joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4690e0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae0a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x18], esi
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x10], esp
cmp eax, ebx
je 0x46911e
push eax
call fcn.00488ede
add esp, 4
mov dword [esi + 0xc], ebx
push 0x400
lea ecx, [ebp - 0x40]
mov dword [esi + 0x10], ebx
call fcn.004a4071
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x43f]
mov byte [ebp - 0x440], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, 1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x14], ebx
je 0x46919d
mov edx, dword [esi + 8]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x440]
push 0x400
push ecx
push edx
call edi
cmp eax, ebx
je 0x46915a
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jbe 0x46915a
push eax
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x40]
call fcn.004a4294
jmp 0x46915a
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call fcn.0049cf37
mov edi, eax
cmp edi, ebx
jbe 0x4691bc
lea ecx, [ebp - 0x40]
call fcn.004a4124
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
cmp ecx, edi
lea ecx, [ebp - 0x40]
sbb esi, esi
neg esi
call fcn.004a4136
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x469590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ae13a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x34]
mov dword [esp + 0x10], 6
call fcn.0049c4b5
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.0049c4b5
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.0049c4b5
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.0049c4b5
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 2
call fcn.0049c4b5
lea ecx, [esi + 8]
mov byte [esp + 0x10], 1
call fcn.0049c4b5
lea ecx, [esi + 4]
mov byte [esp + 0x10], 0
call fcn.0049c4b5
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.0049c4b5
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4695a6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ae13a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
lea ecx, [esi + 0x34]
mov dword [esp + 0x10], 6
call fcn.0049c4b5
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 5
call fcn.0049c4b5
lea ecx, [esi + 0x2c]
mov byte [esp + 0x10], 4
call fcn.0049c4b5
lea ecx, [esi + 0x28]
mov byte [esp + 0x10], 3
call fcn.0049c4b5
lea ecx, [esi + 0xc]
mov byte [esp + 0x10], 2
call fcn.0049c4b5
lea ecx, [esi + 8]
mov byte [esp + 0x10], 1
call fcn.0049c4b5
lea ecx, [esi + 4]
mov byte [esp + 0x10], 0
call fcn.0049c4b5
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.0049c4b5
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x46ac30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x46ac3b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x46ad3e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x6d6d00]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x6d6d00]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x6d6d00]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x6d6d00]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x6d6d00]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x6d6d00]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x6d6d00]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x6d6d00]
xor eax, edx
inc ecx
dec edi
jne 0x46ac56
pop edi
test esi, esi
je 0x46ad60
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x6d6d00]
xor eax, edx
inc ecx
dec esi
jne 0x46ad42
pop esi
pop ebx
not eax
ret
Function at 0x471610
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x471676
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x471676
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x471657
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x471a00
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x471a38
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x472670
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4726b9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x472b30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ae4b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004726e0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00472760
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00472760
lea ecx, [esi + 0xc]
call fcn.0049c440
lea ecx, [esi + 0x10]
call fcn.0049c440
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00473cf0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00473cf0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00473cf0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0049c4b5
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0049c4b5
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x47acf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x47ad3c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x47ad3c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x47ad26
push eax
call ebp
test ax, ax
jl 0x47ad34
inc esi
add edi, 4
cmp esi, 6
jb 0x47ad18
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.0047a9f0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x47e990
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x47e9f0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x47e9f0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x47e9f0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x47e9f0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x47ea00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x49e8e1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49e919
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049c95c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049c934
jmp 0x49e925
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49ffd6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a0018
call fcn.004a65b2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a0018
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a000f
xor eax, eax
jmp 0x4a0020
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a0026
pop edi
pop esi
pop ebx
ret 4
Function at 0x8ba92c
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
jmp 0x8ba964
jmp 0x8ba948
lea esp, [esp + 4]
jmp 0x8ba90f
jmp 0x8ba980
jmp 0x8ba99c
push ebx
jmp 0x8ba9b8
jmp 0x8ba9d4
push ebp
jmp 0x8ba9f0
jmp 0x8baa0c
push esi
jmp 0x8baa28
jmp 0x906945
push edi
movzx edx, byte [eax]
shl edx, 8
movzx esi, byte [eax + 1]
jmp 0x906bb0
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
jmp 0x906bf6
shl edx, 8
xor edx, esi
jmp 0x906d94
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x8c42ac]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x8c42ac]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x8c42ac]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x8c42ac]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.008f202c
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x8c42ac]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x8c42ac]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
and edx, esi
mov edx, dword [edx*4 + 0x8c42ac]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x8c42ac]
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x8c5ad4
jne 0x906e5f
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x8bca70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x90943f
lea esp, [esp + 4]
jmp fcn.009091e8
Function at 0x8bddf3
Capabilities:
Get storage device properties

Disassembly:
jmp 0x8bde0f
lea esp, [esp + 4]
jmp 0x90a02a
jmp 0x8bde47
jmp 0x8bde63
push ebp
jmp 0x8bde7f
jmp 0x8bde9b
mov ebp, esp
jmp 0x8bdeb7
jmp 0x8bded3
sub esp, 0x224
jmp 0x8bdeef
jmp 0x8bdf18
push ebx
jmp 0x90b6aa
jmp 0x8bde2b
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
jmp 0x90b72a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
mov dword [ebp - 4], esi
mov ebx, 0x428
cmp dword [ebp - 4], 4
jmp 0x90b943
inc dword [ebp - 4]
cmp dword [ebp - 8], esi
jmp 0x90b9c5
push dword [ebp - 4]
lea eax, [ebp - 0x224]
push 0x8c5ad4
push eax
call fcn.008cf49f
pop esp
mov eax, dword [0x8c8768]
mov eax, dword [eax + 4]
add esp, 0xc
push esi
push esi
push 3
push esi
push 7
push esi
lea ecx, [ebp - 0x224]
push ecx
call eax
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x90b8c9
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
jmp 0x90bb12
sub dword [ebp + ecx*8 - 0x507cf0db], edx
std
invalid
jae 0x90b6f8
jb 0x90b8e8
rol dword [ecx - 0x2f], cl
mov al, 0x43
out 0xe4, al
jnp 0x90b93f
invalid
je 0x90b733
jmp 0x90b6f8
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
call dword [fcn.008c8750]
push esi
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0x2d1400
push dword [ebp - 0xc]
call fcn.008cfc94
inc byte [ebp + 0x77840fc0]
invalid
stosd dword es:[edi], eax
push ebx
push 8
push dword [0x8c872c]
jmp 0x90ba39

Function at 0x8bf9b5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
push ebx
push esi
push edi
call fcn.008bf906
invalid
Function at 0x8c1acf
Capabilities:
Encode data using xor

Disassembly:
call fcn.008c19fd
jmp 0x8c1af0
push 0x2e6512e2
jmp 0x8c1b0c
pushfd
jmp 0x8c1b28
add dword [esp + 4], 0x5b810c51
jmp 0x8c1b44
jmp 0x8c1b60
pushal
jmp 0x91de99
mov ah, 0xc1
add al, 0x1f
in al, 0xd5
and ah, al
invalid
div byte [edi - 0x463f89e6]
xchg ecx, eax
insb byte es:[edi], dx
push cs
outsb dx, byte [esi]
cmp al, 0x92
pop esp
xor byte [eax], ah
cwde
popfd
adc dword [ebp - 0x6392328f], esp
je 0x91dedd
mov ch, 0x96
and edx, dword [edi]
mov dl, 0xb1
jp 0x91de7b
scasd eax, dword es:[edi]
sal dword cs:[edi + 8], 1
sub eax, edx
mov dh, 0x1e
cmc
push 0x3bbc4da0
mov eax, dword [0x5c3bc2e4]
aas
push es
retf 0x20a7
pop esp
imul esp, dword [eax + 0x24], 0x33367145
das
and al, 0x45
jno 0x91df1a
xor ebp, dword [edi]
pushfd
and eax, 0xad30ff3b
adc esi, dword [ebx]
ja 0x91dee0
mov al, 0x7b
fnstsw word [ecx - 0x1a]
xchg ebx, eax
int1
rcr dword [ecx + edx*8 - 0x19a1051a], 1
push eax
push esi
sal byte [ecx + 0x1a], cl
mov dword [ebp - 0x24], 0x1456a4d9
xor ebx, edx
xlatb
mov dword [0xa9eec025], eax
into
sub edi, dword [eax + 0x4e]
sbb al, ah
out 0x3d, al
add dword [edi], 0xffffff84
xchg esp, eax
cmp eax, 0x862da705
cmp ecx, esp
jne 0x91df31
mov word [eax], cs
invalid
xor dword [edx + 0x4fdd24bf], eax
jg 0x91df80
xchg edi, eax
xchg edi, eax
pop ebx
popal
adc ah, byte [ecx - 0x49034119]
inc ecx
sub eax, 0xfe7588ac
mov edx, 0x8a48a304
sbb dword [ecx + 0x53], eax
push 0xffffffffffffffb0
scasd eax, dword es:[edi]
or byte [esi], 0x2e
cmp dl, byte [edx]
mov esp, dword [ebp + 0x24]
lcall 0x156a, 0x3cb42411
cmp ch, byte [esi]
sub al, 0xe9
cmp al, 0x6a
adc eax, 0xe92c2e3a
jg 0x91df60
inc edi
xchg esp, eax
dec edi
cmp edi, esi
xchg ecx, eax
fnsave dword [edi + esi - 0xfcfa510]
dec esp
or dword [eax + 0x46d403ec], esp
xor ecx, esi
sbb edx, dword [edx + 0x3b90900f]
mov ah, 0xc1
and al, 0x2b
push esi
sbb al, 0x1c
pop ecx
xchg edx, eax
seto byte [eax + 0x24c1b43b]
sub edx, dword [esi + 0x1c]
sbb al, 0x59
add byte [edx + esi*4 + 0x16bcf421], 0x68
push ds
jne 0x91dfa2
mov dl, 0x21
hlt
sti
adc eax, 0x6f4ade25
imul esi, dword [ecx], 0xffffffd9
retf
cmp byte [eax], al
loop 0x91df8f
in eax, 0xbf
push cs
ljmp 0xd4db

Function at 0x901a46
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
jmp 0x901c61
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x901c6f
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x901c02
xor eax, eax
pop ebp
ret

Function at 0x901aae
Capabilities:
Enumerate pe sections

Disassembly:
xor eax, eax
jmp 0x901b1c
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x901a81
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x901b3e
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x901b1c
jmp 0x901b3e
pop edi
pop esi
pop ebx
pop ebp
ret
inc edx
add eax, 0x28
cmp edx, esi
jb 0x901ad3
jmp 0x901a81
Function at 0x935eca
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
xor al, 0x3d
invalid
call 0x935e21
jmp 0x935e37
push eax
jmp 0x935e1c
pop eax
sub eax, 0x935e21
cmp dword [eax + 0x8b40c9], 0
je 0x935e70
lea esp, [esp + 8]
popal
jmp 0x934f56
lea esp, [esp + 4]
jmp 0x935fdc
inc dword [eax + 0x8b40c9]
push 0xac31ad20
add dword [esp], 0x54590437
push 0
push 0
push 0xabb84d7f
add dword [esp], 0x54d253ce
call fcn.008c1666
call fcn.008c0a37
popal
jmp 0x934f56
call 0x935eca
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x63694c20
outsb dx, byte gs:[esi]
jae 0x935f29
jb 0x935edc
inc esp
insd dword es:[edi], dx
outsd dx, dword [esi]
and byte [esi + 0x31], dh
cmp byte cs:[esi], ch
xor byte [esi], ch
xor byte [eax], al
jmp 0x935e51
pop edi
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69f96a00
or bl, bh
cmp ch, byte [ebp - 7]
imul ecx, dword [eax], 0xd5401bfb
sbb eax, dword [eax - 0x2b]
inc ebp
sub al, 0xdf
aaa
int 0x5f
iretd
or al, 0x90
push es
popal
nop
cmp dword [edi + ebx*4], eax
punpckhdq mm3, qword [ecx + 0x60f25010]
pop es
bnd jne 0x935ef2
sbb ecx, dword [ebx + 0x609c1dee]
loop 0x935fb4
pop ss
loop 0x935f7d
mov ebx, 0x5dbd4e2b
dec eax
enter 0x395e, 0xffffffffffffffc8
sub dword [edi + 0x46cbac3e], edi
inc esi
movsb byte es:[edi], byte [esi]
pop ss
xchg edi, eax
pop es
bound edx, qword [ecx - 0x14840d8a]
invalid
in eax, 0x8c
jg 0x935f57
sub dword [edi + 0x64a15237], esp
jge 0x935f79
push 0xd
cld
adc dl, byte [eax + 0x26eb8c1e]
ret 0x3db0
cmp eax, 0x8647b4ad
lds edx, [ecx - 0x3f]
mov al, byte [0x97b353]
xchg esi, eax
int1
add dl, ch
ret
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x93886d
movzx ebx, word [eax + 0x3c]
add ebx, eax
cmp word [ebx], 0x4550
je 0x935e34
jmp 0x937d28
call 0x937d19
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
je 0x9369d8
sub eax, 0x10000
jmp 0x937d1d
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x937d14

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x6b8b465f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0xdc325e0
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x12dd1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp + 4], cl
mov word [ebp], ax
pushfd
lea esp, [esp + 0x48]
jmp fcn.0001232b

Function at 0x1af05
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0xc]
jne 0x19633
movsx eax, dl
sbb ax, 0x75dc
shrd ax, bx, cl
xor edx, edx
adc ah, bh
adc al, ch
shr al, cl
mov eax, edx
adc al, 0xfe
cmc
jmp 0x1b5e6
pushfd
jmp 0x1d9e5
test al, al
call fcn.000176cd
pushfd
pushal
lea eax, [edi - 0x15e48b03]
lea eax, [sym.imp.ntoskrnl.exe_ExFreePool]
push dword [esp + 4]
mov word [esp], bp
mov dword [esp + 0x2c], 0x17d29
mov byte [esp], dh
call fcn.0001a754
add byte [eax], al
dec esi
je 0x1af81
jne 0x1af97
jb 0x1afad
push ebx
jns 0x1afaa
je 0x1af9e
insd dword es:[edi], dx
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
jb 0x1afad
popal
je 0x1afac
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [ecx*8 - 0x58150d0e], dl
xchg al, bl
cmpsd dword [esi], dword es:[edi]
fsubr qword [eax + 0x7aaa27dd]
mov edi, 0x55588c7f
and dword [esi + 0x3d], ecx
push ds
cld
xor dword [esp + edi*4], ebx
movsd dword es:[edi], dword [esi]
inc edi
js 0x1afdb
pop ebx
add ah, byte [ebx + 0x55]
mov ebp, 0x13c0b92d
inc esp
rcr dword [eax - 0x7c], cl
or ebp, dword [esi - 0x6d0fc12e]
xchg ebx, esp
add dword [ebp - 0xdddfecb], ebx
sub edi, ebx
or al, 0xd0
stc
add eax, 0x68db5a4c
jns 0x1af8a
push 0x3ca8fd79
test al, 0x3c
out dx, eax
in eax, 0x71
jno 0x1af4f
ret
cwde
jnp 0x1af67
ror dword [ebx], cl
push ds
mov dword [esp + edx], edi
cmp al, 0x14
and al, 0x51
pop esi
xor byte [edi], ch
xchg ecx, eax
cmp al, 0x6d
xor dword [edx + 0x58], edi
pop eax
sbb byte [0xa30cfd81], al
add eax, 0xa30cfd81
cmp ebp, 0xdc6a30c
and al, 0x8f
outsb dx, byte [esi]
shr ch, cl
push 0x5906e35b
jo 0x1afa2
invalid
retf 0xc866
pushfd
jmp 0x173e2
pushal
add edi, 1
stc
mov byte [esp], cl
mov al, byte [edi]
jmp 0x1a43a
jmp 0x1a83d

Function at 0x105ae
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0
call sub.ntoskrnl.exe_PsGetCurrentProcessId
push eax
push 2
call fcn.00010522
push 0x1059a
mov esi, eax
call sub.ntoskrnl.exe_DbgPrint
test esi, esi
pop ecx
jne 0x105ff
call fcn.00010406
mov esi, eax
test esi, esi
je 0x1060c
call sub.ntoskrnl.exe_PsGetCurrentProcessId
and dword [esi + 0xc], 0
mov dword [esi], eax
mov eax, dword [ebp + 8]
push esi
mov dword [esi + 4], eax
mov dword [esi + 8], 1
call fcn.00010456
jmp 0x1060c
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], 1
pop esi
pop ebp
ret 4

Function at 0x10f05
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x10e84]
test eax, eax
mov ecx, 0xbb40
je 0x10f1c
cmp eax, ecx
jne 0x10f3f
mov edx, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, 0x10e84
shr eax, 8
xor eax, dword [edx]
and eax, 0xffff
mov dword [0x10e84], eax
jne 0x10f3f
mov eax, ecx
mov dword [0x10e84], eax
not eax
mov dword [0x10e80], eax
pop ebp
jmp 0x10a32