joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dbeb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x99000]
push edi
jmp 0x4dbeca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4dbed1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dbec0
mov eax, 1
add ebx, ebx
jne 0x4dbee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4dbef4
jne 0x4dbf13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dbf13
dec eax
add ebx, ebx
jne 0x4dbf00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4dbed8
add ebx, ebx
jne 0x4dbf0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4dbf65
xor ecx, ecx
sub eax, 3
jb 0x4dbf2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4dbf9a
sar eax, 1
mov ebp, eax
jmp 0x4dbf36
add ebx, ebx
jne 0x4dbf36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dbf04
inc ecx
add ebx, ebx
jne 0x4dbf44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dbf04
add ebx, ebx
jne 0x4dbf51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4dbf46
jne 0x4dbf62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4dbf46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4dbf84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4dbf76
jmp 0x4dbec6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4dbf84
add edi, ecx
jmp 0x4dbec6
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4dbfa2
cmp byte [edi], 0x13
jne 0x4dbfa2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4dbfa7
lea edi, [esi + 0xd7000]
mov eax, dword [edi]
or eax, eax
je 0x4dc01f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x106a58]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x106bac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4dbfd4
mov ecx, edi
jns 0x4dc003
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x106bb0]
or eax, eax
je 0x4dc019
mov dword [ebx], eax
add ebx, 4
jmp 0x4dbff1
call dword [esi + 0x106bc0]
mov ebp, dword [esi + 0x106bb4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4dc053
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x403000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.0040350f
mov ebx, dword fs:[0x30]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x4231dc], eax
mov edi, dword [0x4231dc]
call esi
mov ecx, eax
and ecx, 2
push 0x3a
xor edx, edx
or ecx, 0x4d4225d
pop eax
div ecx
or edx, 0x3c
sub edi, edx
call esi
mov ecx, eax
and ecx, 0x40
or ecx, edi
or ecx, 0x3f6faf3f
xor edx, edx
mov eax, 0x2b4a
div ecx
mov ecx, dword [ebx + 0xc]
mov edi, dword [ecx + 0xc]
imul eax, eax, 0x67d4
lea ecx, [eax - 0x2c44cdf4]
or ecx, 0xea
jmp 0x403120
mov ebx, ecx
call esi
mov ecx, eax
and ecx, 0x24023020
or ecx, 0x5a3d4e8d
xor edx, edx
mov eax, 0x10ac
div ecx
or eax, 0xfffffffb
and eax, ebx
and eax, 0x77
mov dword [0x4231dc], eax
mov dword [ebp - 4], eax
call esi
and eax, 0x405342ff
xor edx, edx
mov ecx, 0xef18cc2f
div ecx
mov ebx, eax
xor ebx, dword [ebp - 4]
call esi
and eax, 0x7398638b
sub eax, ebx
cmp dword [edi + 0x18], 0
mov dword [0x4231dc], eax
je 0x40312e
call fcn.00403518
mov edx, dword [edi + 0x18]
mov ecx, 0x4231cc
mov dword [0x4231dc], eax
cmp edx, ecx
ja 0x4030e5
mov ebx, dword [edi + 0x20]
add ebx, edx
cmp ebx, ecx
ja 0x403135
mov ebx, eax
call esi
mov ecx, eax
and ecx, 0x2df5
imul ecx, ecx, 0x22383fd
or ecx, 0x76b4004b
mov eax, 0x5da4
sub eax, ecx
or ebx, 0x3ee7a202
xor edx, edx
div ebx
mov ebx, edx
call esi
mov edi, dword [edi]
and eax, ebx
and eax, 0x20
mov ecx, 0x562a
sub ecx, eax
mov dword [0x4231dc], ecx
test edi, edi
jne 0x403072
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, edx
jmp 0x403130

Function at 0x4039bb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x4039e9
mov ecx, dword [ebp - 4]
cmp ecx, 2
jl 0x4039e9
push dword [eax + ecx*4 - 4]
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
leave
ret
xor eax, eax
leave
ret
Function at 0x407539
Capabilities:
Check os version
Terminate process

Disassembly:
and esi, 0xffffffff
neg ecx
mov dword [0x410edb], esi
and edi, 0xffffffff
not ecx
mov dword [0x410ed7], edi
and ebx, 0xffffffff
not ecx
mov dword [0x410ee7], ebx
pop eax
jmp fcn.00403f7c
Function at 0x10005500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x210
call fcn.10005514

Function at 0x1000a9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x1000aa10
cmp edi, esi
jb 0x1000aa7b
cmp edi, dword [ebp + 0x10]
ja 0x1000aa8e
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x1000aa12
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x1000aa00
jmp 0x1000aa6f
ja 0x1000aa19
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x1000a9d5
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x1000aa50
mov ebx, esi
sub ecx, edx
jns 0x1000aa67
jmp 0x1000aa71
cmp esi, edi
je 0x1000aaa2
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x1000aa71
xor al, 1
cmp ebx, edi
jne 0x1000aa30
jmp 0x1000aa71
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x370d49c
call fcn.100095d0
add esp, 4
ud2
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x370d49c
call fcn.10008d00
add esp, 4
ud2
mov ecx, 0x3715a40
mov edx, 0x2b
push 0x370d48c
call fcn.100091f0
add esp, 4
ud2
Function at 0x10025460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp byte [edx + 0x1199], 0
mov edi, edx
mov esi, ecx
je 0x100254b1
mov edx, edi
mov ecx, esp
push 3
push 0
call fcn.10025750
add esp, 8
movq xmm0, qword [esp]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
movd ecx, xmm0
test ecx, ecx
je 0x1002557d
movq qword [esi], xmm0
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
jmp 0x100255b0
cmp byte [edi + 0x119a], 0
je 0x100255b8
mov dword [esp + 0x14], esi
mov byte [edi + 0x1194], 0xc
xor edi, edi
lea esi, [0x370ea09]
lea edx, [0x370ea0a]
mov eax, 0xfffffff9
mov dword [esp + 0x18], 0
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
mov esi, edx
mov edx, ebx
add dl, 0xd0
cmp dl, 0xa
jb 0x10025515
or bl, 0x20
mov edx, ebx
add dl, 0x9f
cmp dl, 6
jae 0x1002560d
add bl, 0xa9
mov edx, ebx
mov ecx, edi
movzx ebx, dl
lea edx, [esi + 1]
shl ecx, 4
or ebx, ecx
test eax, eax
cmove edx, esi
je 0x10025536
shld dword [esp + 0x18], edi, 4
inc eax
test esi, esi
mov edi, ebx
jne 0x100254f0
mov ecx, 0x370e7f6
mov edx, 9
xor ebx, 0xe
call fcn.1000d390
mov edi, eax
test eax, eax
mov esi, 1
mov ecx, 0x370e7e4
mov edx, 0x12
cmove edi, esi
call fcn.1000d390
mov ecx, dword [esp + 0x14]
test eax, eax
cmove eax, esi
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], 0
jmp 0x100255b0
movzx ecx, byte [edi + 0x118f]
cmp ecx, 0x10
jae 0x100255f9
mov dword [edi + ecx*8], edx
mov dword [edi + ecx*8 + 4], eax
mov dword [esi], 0
mov eax, dword [edi + 0x1178]
add dword [edi + 0xa0], eax
adc dword [edi + 0xa4], 0
mov byte [edi + 0x1194], 0xd
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, edi
mov ecx, esp
push 2
push 0
call fcn.10025750
add esp, 8
movq xmm0, qword [esp]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
movd ecx, xmm0
test ecx, ecx
jne 0x100254a2
movzx ecx, byte [edi + 0x118f]
cmp ecx, 0x10
jb 0x10025589
mov edx, 0x10
push 0x370ea14
jmp 0x10025603
mov edx, 0x10
push 0x370ea24
call fcn.10008830
add esp, 4
ud2
mov ecx, 0x3714230
mov edx, 0xe
push 0x370de30
call fcn.100091f0
add esp, 4
ud2
Function at 0x10029a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp byte [edx + 0x118e], 3
mov edi, edx
mov esi, ecx
jne 0x10029ada
movzx ecx, byte [edi + 0x1190]
cmp ecx, 0x10
jae 0x10029bd2
movzx eax, byte [edi + 0xa8]
mov dword [esi], 0
and al, 1
mov byte [edi + ecx*8], al
mov eax, dword [edi + 0x1178]
add dword [edi + 0xa0], eax
adc dword [edi + 0xa4], 0
mov byte [edi + 0x1194], 0xd
jmp 0x10029bca
lea ecx, [esp + 8]
mov edx, edi
push 0
push 0
call fcn.10025750
add esp, 8
movq xmm0, qword [esp + 8]
movd eax, xmm0
test eax, eax
je 0x10029b11
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
movq qword [esi], xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
jmp 0x10029bca
mov dword [esp], esi
mov byte [edi + 0x1194], 0xc
xor edi, edi
lea esi, [0x370e9cd]
lea edx, [0x370e9ce]
mov eax, 0xfffffff9
mov dword [esp + 4], 0
nop word cs:[eax + eax]
movzx ebx, byte [esi]
mov esi, edx
mov edx, ebx
add dl, 0xd0
cmp dl, 0xa
jb 0x10029b65
or bl, 0x20
mov edx, ebx
add dl, 0x9f
cmp dl, 6
jae 0x10029be6
add bl, 0xa9
mov edx, ebx
mov ecx, edi
movzx ebx, dl
lea edx, [esi + 1]
shl ecx, 4
or ebx, ecx
test eax, eax
cmove edx, esi
je 0x10029b86
shld dword [esp + 4], edi, 4
inc eax
test esi, esi
mov edi, ebx
jne 0x10029b40
mov ecx, 0x370e7f6
mov edx, 9
xor ebx, 0x1a
call fcn.1000d390
mov edi, eax
test eax, eax
mov esi, 1
mov ecx, 0x370e7e4
mov edx, 0x12
cmove edi, esi
call fcn.1000d390
mov ecx, dword [esp]
test eax, eax
cmove eax, esi
mov dword [ecx], edi
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, 0x10
push 0x370e9f8
call fcn.10008830
add esp, 4
ud2
mov ecx, 0x3714230
mov edx, 0xe
push 0x370de30
call fcn.100091f0
add esp, 4
ud2
Function at 0x10035390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
movzx esi, byte [ebp + 0x18]
mov edi, ecx
mov ecx, dword [ebp + 0x10]
or eax, dword [ebp + 8]
or esi, edx
mov edx, dword [ebp + 0xc]
and ecx, 0xfffff000
or esi, ecx
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.100314e0
add esp, 8
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x100353e2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 0xc], ecx
mov dword [edi + 8], esi
jmp 0x100354b9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], edi
xor edi, edi
lea esi, [0x37121bd]
mov ecx, 0xfffffff9
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
lea eax, [0x37121be]
nop word cs:[eax + eax]
nop
movzx ebx, byte [esi]
mov esi, eax
mov eax, ebx
add al, 0xd0
cmp al, 0xa
jb 0x10035431
or bl, 0x20
mov eax, ebx
add al, 0x9f
cmp al, 6
jae 0x100354c1
add bl, 0xa9
mov eax, ebx
mov edx, edi
movzx ebx, al
lea eax, [esi + 1]
shl edx, 4
or ebx, edx
test ecx, ecx
cmove eax, esi
je 0x10035451
shld dword [ebp - 0x18], edi, 4
inc ecx
test esi, esi
mov edi, ebx
jne 0x10035410
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10035472
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
and eax, 0xfff
movzx eax, byte [ecx + eax]
mov byte [edx + 4], al
mov dword [edx], 0
jmp 0x100354b9
mov ecx, 0x3715889
mov edx, 0x13
xor ebx, 0x2c7
call fcn.1000d390
mov ecx, 0x3715865
mov edx, 6
mov edi, eax
call fcn.1000d390
mov edx, dword [ebp - 0x10]
test eax, eax
mov ecx, 1
cmove eax, ecx
test edi, edi
cmove edi, ecx
mov dword [edx], edi
mov dword [edx + 4], eax
mov dword [edx + 8], ebx
mov dword [edx + 0xc], 0
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x3714230
mov edx, 0xe
push 0x370de30
call fcn.100091f0
add esp, 4
ud2
Function at 0x1003dc70
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x580
cmp dword [edx + 8], 0
call fcn.1003dc88
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10029874
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x10029874
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10029883
pop dword [ebp - 0x18]
mov eax, 0x83d9f380
add eax, 0x8c28a503
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3eff0
push 0
mov eax, 0x13f96c10
sub eax, 0x3f66ab4
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x2568295e
add ecx, 0xda9819c1
mov ebx, eax
mov edx, 0x98d2ece2
sub edx, 0x88ce30e2
add edx, dword [ebp - 0x18]
mov edi, 0x8acbf70e
add edi, 0x65669bc0
sub dword [ebp - 0x10], edi
mov esi, dword [edx]
sub dword [ebp - 0x10], 0xf83c1bac
add esi, edi
mov dword [ebp - 0x10], 0x87e4994c
mov dword [ebx], esi
xor dword [ebp - 4], esi
add ebx, 0x7df6dfe5
sub ebx, 0x7df6dfe1
add edx, 0x1b0ab59
sub edx, 0x1b0ab55
loop 0x100298e2
add eax, 0x1ecc47c5
add eax, 0xe134b78a
xor ebx, ebx
add ebx, eax
add eax, 0xfeb0c6b
sub eax, 0xfeb0c66
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x1000a7e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000a7f3
pop dword [ebp - 0x1c]
mov eax, 0xafdef886
add eax, 0x6021af6d
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xea289322
sub dword [ebp - 0x2c], 0x9bd64dd7
mov dword [ebp - 0x28], 0x3ed2a4a9
sub dword [ebp - 0x28], 0xc9f5864
mov dword [ebp - 0x24], 0xa2cbfc63
sub dword [ebp - 0x24], 0x567fb835
mov dword [ebp - 0x20], 0xd145e117
sub dword [ebp - 0x20], 0xd145e117
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xb239ded1
add eax, 0x5dc6e153
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x4f97ff5a
add dword [ebp - 0x2c], 0x24da69fc
mov dword [ebp - 0x28], 0x1d2067a
add dword [ebp - 0x28], 0x3f9a5afb
mov dword [ebp - 0x24], 0xf35a432f
add dword [ebp - 0x24], 0x7015293d
mov dword [ebp - 0x20], 0x8de98f0e
add dword [ebp - 0x20], 0x721670f2
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a504
push 0
call eax
mov ecx, 0x5142
xor ebx, ebx
add ebx, eax
mov edi, 0xb63468df
add edi, 0x59d00b21
add edi, dword [ebp - 0x1c]
mov edx, 0x20fbb233
sub edx, 0xfb810ddf
xor dword [ebp - 0x18], edi
mov esi, dword [edi]
add dword [ebp - 0x10], 0x82c9d2d6
add esi, edx
xor dword [ebp - 0x18], 0xc9f0b2af
mov dword [ebx], esi
sub dword [ebp - 0x14], 0xf8fd9828
add ebx, 4
add edi, 0x7d155a7f
add edi, 0x82eaa585
loop 0x1000a90c
add eax, 0xd6fd273b
add eax, 0x290410a0
xor ebx, ebx
add ebx, eax
add eax, 0x8894d14d
sub eax, 0x8894d148
mov ecx, 0xb80e96ec
add ecx, 0x57f16914
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x1000169a
Capabilities:
Enumerate pe sections
Get common file path
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 8], eax
and dword [ebp - 0x14], 0
jmp 0x100016d7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
jge 0x100017cf
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x10001739
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x10001737
push 4
push 0x1000
push dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call sub.MSVCRT.dll_memset
add esp, 0xc
jmp 0x100016c7
push 4
push 0x1000
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0xc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov dword [ebp - 0x41c], 0x100
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x105
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100016c7
leave
ret
Function at 0x100017d1
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
jmp 0x10001802
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 8], eax
jge 0x10001913
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
test eax, eax
je 0x1000187b
push 0x4000
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100017f2
mov eax, dword [ebp - 0x10]
shl eax, 4
mov ecx, dword [ebp - 0x20]
lea eax, [eax + ecx*8 + 0x100010a4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
and eax, 0x4000000
test eax, eax
je 0x100018ac
mov eax, dword [ebp - 0x18]
or ah, 2
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100018ef
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
and eax, 0x40
test eax, eax
je 0x100018d5
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x14], eax
jmp 0x100018ef
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
and eax, 0x80
test eax, eax
je 0x100018ef
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x1000190e
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100017f2
leave
ret
Function at 0x10001d08
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x100020f0
call sub.MSVCRT.dll__EH_prolog
push ecx
mov eax, 0x113c
call fcn.10001f50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [0x10002304]
test eax, eax
jne 0x10001ee6
mov eax, dword [ebp + 8]
mov dword [0x10002220], eax
push 0x104
lea eax, [ebp - 0x120]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], 0x1e00
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
jne 0x10001d8b
xor eax, eax
jmp 0x10001ee9
mov dword [ebp - 0x130], 0x1e00
and dword [ebp - 0x12c], 0
and dword [ebp - 0x128], 0
push 0
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, 0x1df6
mov dword [ebp - 0x124], eax
push dword [ebp - 0x124]
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x124]
push dword [ebp - 0x18]
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_ReadFile]
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x114c], eax
push 0x10002130
lea eax, [ebp - 0x114c]
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x10001e1f
ret
push 1
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4241b0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4a5014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x4241f7
mov ecx, dword [ebp - 0x1c]
mov eax, 0x4e20
add ecx, 0x1e
mov word [ebp - 0x1e], ax
mov word [ebp - 0x20], cx
push dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x1d
mov word [ebp - 0x24], ax
mov eax, 0x32
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push dword [0x4a5004]
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004024e0
mov esp, ebp
pop ebp
ret