp + 0x274]
push eax
push 0
push 0
push ebp
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, eax
jmp 0x4787b6
mov ebx, dword [esp + 0x10]
cmp ebx, 0x20
jbe 0x4787c4
cmp edi, 1
jne 0x4788a8
mov edx, dword [esi]
lea eax, [esp + 0x68]
push eax
push str..htm
push SysReAllocStringLen
mov ecx, esi
call dword [edx + 0xf8]
test eax, eax
jne 0x4788a8
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x68]
push str._shellopencommand
push ecx
call edi
mov edx, dword [esi]
lea eax, [esp + 0x68]
lea ecx, [esp + 0x68]
push eax
push ecx
push SysReAllocStringLen
mov ecx, esi
call dword [edx + 0xf8]
test eax, eax
jne 0x4788a8
lea edx, [esp + 0x68]
push str.__1_
push edx
call fcn.00466961
add esp, 8
test eax, eax
jne 0x478844
lea eax, [esp + 0x68]
push 0x6d57fc
push eax
call fcn.00466961
add esp, 8
test eax, eax
je 0x478847
mov byte [eax], 0
lea ecx, [esp + 0x68]
push 0x6d3e1c
push ecx
call edi
lea edx, [esp + 0x68]
push ebp
push edx
call edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x68]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4788a4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x260
ret 0x10
mov ebx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x260
ret 0x10
Function at 0x1005e7f
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
movzx eax, word [esi]
push edi
test ax, ax
je 0x1005f38
mov edi, dword [0x1001190]
cmp ax, 0x2d
je 0x1005eb6
cmp ax, 0x2f
je 0x1005eb6
inc esi
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x1005ea0
cmp word [esi], 0
je 0x1005f38
inc esi
push 0x10014b0
inc esi
push esi
call edi
test eax, eax
je 0x1005f41
push 0x1001494
push esi
call edi
test eax, eax
je 0x1005f6f
push 0x1001484
push esi
call edi
test eax, eax
je 0x1005f82
push 0x1001458
push esi
call edi
test eax, eax
je 0x1005fa0
push 0x1001444
push esi
call edi
test eax, eax
je 0x1005fee
movzx eax, word [esi]
sub eax, 0x62
je 0x1005f26
sub eax, 0x10
je 0x1005f20
dec eax
jne 0x1005f2a
or dword [ebp - 4], 4
jmp 0x1005f2a
or dword [ebp - 4], 1
jmp 0x1005f2a
or dword [ebp - 4], 2
inc esi
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x1005ea0
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
push 0x1e
call dword [0x1001194]
test eax, eax
je 0x1005f67
push 0
push 0x1009581
push 0
push 3
push 0x10013e0
push 0x80000002
call fcn.01008c55
push 0
call dword [0x1001084]
push 0x1e
call dword [0x1001194]
test eax, eax
je 0x1005f67
call fcn.01005e4b
jmp 0x1005f67
push 0x1e
call dword [0x1001194]
test eax, eax
je 0x1005f67
push 0
push 0x1009581
push 0
push 8
push 0x1001380
jmp 0x1005f5d
call 0x1008b6d
test eax, eax
jne 0x1005fb3
call 0x1008a60
call 0x10075db
mov esi, dword [0x1001208]
push 0x43
call esi
test eax, eax
jne 0x1005fc6
call 0x10075c1
call 0x1008b6d
test eax, eax
jne 0x1005fe4
push 0x43
call esi
test eax, eax
jne 0x1005fe4
push eax
call 0x1007e16
push 0
call 0x100769d
call 0x10076ba
jmp 0x1005f67
call 0x1008a60
call 0x10075db
jmp 0x1005f67

Function at 0x10061cf
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [fcn.01001010]
test eax, eax
jne 0x1006208
push 0x1001500
push dword [ebp - 4]
call dword [fcn.0100100c]
push dword [ebp - 4]
call dword [fcn.01001008]
leave
ret
Function at 0x40274c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004034f4
test esi, esi
jne 0x402782
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004035e4
jmp 0x4027a0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402600
mov edi, eax
test esi, esi
je 0x4027a0
cmp dword [ebx], 0
je 0x4027a0
dec esi
jmp 0x402789
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402948
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4d5008], 0x8088405
inc edx
mov dword [ebx + 0x4d5008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402ad4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4d5010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b6c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b4c
xor eax, eax
push ebp
push 0x402b45
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b88
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b4c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4d5010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4d5010], ax
mov esp, ebp
pop ebp
ret

