joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
imul edi
bswap edi
bswap edx
bswap eax
imul eax
dec edi
rcl edi, 0x12
neg esi
inc edi
inc eax
dec eax
not edi
neg esi
neg edi
rcr edi, 0xa
rcl edi, 0xf1
sbb edi, 0xd2
or esi, 0xe5
not ebx
and edx, 0xe1
neg esi
imul edx
rcr esi, 0xf7
inc edi
mov eax, 0xd2
rcl edi, 0xb1
dec edx
ror eax, 0xdc
or edi, 0xa6
dec esi
inc edx
not ebx
mov esi, 0x9e
ror ebx, 0x11
or edx, 0x1a
bswap edi
inc ebx
and edx, 0x24
neg edi
rol eax, 0xd7
rol esi, 0x11
not ebx
rcr edi, 0x10
rcr edx, 0x83
bswap edx
bswap ebx
and ebx, 0x8c
rcr edi, 0xe7
rcl ebx, 0x15
bswap edx
xor ecx, ecx
xor edi, edi
inc esi
bswap edi
ror ebx, 0x5a
mov edi, 0x1a
neg ebx
neg eax
neg ebx
sbb edx, 0xf8
inc ebx
bswap edi
dec edi
ror esi, 0x58
mov ebx, 0x57
rcl esi, 0x30
inc esi
bswap edx
rcl esi, 0xbc
rcr ebx, 0x56
rcl esi, 0x41
or ebx, 0x6f
imul edx
and edi, 0x2a
neg esi
inc esi
sbb edx, 0x13
rol ebx, 0xb3
bswap edi
imul eax
inc eax
sub edx, 0x56
inc eax
rcl esi, 0xa6
neg eax
rcl esi, 0xb
or eax, 0x78
or eax, 0xd5
dec eax
dec esi
or esi, 0x50
dec edi
add esi, 0xac
bswap eax
dec edi
rcl edi, 0xa5
neg ebx
dec esi
bswap eax
not edx
mov edi, 0x9d
sbb eax, 0xa4
mov ecx, dword [ebp + 0xc]
mov eax, 0x4b
and esi, 9
imul edi
sbb esi, 0x99
bswap eax
neg edi
neg eax
inc edi
sub esi, 0x86
neg edi
rol edx, 0xfd
or esi, 0x42
inc esi
mov eax, 0x8e
imul edi
rol ebx, 0x3d
neg edi
and ebx, 0xbf
imul esi
ror edx, 0xed
bswap edx
neg esi
inc esi
rol eax, 0x6f
and ebx, 0x3d
mov ebx, 0xc
inc ebx
bswap edi
rcr esi, 0xc3
mov esi, 0x2f
or esi, 0x9e
rol ebx, 0x63
mov eax, 0x8d
sub edx, 0x8b
inc esi
and ebx, 0x76
neg edi
rcr ebx, 0xf3
imul ebx
rcl edx, 0x69
sbb edx, 0x15
add esi, 0x70
mov esi, 0xee
imul eax
bswap edi
add ebx, 0x42
mov ebx, 0x84
dec edi
or eax, 0x61
bswap edx
mov edi, dword [ebp + 8]
mov ebx, ebx
xor eax, eax
mov esi, ebx
mov eax, esi
xor esi, eax
xor eax, ebx
mov eax, ebx
mov ebx, eax
xor esi, ebx
xor eax, ebx
mov eax, esi
xor eax, eax
not byte [edi]
mov ebx, eax
xor ebx, esi
xor esi, esi
mov eax, esi
xor eax, eax
mov esi, esi
xor esi, esi
xor esi, eax
xor ebx, ebx
sub byte [edi], 0x76
xor esi, esi
xor eax, ebx
mov eax, eax
xor esi, ebx
xor ebx, eax
mov esi, ebx
mov ebx, esi
xor eax, eax
xor ebx, eax
add byte [edi], 0x45
xor ebx, ebx
mov eax, eax
mov eax, ebx
xor ebx, eax
mov esi, ebx
xor eax, eax
xor eax, eax
xor eax, eax
mov eax, eax
imul byte [edi]
inc edi
loop 0x4011b6
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404976
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4049b5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4049b5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4049b5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4049b5
cmp dword [ecx + 0x74], 0xe
jbe 0x4049b5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40a4b6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40a553
push ebx
push esi
call fcn.0040a47f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a3c8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a500
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a552
push edi
push eax
call fcn.0040b0b6
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40a520
call fcn.00408ff1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a551
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a3c8
add esp, 0x20
test eax, eax
jne 0x40a53f
push edi
call fcn.00408ff1
jmp 0x40a547
push ebx
call fcn.00408ff1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b839
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438c68
push 0x438c60
push str.FlsAlloc
push 0x1e
call fcn.0040b6fa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b86d
push dword [ebp + 8]
mov ecx, esi
call dword [0x41212c]
call esi
jmp 0x40b873
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b8b7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x438c78
push 0x438c70
push str.FlsGetValue
push 0x20
call fcn.0040b6fa
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b8ee
push dword [ebp + 8]
mov ecx, esi
call dword [0x41212c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x410d70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x410d9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x410d9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7d876866
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x60987985
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0xeee1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00eee140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00eee140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00eee140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00eee140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xeeebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xeeec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xf0087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xeeec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xeeec52
xor eax, eax
pop esi
leave
ret 4
Function at 0x40ab31
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x459218
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4758c0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
push eax
lea ecx, [esp + 0x14]
call fcn.00413969
mov dword [esp + 0x30], 0
mov ecx, dword [esi + 0x1c]
push ecx
lea ecx, [esp + 0xc]
call fcn.00413969
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x28]
mov esi, dword [0x45a41c]
mov dword [esp + 0x24], edx
lea edx, [ecx + eax + 2]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x24], edx
mov edx, dword [edi + 4]
push ecx
push edx
call esi
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call esi
mov esi, 0x45b840
lea ecx, [esp + 8]
mov dword [esp + 8], esi
call fcn.00401361
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], esi
call fcn.00401361
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 0x10
Function at 0x1000188f
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1001900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
and dword [ebp - 0x28], 0
xor edx, edx
and dword [ebp - 0x2c], 0
inc edx
push 0x64
mov dword [ebp - 0x20], ecx
pop ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x30]
push ecx
push 2
push eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000255d
mov esp, ebp
pop ebp
ret

Function at 0x10001a1e
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x1001900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [0x10019858], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
push edi
mov dword [0x1001985c], eax
mov eax, dword [ebp + 0xc]
push 0x400
mov dword [0x10019860], eax
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.10004be0
lea eax, [ebp - 0x404]
push eax
call fcn.100019e6
add esp, 0x10
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x10001ab6
push 0x10000
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x10001aa3
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001ab6
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000255d
mov esp, ebp
pop ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0xd1873e9
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x4f223157
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4065f1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406615
xor eax, eax
test eax, eax
je 0x406627
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406627
xor ecx, ecx
jmp 0x40662a
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406716
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422eb4], 0
push esi
jne 0x40674d
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406727
mov dword [ecx*4 + 0x422eb0], eax
inc ecx
cmp ecx, 0x100
jl 0x406722
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40677e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422eb0]
xor eax, esi
inc ecx
dec edx
jne 0x406760
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x53392d4b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x633037b1
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
and bh, bl
xor byte [esi + 0x79], ah
imul esi, dword [edi + 0x2652a863], 0xffffffa1
jmp 0x414b09
push 0x1e
invalid
adc dword [edx], ebp
xchg esi, eax
and ch, byte [ecx + 0x56e527d2]
lds edi, [edi]
mov al, byte [0x63f63aa9]
test eax, 0xa963f63a
cmp dh, dh
arpl word [ecx + 0x569cf63a], bp
test eax, 0xa963f63a
cmp dh, dh
pushfd
push esi
lds ecx, [ecx]
arpl word [ecx + 0x569cf63a], bp
lds ecx, [ecx]
arpl word [ecx - 0x569c09c6], bp
cmp dh, dh
arpl word [ecx - 0x569c09c6], bp
mov ecx, 0x3e6e671a
ror byte [edi + 0x6af67801], cl
push edx
js 0x414b2a
push 0x52
jne 0x414ad6
arpl cx, bx
jnp 0x414b32
sub eax, 0xe12e82ee
xchg ebx, eax
mov esp, 0x5af8ac4d
mov bl, 0x4a
push esi
jl 0x414b9b
arpl word [ecx + 0x6ee2f67a], di
cmp esi, esi
arpl word [ecx - 0x2075e745], bp
xor dl, byte [edx]
inc edi
cmp esi, esi
arpl word [ecx - 0x17d72980], bp
cmp dh, byte [edi - 0x74]
ja 0x414af5
or esi, esi
ret 0xa847
add byte [edx + 0x5e], ch
jno 0x414b67
bound edx, qword [edi]
invalid
Function at 0x40a470
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [esp + 0xc]
mov ecx, 0
sub esi, edi
je 0x40a499
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40a488
pop edi
mov eax, edx
pop esi
ret 8

Function at 0x419132
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418fa8
Function at 0x10001110
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10014220
push 0x100073b0
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [section..data]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x2b4], esi
lea eax, [ebp - 0x2b0]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100011dc
push pe_nt_image_headers32
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.10008730
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x100011d6
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100011d6
cmp word [eax + 8], 2
jne 0x100011d6
mov dword [ebp - 4], esi
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x100011d6
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10003b02
mov esp, ebp
pop ebp
ret
Function at 0x100013f0
Capabilities:
Get common file path
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x238], eax
push esi
push 0x224
lea eax, [esp + 0x18]
mov dword [esp + 8], ecx
push 0
push eax
mov dword [esp + 0x1c], 0
call fcn.10008730
mov eax, dword [0x100ab548]
add esp, 0xc
test eax, eax
jne 0x1000145d
push str.CsrGetProcessId
push 0x10013f08
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100ab548], eax
test eax, eax
jne 0x1000145d
mov dword [esp + 0x230], eax
jmp 0x1000146a
call eax
mov dword [esp + 0x230], eax
test eax, eax
jne 0x10001477
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x230], eax
call fcn.10001110
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x10001500
push dword [esp + 8]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10001500
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x100014f0
mov eax, esi
mov ecx, dword [eax + 0x190]
test ecx, ecx
je 0x100014d4
cmp ecx, 0xc
jb 0x100014dc
mov eax, dword [eax]
test eax, eax
jne 0x100014c5
jmp 0x100014f0
push ecx
add eax, 0x194
push eax
lea eax, [esp + 0x24]
push eax
call fcn.10003b20
add esp, 0xc
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push str.UserRegisterWowHandlers
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [esp + 0x234], eax
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0x10
push 0
call esi
lea eax, [esp + 0x12c]
push eax
push 0
push 0
push 0x19
push 0
call esi
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x228
lea eax, [esp + 0x24]
push eax
push 0x222558
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [esp + 0x23c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10003b02
mov esp, ebp
pop ebp
ret