joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dda10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push ebp
push esi
mov ebp, dword [edi + 0x3c]
sub ebp, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x4dda8e
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00444c40
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x4dda61
sub eax, ebx
jmp 0x4dda63
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x4dda52
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x4dda82
sub eax, ebx
jmp 0x4dda84
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x4dda73
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x4ddb62
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, ebp
add edx, dword [edi + 0x38]
push edx
call fcn.004dd790
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x4ddad9
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x4ddaed
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4dda16
mov eax, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jae 0x4ddb62
mov esi, dword [edi + 0x6c]
add esi, edx
cmp eax, esi
jae 0x4ddb31
sub ecx, esi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x4ddb14
mov ebx, 0x102
mov ecx, dword [edi + 0x38]
push ebx
add ecx, esi
push 0
push ecx
call fcn.004459b0
add esp, 0xc
add ebx, esi
pop esi
pop ebp
mov dword [edi + 0x16c0], ebx
pop ebx
ret
lea edx, [esi + 0x102]
cmp eax, edx
jae 0x4ddb62
sub esi, eax
add esi, 0x102
sub ecx, eax
cmp esi, ecx
jbe 0x4ddb4b
mov esi, ecx
mov ecx, dword [edi + 0x38]
push esi
add ecx, eax
push 0
push ecx
call fcn.004459b0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop esi
pop ebp
pop ebx
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x48603bef
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x4acc3d3c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x41fd10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19000]
push edi
or ebp, 0xffffffff
jmp 0x41fd32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41fd39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41fd28
mov eax, 1
add ebx, ebx
jne 0x41fd4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41fd40
jne 0x41fd5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41fd40
xor ecx, ecx
sub eax, 3
jb 0x41fd70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41fde2
mov ebp, eax
add ebx, ebx
jne 0x41fd7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41fd88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41fdac
inc ecx
add ebx, ebx
jne 0x41fd98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41fd8d
jne 0x41fda9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41fd8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41fdcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41fdbd
jmp 0x41fd2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41fdcc
add edi, ecx
jmp 0x41fd2e
pop esi
mov edi, esi
mov ecx, 0x1a3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41fdea
cmp byte [edi], 3
jne 0x41fdea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41fdef
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41fe67
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2064c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x20688]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41fe1c
mov ecx, edi
jns 0x41fe4b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2068c]
or eax, eax
je 0x41fe61
mov dword [ebx], eax
add ebx, 4
jmp 0x41fe39
call dword [esi + 0x20690]
popal
jmp 0x40215c

Function at 0x401000
Capabilities:
Check for peb beingdebugged flag
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
test al, al
je 0x401027
mov byte [0x402044], 1
push eax
xor eax, eax
pop eax
test eax, eax
jne 0x40101e
jmp 0x401037
mov ebx, 0xdeadbeef
test ebx, ebx
jne 0x401027
mov ecx, 0x12
mov esi, section..data
mov edi, 0x40200e
push ecx
xor byte [esi], 0x5a
xor byte [edi], 0x36
inc esi
inc edi
loop 0x401037
mov eax, 6
add eax, 9
cmp eax, 0xf
jne 0x401050
jmp 0x401064
xor eax, eax
mov eax, 0xbadcafe
push 0xdeadc0de
pop eax
cmp eax, 0xdeadc0de
jne 0x40106b
mov ecx, 4
xor ebx, ebx
mov eax, ecx
shl eax, 1
add eax, 0x14
cmp eax, 0x28
jl 0x40107a
jg 0x40107a
nop
mov eax, 0x401086
imul ecx, ecx, 4
add eax, ecx
jmp eax
Function at 0x59806c37
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x94
mov eax, dword [0x59857105]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0x598570cd
mov eax, dword fs:[eax]
cmp dword [eax + 0x64], 2
jb 0x59806cf2
mov ebp, dword [eax + 0xc]
add ebp, 0xc
mov edx, dword [ebp]
cmp edx, ebp
je 0x59806cc1
xor ebx, ebx
mov edi, dword [edx + 0x30]
mov ecx, ebx
mov esi, dword [0x598570f5]
movzx eax, word [edi]
test eax, eax
je 0x59806cb3
mov dword [esp + 0x6c], edx
mov eax, ebx
mov dword [esp + 0x68], ebp
movzx ebx, word [edi + eax*2]
inc eax
lea edx, [ebx - 0x41]
cmp edx, 0x19
lea ebp, [ebx + 0x20]
jbe 0x59806c9c
mov ebp, ebx
movzx edx, bp
movzx ebx, word [edi + eax*2]
add ecx, edx
test ebx, ebx
jne 0x59806c8a
mov edx, dword [esp + 0x6c]
xor ebx, ebx
mov ebp, dword [esp + 0x68]
cmp esi, ecx
je 0x598073ae
mov edx, dword [edx]
cmp edx, ebp
jne 0x59806c6e
mov esi, dword [esp + 0x50]
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
mov esi, dword [edx + 0x18]
mov dword [esp + 0x50], esi
jmp 0x59806cc5

Function at 0x59806c8f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x94
mov eax, dword [0x59857105]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0x598570cd
mov eax, dword fs:[eax]
cmp dword [eax + 0x64], 2
jb 0x59806cf2
mov ebp, dword [eax + 0xc]
add ebp, 0xc
mov edx, dword [ebp]
cmp edx, ebp
je 0x59806cc1
xor ebx, ebx
mov edi, dword [edx + 0x30]
mov ecx, ebx
mov esi, dword [0x598570f5]
movzx eax, word [edi]
test eax, eax
je 0x59806cb3
mov dword [esp + 0x6c], edx
mov eax, ebx
mov dword [esp + 0x68], ebp
movzx ebx, word [edi + eax*2]
inc eax
lea edx, [ebx - 0x41]
cmp edx, 0x19
lea ebp, [ebx + 0x20]
jbe 0x59806c9c
mov ebp, ebx
movzx edx, bp
movzx ebx, word [edi + eax*2]
add ecx, edx
test ebx, ebx
jne 0x59806c8a
mov edx, dword [esp + 0x6c]
xor ebx, ebx
mov ebp, dword [esp + 0x68]
cmp esi, ecx
je 0x598073ae
mov edx, dword [edx]
cmp edx, ebp
jne 0x59806c6e
mov esi, dword [esp + 0x50]
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
mov esi, dword [edx + 0x18]
mov dword [esp + 0x50], esi
jmp 0x59806cc5
Function at 0x405730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5e
push ebx
leave
pop ebp
or byte [edi + 0x33], dl
inc dword [ebp - 0x6f7f025]
add byte [eax], al
xchg esp, eax
sbb ch, byte [ebx + 0x6a068b42]
add dword [edx], ebp
push 0
push eax
call 0x49a475
cmp eax, 0x11176
je 0x405764
mov dword [esi + 4], 0
mov eax, ebx
or byte [ebp + 0x1bdd75f6], al
invalid

Function at 0x42b5e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x42b602
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42b609
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42b5f8
mov eax, 1
add ebx, ebx
jne 0x42b61b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42b610
jne 0x42b62c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42b610
xor ecx, ecx
sub eax, 3
jb 0x42b640
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42b6b2
mov ebp, eax
add ebx, ebx
jne 0x42b64b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42b658
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42b67c
inc ecx
add ebx, ebx
jne 0x42b668
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42b65d
jne 0x42b679
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42b65d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42b69c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42b68d
jmp 0x42b5fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42b69c
add edi, ecx
jmp 0x42b5fe
pop esi
mov edi, esi
mov ecx, 0x3e7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42b6ba
cmp byte [edi], 1
jne 0x42b6ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42b6bf
lea edi, [esi + 0x29000]
mov eax, dword [edi]
or eax, eax
je 0x42b737
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2c688]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2c73c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42b6ec
mov ecx, edi
jns 0x42b71b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2c740]
or eax, eax
je 0x42b731
mov dword [ebx], eax
add ebx, 4
jmp 0x42b709
call dword [esi + 0x2c748]
mov ebp, dword [esi + 0x2c744]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42b76b
sub esp, 0xffffff80
jmp 0x40d841
Function at 0x1002df80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1002e144
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
or ebp, 0xffffffff
jmp 0x1002dfaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1002dfb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1002dfa0
mov eax, 1
add ebx, ebx
jne 0x1002dfc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1002dfb8
jne 0x1002dfd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002dfb8
xor ecx, ecx
sub eax, 3
jb 0x1002dfe8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1002e05a
mov ebp, eax
add ebx, ebx
jne 0x1002dff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1002e000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1002e024
inc ecx
add ebx, ebx
jne 0x1002e010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1002e005
jne 0x1002e021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1002e005
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1002e044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1002e035