Function at 0x403378
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4d7034], 0
je 0x4033d9
cmp word [0x4d7208], 0xd7b2
jne 0x4033a1
cmp dword [0x4d7210], 0
jbe 0x4033a1
mov eax, 0x4d7204
call dword [0x4d7220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4d5050
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403400
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4d501c], 0
jne 0x4033f5
push 0
push 0x4d5070
push 0x4d5050
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x497ca0
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
out dx, al
pop esp
invalid
cmp byte [0xed66ab0], 4
cmp dword [eax], edx
mov eax, dword [ebx]
mov al, byte [eax + esi - 1]
and eax, 0x4d040e64
mov dword [ebp - 0xc], eax
jmp 0x497c5c
adc ch, cl
in al, dx
jl 0x497c1e
mov ebp, 0x558bfff6
clc
idiv bh
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 0x6f]
test byte [eax], dl
inc edi
mov byte [eax + esi - 1], dl
inc esi
dec edi
jne 0x497c34
test al, 0xce
pop esi
adc al, 0x59
mov dword fs:[eax], edx
push 0x9b497c96
add dword [ecx - 0x4b], 0xffffffba
add al, byte [eax]
add byte [eax], al
call 0xf1b73518
invalid
push ebp
mov ebp, esp
push ecx
enter 0xffffffffffffde85, 0xffffffffffffffc4
inc ebp
cld
mov eax, dword [ebp - 4]
call 0xf1b73934
aaa
lea edx, [ebp + 0x68]
cld
jl 0x497d02
add byte [edi + edi*8 - 0x55], ah
push 0xffffffffffffff8d
insd dword es:[edi], dx
cmp byte [0x4d6ab0], 0
je 0x497c60
test edi, edx
mov byte [ebp - 4], 0xe8
stc
and al, 0
add bl, ch
mov dh, byte [esi + 0x7fffb2fb]
call fcn.00402948
mov ecx, dword [eax - 0x1a]
out 0x4a, al
add byte [eax], al
xor eax, eax
pop edx
pop ecx
pop ecx
adc bl, byte fs:[esi]
insb byte es:[edi], dx
dec esi
jge 0x497d3b
add byte [ebp - 0x61703bb], cl
sub al, 0xf8
sti
mov gs, ecx
invalid
invalid
call 0x3e15d365
ffreep st(4)
pop ebp
call 0x8a35daa3
dec ebp
clc
adc ah, bh
lea ecx, [eax]
cld
mov eax, dword [ebp - 4]
call 0x65403934
cmp eax, 0x1c6818c4
jle 0x497d79
sbb al, 0x7e
dec ecx
add byte [edi + edi*8 + 0x30], ah
inc dword [edi - 0xba23fdc]
mov dword [ebx], esi
lea ecx, [ebp - 0x14]
mov edx, 0x4d040e9d
xor ecx, dword [ebp - 0x624513b3]
push cs
add al, 0x4d
mov al, 0x64
call fcn.00403a88
mov ebx, esi
loop 0x497d0d
jns 0x497dcf
dec ecx
add al, ch
cmp byte [ebx + 0x1beefff6], bh
mov dword [eax], eax
call fcn.00498d1b
add byte [eax - 0x46ee8c97], dh
mov ebx, 0xe87d83ff
add byte [edx + eax - 0x70], dh
or eax, dword [ebp - 0x2c174ebf]
mov ecx, 0xf88bfff6
mov edi, eax
xor ebx, dword [ebx - 0x79]
inc ecx
mov ebp, 0x7c04ff83
sub cl, byte [ebx - 0xd2172cd]
in al, dx
dec eax
mov esp, 0xd78bfff6
test edx, edx
jns 0x497d2d
invalid
cld

Function at 0x499044
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
push edx
test eax, eax
je 0x49903d
push ds
fdiv qword [eax + 0x6b]
mov esi, eax
mov edi, edx
mov edi, edx
mov eax, dword [eax + 0x67]
test dword [esi - 0x4f], edx
dec eax
sub edx, eax
dec ecx
sub edx, ecx
jle 0x49901e
adc cl, ch
xchg esi, eax
fld qword [ecx]
iretd
xor eax, eax
jmp 0x49903d
push es
adc bl, ch
out dx, eax
mov edi, 0xb74d285
mov al, byte [ebx + esi]
xor bl, byte [edi + 0x4ba37135]
jne 0x49902c
lea eax, [edi + 1]
sub eax, dword [edi + edi*4]
push edi
pop edi
adc bl, byte [esi - 0x3d]
mov eax, eax
push ebp
mov ebp, esp
sbb dword [edi - 2], 0x57
sbb edx, dword [edi + 0x33]
fisttp dword [ecx + 0x5d89f05d]
outsd dx, dword [esi]
test ebp, ebx
les edx, [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jae 0x499023
lodsb al, byte [esi]
mov ebx, 0xf8458bff
call 0x65403934
cmp eax, 0x46818c4
xchg ecx, eax
dec ecx
add byte [edi + edi*8 + 0x30], ah
inc dword [edi + 0x75dbc924]
sub al, 0x8d
push ebp
hlt
Function at 0x521208
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x521261
test eax, edx
je 0x521264
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x52121f
movzx eax, word [eax]
sub eax, ecx
jmp 0x521246
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x521247
add ecx, 4
js 0x521237
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x521244
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x521246
xor eax, eax
ret
test eax, eax
je 0x521270
test edx, edx
jne 0x521210
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x61708c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x617092
ret
Function at 0x4061e0
Capabilities:
Terminate thread
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov eax, dword [0x445b0c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
je 0x406260
push esi
push edi
push edi
push 3
push edi
push edi
push 0x40000000
push edi
push 0x445a04
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0x1f40
mov dword [esp + 0x3c], edi
call fcn.00406450
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40624d
lea eax, [esp + 0xc]
push edi
push eax
lea ecx, [esp + 0x18]
push 0x10
push ecx
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
push 0x3e8
mov edx, dword [0x445b0c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov eax, dword [0x445b08]
cmp eax, edi
je 0x406281
mov eax, dword [0x445b08]
cmp eax, 0xffffffff
je 0x406281
mov eax, dword [0x445b08]
push eax
call ebx
mov dword [0x445b08], edi
mov eax, dword [0x445b0c]
cmp eax, edi
je 0x4062a9
mov eax, dword [0x445b0c]
cmp eax, 0xffffffff
je 0x4062a9
push 0xffffffffffffffff
mov ecx, dword [0x445b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x445b0c], edi
call fcn.004063b0
mov dword [0x445b14], edi
pop edi
pop ebx
add esp, 0x14
ret

Function at 0xc0e99c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0xc0e9a2
pop ebp
sub ebp, 6
sub ebp, 0x80e99c
jmp 0xc0ea00
mov al, byte [esp + 0x28]
cmp al, 1
je 0xc0ea17
popal
xor eax, eax
inc eax
ret 0xc
jmp 0xc0ea20
mov eax, 0x80e99c
add eax, ebp
add eax, 0xaa
mov ecx, 0x5c2
mov edx, 0xb7481dd1
xor byte [eax], dl
inc eax
dec ecx
jne 0xc0ea37
jmp 0xc0ea4a
pop edx
sbb al, 0x5a
pop eax
in eax, dx
rcl ecx, 1
rcl dword [eax + 0x10]
sub ecx, edx
rcl ecx, 1
rcr byte [ecx + ebp*2], cl
fcmovbe st(0), st(1)
rcl ecx, 1
imul edi, ecx, 0xffffffd1
rcl ecx, 1
xor edx, edx
sbb dword [edx + 0x50], ebx
fst st(1)
rcl ecx, 1
rcl byte [ecx + eax*4], cl
cmp dword [ecx - 0x2e2313eb], 0xa27a06b9
rcl eax, 1
std
cmc
mov ecx, 0x431a6e50
cmp esp, edx
rcl ecx, 1
sar dword [eax], 1
stc
rcl ecx, 1
rol dword [ebp + eax*4 - 0x26aba574], 1
rcl ecx, 1
rcr dword [edx + 0x44], 1
fst st(1)
rcl ecx, 1
pop edx
pop esp
rcl ecx, 0xd1
rcl dword [eax]
cmp bl, dl
loopne 0xc0ea7b
push edx
adc edx, ebp
cwde
ficom word [ebp + 0x2e]
mov word cs:[ebx], ss
fst st(1)
pop edx
pop ebp
cmc
aad 0xd1
rcl ecx, 1
mov ecx, 0xd1dcec15
mov ecx, 0xd1a27a06
sar ch, 1
cmc
cmp byte [ecx], 0xd4
rcl ecx, 1
sar dword [eax], 1
out dx, al
rcl ecx, cl
rol dword [edx + ebx*2 - 0x225bd1c3], 1
movsb byte es:[edi], byte cs:[esi]
fnstcw word [ecx]
mov dword [0x5ad1d1d1], eax
insb byte es:[edi], dx
invalid
Function at 0x401010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x208
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004024d0
push 0x4d8
call fcn.00401428
push 0x208
mov ebx, eax
call fcn.00401428
add esp, 0x14
mov edi, eax
push 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x412d50
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
push ebx
call esi
push 0x412d54
push ebx
call esi
push edi
push ebx
call esi
push str.msinfo32.nfo_
push ebx
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040140c
mov esp, ebp
pop ebp
ret

Function at 0x401320
Capabilities:
Create process on windows
Enumerate gui resources
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x40
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], 0x44
push 0
push eax
call fcn.004024d0
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [ebp - 0x58], xmm0
call fcn.00401010
mov esi, eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 5
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40138b
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040140c
mov esp, ebp
pop ebp
ret
push 2
push esi
call fcn.0040141a
mov eax, dword [ebp - 0x50]
add esp, 8
mov dword [0x415880], eax
mov eax, dword [ebp - 0x58]
mov dword [0x416448], eax
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x4013c8
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040140c
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xfa
call esi
push 0
push 0x4012d0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xbb8
call esi
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0040140c
mov esp, ebp
pop ebp
ret

Function at 0x401c8e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ccd
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ccd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ccd
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ccd
cmp dword [ecx + 0x74], 0xe
jbe 0x401ccd
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret