joyce8/EMBER2024-capa huggingface dataset:
Function at 0x564500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, 0x72
mov dword [esp], 0x65004b
mov word [esp + 4], ax
lea eax, [esp]
push eax
mov dword [esp + 0xa], 0x65006e
mov dword [esp + 0x1a], 0x6c
mov dword [esp + 0xe], 0x33006c
mov dword [esp + 0x16], 0x6c0064
mov dword [esp + 0x12], 0x2e0032
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0x1c
ret

Function at 0x5645a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
xor eax, eax
mov dword [esp + 4], 0x640077
mov word [esp + 0x14], ax
lea eax, [esp]
push eax
mov dword [esp + 0x14], 0x6c006c
mov dword [esp + 0x10], 0x64002e
mov dword [esp + 4], 0x65004e
mov dword [esp + 0xc], 0x760065
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x18
ret

Function at 0x5645e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
xor eax, eax
mov dword [esp + 0x14], 0x6c006c
mov word [esp + 0x18], ax
lea eax, [esp]
push eax
mov dword [esp + 8], 0x63006d
mov dword [esp + 0x14], 0x64002e
mov dword [esp + 0xc], 0x6c0074
mov dword [esp + 0x10], 0x320033
mov dword [esp + 4], 0x6f0043
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0x1c
ret

Function at 0x564630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, 1
call fcn.005644b0
mov edi, eax
test edi, edi
je 0x56467f
lea eax, [esp + 8]
mov dword [esp + 0x11], 0x657a69
push eax
push edi
mov dword [esp + 0x14], 0x61697469
mov dword [esp + 0x10], 0x6e496f43
mov byte [esp + 0x18], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564678
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x564690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
mov esi, 1
call fcn.005644b0
mov edi, eax
test edi, edi
je 0x564706
lea eax, [esp + 8]
mov word [esp + 0x16], 0x6563
push eax
push edi
mov word [esp + 0x1b], 0x6174
mov dword [esp + 0x16], 0x6e496574
mov byte [esp + 0x1a], 0x73
mov dword [esp + 0x12], 0x61657243
mov word [esp + 0x10], 0x6f43
mov byte [esp + 0x20], 0
mov byte [esp + 0x1d], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5646ff
push dword [esp + 0x28]
push 0x5a5c5c
push 0x15
push 0
push 0x5a5c8c
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x14
ret

Function at 0x564710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
call fcn.005644b0
mov esi, eax
test esi, esi
je 0x56475c
lea eax, [esp + 4]
mov dword [esp + 0xe], 0x657a696c
push eax
push esi
mov dword [esp + 0xc], 0x6e556f43
mov dword [esp + 0x12], 0x61697469
mov word [esp + 0x10], 0x6e69
mov byte [esp + 0x1a], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564755
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
add esp, 0x10
ret
Function at 0x564770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00564550
mov edi, eax
test edi, edi
je 0x5647d5
lea eax, [esp + 0xc]
mov word [esp + 0x13], 0x776f
push eax
push edi
mov dword [esp + 0x1d], 0x736f50
mov dword [esp + 0x16], 0x6e695774
mov word [esp + 0x14], 0x6553
mov byte [esp + 0x1a], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5647ce
push esi
push 1
push 1
push 0xffffd8f0
push 0xffffd8f0
push 1
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x5647e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00564550
mov edi, eax
test edi, edi
je 0x56483c
lea eax, [esp + 0x10]
mov dword [esp + 0x16], 0x54776f64
push eax
push edi
mov dword [esp + 0x19], 0x69577465
mov dword [esp + 0x23], 0x577478
mov byte [esp + 0x22], 0x65
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x18], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564835
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x564850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00564550
mov edi, eax
test edi, edi
je 0x5648c4
lea eax, [esp + 0xc]
mov word [esp + 0x18], 0x776f
push eax
push edi
mov dword [esp + 0x1b], 0x6e695772
mov word [esp + 0x16], 0x6967
mov word [esp + 0x19], 0x6574
mov dword [esp + 0x23], 0x61737365
mov word [esp + 0x14], 0x6552
mov byte [esp + 0x18], 0x73
mov dword [esp + 0x27], 0x576567
mov byte [esp + 0x1f], 0x64
mov byte [esp + 0x22], 0x4d
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5648bd
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x5648d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.005645e0
mov edi, eax
test edi, edi
je 0x56493d
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0x6d6d6f43
push eax
push edi
mov word [esp + 0x25], 0x4573
mov dword [esp + 0x14], 0x74696e49
mov dword [esp + 0x1d], 0x6e6f436e
mov word [esp + 0x22], 0x6f72
mov byte [esp + 0x24], 0x6c
mov word [esp + 0x27], 0x78
mov byte [esp + 0x1c], 0x6f
mov byte [esp + 0x21], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564936
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x564950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00564460
mov edi, eax
test edi, edi
je 0x5649ba
lea eax, [esp + 0x10]
mov word [esp + 0x1b], 0x6f54
push eax
push edi
mov word [esp + 0x1d], 0x646e
mov dword [esp + 0x18], 0x6d6d6f43
mov dword [esp + 0x26], 0x57766772
mov dword [esp + 0x1f], 0x656e694c
mov byte [esp + 0x25], 0x41
mov byte [esp + 0x1c], 0x61
mov byte [esp + 0x2a], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5649b3
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x5649d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp], 0x43746547
push eax
mov word [esp + 0x10], 0x656e
mov word [esp + 0xd], 0x4c64
mov word [esp + 0x12], 0x57
mov dword [esp + 8], 0x616d6d6f
mov byte [esp + 0xc], 0x6e
mov byte [esp + 0xf], 0x69
call fcn.00564500
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564a1b
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x564a70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.005645a0
mov edi, eax
test edi, edi
je 0x564b0b
lea eax, [esp + 0xc]
mov dword [esp + 0x21], 0x616c5064
push eax
push edi
mov word [esp + 0x1c], 0x7669
mov dword [esp + 0x23], 0x67756c50
mov dword [esp + 0x31], 0x73656369
mov dword [esp + 0x14], 0x61647055
mov dword [esp + 0x18], 0x72446574
mov dword [esp + 0x1f], 0x726f4672
mov word [esp + 0x27], 0x6e41
mov word [esp + 0x35], 0x57
mov word [esp + 0x2e], 0x6544
mov byte [esp + 0x2d], 0x79
mov byte [esp + 0x30], 0x76
mov byte [esp + 0x1e], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564b04
push dword [esp + 0x3c]
push 1
push dword [esp + 0x3c]
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x564b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp], 0x4c746547
push eax
mov dword [esp + 0xd], 0x726f72
mov dword [esp + 9], 0x72457473
mov byte [esp + 8], 0x61
call fcn.00564500
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564b59
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x564bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0x4d746547
push eax
mov esi, edx
mov word [esp + 0x15], 0x614e
mov dword [esp + 0x17], 0x57656d
mov word [esp + 0xd], 0x7564
mov dword [esp + 0x10], 0x6c694665
mov byte [esp + 0xf], 0x6c
mov byte [esp + 0x14], 0x65
mov byte [esp + 0xc], 0x6f
call fcn.00564500
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564c0f
push 0x104
push esi
push 0
call eax
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x564c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00564410
mov edi, eax
test edi, edi
je 0x564c88
lea eax, [esp + 0xc]
mov dword [esp + 0x1b], 0x57636570
push eax
push edi
mov dword [esp + 0x1d], 0x6c694665
mov dword [esp + 0x16], 0x65526874
mov word [esp + 0x1a], 0x6f6d
mov word [esp + 0x21], 0x5365
mov byte [esp + 0x27], 0
mov word [esp + 0x14], 0x6150
mov byte [esp + 0x1c], 0x76
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564c81
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x564ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00564410
mov edi, eax
test edi, edi
je 0x564cf3
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x68746150
push eax
push edi
mov dword [esp + 0x1e], 0x646e6570
mov word [esp + 0x22], 0x57
mov word [esp + 0x1c], 0x7041
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564cec
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x564d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00564410
mov edi, eax
test edi, edi
je 0x564d57
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x73697845
push eax
push edi
mov dword [esp + 0x16], 0x69466874
mov dword [esp + 0x20], 0x577374
mov word [esp + 0x14], 0x6150
mov word [esp + 0x1a], 0x656c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564d50
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x564d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.00564550
mov edi, eax
test edi, edi
je 0x564dd7
lea eax, [esp + 0xc]
mov dword [esp + 0x1a], 0x577845
push eax
push edi
mov word [esp + 0x1e], 0x6f48
mov word [esp + 0x18], 0x6e69
mov word [esp + 0x15], 0x7465
mov word [esp + 0x1b], 0x776f
mov byte [esp + 0x14], 0x53
mov word [esp + 0x20], 0x6b6f
mov byte [esp + 0x17], 0x57
mov byte [esp + 0x1a], 0x64
mov byte [esp + 0x1d], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564dd0
push esi
push dword [esp + 0x28]
push ebx
push 3
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x564de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.00564550
mov edi, eax
test edi, edi
je 0x564e42
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x776f646e
push eax
push edi
mov word [esp + 0x26], 0x78
mov dword [esp + 0x21], 0x6b6f6f48
mov dword [esp + 0x18], 0x69576b6f
mov byte [esp + 0x25], 0x45
mov dword [esp + 0x14], 0x6f686e55
mov byte [esp + 0x20], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564e3b
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x564eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.00564550
mov edi, eax
test edi, edi
je 0x564f0a
lea eax, [esp + 0x10]
mov dword [esp + 0x17], 0x65676173
push eax
push edi
mov word [esp + 0x1d], 0x7365
mov dword [esp + 0x18], 0x74736f50
mov word [esp + 0x23], 0x57
mov byte [esp + 0x1c], 0x4d
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x564f03
push esi
push esi
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1044fa5b
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
mov al, 0x37
xor byte [edi + 0x60], 0x57
xor byte [edi + 0x40], ah
pop ecx
mov al, 0xd0
arpl dx, cx
add al, 0x55
dec edi
sub al, 0xfb
adc byte [edi + 0x72], bh
dec byte [ecx - 0x16]
out dx, al
sub eax, 0xae916ce2
pushal
sbb eax, 0xaca39e2a
xlatb
xchg edx, eax
imul esi, dword [esi + 0x6d893e90], 5
dec ebx
scasb al, byte es:[edi]
invalid
mov eax, 0xe1e7bfa0
call 0xd0e5dfbd
xor dword [esi], ecx
lodsd eax, dword [esi]
mov al, byte [0xe8e1e7bf]
shl ch, 0xa0
sal byte [ecx], 0x4e
add byte [ebp + 0x307ba70], ch
out 0x5f, al
jo 0x1044f9bd
pop es
add esp, esi
pop edi
je 0x1044f9f3
add ah, byte [0x46d3734e]
or byte [ebx], dl
mov bh, ch
jp 0x1044f9f4
fst st(0)
sub eax, 0xadad28ff
lodsd eax, dword [esi]
lodsd eax, dword [esi]
adc esp, esp
or dword [edx], eax
cmp eax, 0x47c79645
mov dword [edx + 0x29], esp
push edx
xlatb
inc ecx
jecxz 0x1044fa01
in al, 0x22
mov byte [0xe91a3c9b], al
sbb ch, byte [edi]
xchg ebx, eax
out dx, al
outsb dx, byte [esi]
mov cl, 0x11
pushfd
cmpsd dword [esi], dword es:[edi]
push esp
adc al, 0x6b
jmp 0x1044fa88
pushfd
call fcn.10481e3e
sti
fadd qword [ebx + 0x465a38d0]
in al, dx
jbe 0x1044fa1a
push ebx
or dword [edx + 0x49], edi
xchg esi, eax
or al, 0x71
cmp byte [ebp - 0x1d], ch
insb byte es:[edi], dx
imul ebx, dword [ebx + edx*2 + 0x54], 0xffffffdb
cld
xor ecx, dword [ebx + edx*8]
add byte [edi], bh
add al, 0x91
fistp dword [di - 0x16]
mov bh, 0x9a
aam 0x4b
int 0xb6
rcl byte [eax], cl
pop ecx
mov dl, 0xce
inc ebp
xchg esi, eax
iretd

Function at 0x104840d9
Capabilities:
Encode data using xor

Disassembly:
cmp eax, edx
pushfd
mov dword [esp + 4], 0xb542b1f0
lea esp, [esp + 8]
jb fcn.102ea86f
call fcn.102e3497
test edi, edi
mov byte [esp], al
pushal
lea esp, [esp + 0x34]
je 0x10482563
pushfd
add eax, edi
jmp 0x102eb143

Function at 0x10484907
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x44]
jns 0x104843d2
jae fcn.102ea86f
pushfd
lea esp, [esp + 4]
jmp 0x102e8bd9
cld
add dword [eax], 0xefa2e00e
jle 0x104843c3
mov ch, 0xe6
mov ecx, 0x17c8c19
invalid
ja 0x102ebc08
inc al
xor al, 0x67
call fcn.102e1d6a
call fcn.102e5a94
add dword [esi], edx
test dword [edx - 0x68b9a27f], edx
scasw ax, word es:[edi]
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
cmpsb byte [esi], byte es:[edi]
jg 0x1048442c
jg 0x104843ee
dec edi
salc
adc esp, dword [edx - 0x1a11ae1d]
ficom dword [eax - 0x2f]
inc edi
mov ah, 0x7b
cwde
out dx, al
in eax, 0xda
push eax
rol dword [edi - 0x4c], 1
jnp 0x1048438f
test byte [si + 0x1ea6], ch
xchg ebp, eax
push 0x9dc891b0
std
test byte [ebp + 0x7c], bl
sub esi, dword [edx]
dec ecx
dec ebp
ljmp 0x40b4
xlatb
mov bl, ah
cmpsb byte [esi], byte es:[edi]
frstor dword [ebp - 0x59]
mov byte [edx + 0x66], al
xchg edi, eax
into
retf
lea esp, [esp + 0x38]
jb fcn.102ea86f
stc
cmp bl, 0xd0
pushal
cmp eax, dword [ebp - 0x10]
pushfd
pushal
jmp 0x102eb5e8
Function at 0x42e002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x360b5cb5
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x3ec22896
nop
nop
nop
nop
nop
test eax, eax
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4243b8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4243f7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4243f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4243f7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4243f7
cmp dword [ecx + 0x74], 0xe
jbe 0x4243f7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42bb5b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42bbf8
push ebx
push esi
call fcn.0042bb24
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042bab8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42bba5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42bbf7
push edi
push eax
call fcn.0042a5f0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42bbc5
call fcn.0042a63e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42bbf6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042bab8
add esp, 0x20
test eax, eax
jne 0x42bbe4
push edi
call fcn.0042a63e
jmp 0x42bbec
push ebx
call fcn.0042a63e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42ce07
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4358b0
push 0x4358a8
push str.FlsAlloc
push 0x1f
call fcn.0042ccc6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42ce3b
push dword [ebp + 8]
mov ecx, esi
call dword [0x433144]
call esi
jmp 0x42ce41
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42ce85
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4358c0
push 0x4358b8
push str.FlsGetValue
push 0x21
call fcn.0042ccc6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42cebc
push dword [ebp + 8]
mov ecx, esi
call dword [0x433144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42cec4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4358c8
push 0x4358c0
push str.FlsSetValue
push 0x22
call fcn.0042ccc6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42cefe
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x433144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4321e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43220d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43220d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x11001a70
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 8]
sub eax, 1
jne 0x11001aab
call sym.LIBEAY32.dll_OPENSSL_cpuid_setup
mov ecx, dword [esp + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x11001aab
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x11001aab
cmp ecx, dword [eax + 0x34]
mov eax, 1
je 0x11001ab0
mov dword [0x111453f8], eax
ret 0xc
mov eax, 1
ret 0xc

Function at 0x11001c00
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.110d22e0
mov eax, dword [0x11143f70]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x11001c87
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x11001c87
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.110d2a5f
add esp, 0x10
test eax, eax
jge 0x11001c5d
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.110d2962
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call fcn.110d2a5f
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x11001d19
call sym.LIBEAY32.dll_OPENSSL_isservice
test eax, eax
jle 0x11001d19
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x11001d2d
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.110d2962
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.110d2962
add esp, 0x108
ret

Function at 0x11001d90
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x11001db8
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
sub edi, 1
jne 0x11001da7
pop esi
pop ebx
movzx eax, cl
pop edi
ret