jmp 0x1002dfa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1002e044
add edi, ecx
jmp 0x1002dfa6
pop esi
mov edi, esi
mov ecx, 0xc42
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1002e062
cmp byte [edi], 0x11
jne 0x1002e062
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1002e067
lea edi, [esi + 0x2a000]
mov eax, dword [edi]
or eax, eax
je 0x1002e0d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e44c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e49c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1002e094
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e4a0]
or eax, eax
je 0x1002e0d0
mov dword [ebx], eax
add ebx, 4
jmp 0x1002e0b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1002e107
cmp al, 0xef
ja 0x1002e0fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1002e0dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1002e0e9
mov ebp, dword [esi + 0x2e4a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1002e13b
sub esp, 0xffffff80
jmp 0x10013194

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push 0x96800
push 0
call sub.user32.dll_GetClipboardOwner
call sub.kernel32.dll_VirtualAlloc
call fcn.004a1400
ret
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x77ae51c0
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x14d66cc4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401987
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x214]
push eax
xor ebx, ebx
push 0x20019
push ebx
push str.SOFTWAREmozilla.orgMozilla
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x228], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4019fb
lea eax, [ebp - 0x214]
push eax
push 0x20119
push ebx
push str.SOFTWAREmozilla.orgMozilla
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x401b6e
xor eax, eax
mov dword [ebp - 0x218], 0xc
inc eax
mov byte [ebp - 0x10], bl
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push str.CurrentVersion
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401b6e
lea eax, [ebp - 0x10]
push 0x2e
push eax
call fcn.0049f5a0
pop ecx
pop ecx
test eax, eax
je 0x401a50
mov byte [eax], bl
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x10]
push 0x5067a4
push eax
call fcn.004015fb
add esp, 0xc
cmp dword [ebp - 0x224], 0x4a
jb 0x401b6e
cmp dword [ebp - 0x214], ebx
je 0x401a8b
push dword [ebp - 0x214]
call esi
mov dword [ebp - 0x214], ebx
lea edx, [ebp - 0x210]
mov byte [ebp - 0x210], bl
call fcn.004016f5
cmp byte [ebp - 0x210], bl
je 0x401b6e
push ebx
push str.SoftwareK7_ComputingK7TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x210], bl
call fcn.004991c0
mov dword [ebp - 0x220], eax
test eax, eax
je 0x401ae7
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push str.DirProductBase
push eax
call fcn.004996b0
push dword [ebp - 0x220]
call esi
cmp byte [ebp - 0x210], bl
je 0x401b6e
push str.K7SRK7Webprotection.xpi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401b6e
lea eax, [ebp - 0x220]
push eax
push 0x20019
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityProductsK7SRConfig
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x401b6e
push 4
pop eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push str.SiteRateEnabled
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push 1
pop eax
cmove ebx, eax
cmp dword [ebp - 0x214], 0
je 0x401b7f
push dword [ebp - 0x214]
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
Function at 0x402439
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x28]
push eax
xor ebx, ebx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], ebx
call esi
test eax, eax
je 0x402494
lea eax, [ebp - 0x28]
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x40254c
xor eax, eax
mov dword [ebp - 0x2c], 0x20
inc eax
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push str.Version
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40254c
lea eax, [ebp - 0x24]
push 0x2e
push eax
call fcn.0049f5a0
pop ecx
pop ecx
test eax, eax
je 0x4024da
mov byte [eax], bl
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push 0x5067a4
push eax
call fcn.004015fb
add esp, 0xc
cmp dword [ebp - 0x34], 0x63
jb 0x40254c
cmp dword [ebp - 0x28], ebx
je 0x402506
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x28]
push eax
push 0x20019
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityProductsK7SRConfig
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x40254c
push 4
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push str.SiteRateEnabled
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push 1
pop eax
cmove ebx, eax
cmp dword [ebp - 0x28], 0
je 0x40255b
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret