joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009b9d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push dword [esp + 0x24]
call fcn.1004f130
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], ebx
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov esi, eax
add esp, 8
test esi, esi
je 0x1009bb52
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x1009ba52
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [esp + 0x28]
push ebx
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x38], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov eax, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x1c]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x1009bac6
mov ebp, dword [esp + 0x24]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x1009ba80
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jae 0x1009baf5
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x100aded5
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x100aded6
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x1009bad0
push dword [esp + 0x30]
call fcn.1004f130
mov ecx, dword [esi]
push eax
push dword [esp + 0x34]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [esp + 0x44]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x1009bb20
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0x100b9004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x1009bc20
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1009bc46
mov eax, 0x1b
add esp, 0xc
ret
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x800c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1009bc7e
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esp + 4], 0
mov eax, 2
add esp, 0xc
ret
push dword [esp + 0x18]
call fcn.1004f130
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x20
jne 0x1009bcd5
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x1009bce4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x1009bcf5
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0xc
ret
Function at 0x1009c930
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
je 0x1009c97b
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x1009c941
pop edi
pop esi
pop ebx
ret
Function at 0x4084c9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d948
cmp edx, dword [eax]
je 0x4084eb
add eax, 8
inc ecx
cmp eax, 0x40d9d8
jl 0x4084dc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d948]
jne 0x408619
mov eax, dword [0xf0c7a8]
cmp eax, 1
je 0x4085f3
test eax, eax
jne 0x40851c
cmp dword [0x40d274], 1
je 0x4085f3
cmp edx, 0xfc
je 0x408619
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x408553
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00405300
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004053f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408596
lea eax, [ebp - 0x1a4]
push eax
call fcn.004053f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40c484
push edi
call fcn.00405ec0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00405300
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405310
lea eax, [ebp - 0xa0]
push 0x40c464
push eax
call fcn.00405310
push dword [esi + 0x40d94c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405310
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040a693
add esp, 0x2c
pop edi
jmp 0x408619
lea eax, [ebp + 8]
lea esi, [esi + 0x40d94c]
push 0
push eax
push dword [esi]
call fcn.004053f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0xdc021e
Capabilities:
Encode data using xor

Disassembly:
add al, ah
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
pushal
call 0xdc0224
pop ebp
sub ebp, 0x10
sub ebp, 0x9c0214
jmp 0xdc023a
mov eax, 0x9c0214
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e0
mov edx, 0xa9294116
xor byte [eax], dl
inc eax
dec ecx
jne 0xdc0251
jmp 0xdc0264
popfd
fistp dword [ebp + 0x16162a9f]
push ss
xchg edi, eax
xlatb
out dx, al
push ss
push ss
push ss
adc eax, 0x1612aedb
scasb al, byte es:[edi]
adc dl, byte [esi]
push ss
push ss
lodsb al, byte [esi]
push ss
push ss
push ss
loope 0xdc0274
adc eax, 0x1a979dde
push ss
push ss
push ss
adc eax, 0x729b46d3
xor ch, dl
lahf
adc dh, byte [edx]
jle 0xdc0216
invalid
Function at 0x402106
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
push 0x404075
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
sub esp, 0xe
mov byte [esp], 0x6d
mov byte [esp + 1], 0x63
mov byte [esp + 2], 0x69
mov byte [esp + 3], 0x53
mov byte [esp + 4], 0x65
mov byte [esp + 5], 0x6e
mov byte [esp + 6], 0x64
mov byte [esp + 7], 0x53
mov byte [esp + 8], 0x74
mov byte [esp + 9], 0x72
mov byte [esp + 0xa], 0x69
mov byte [esp + 0xb], 0x6e
mov byte [esp + 0xc], 0x67
mov byte [esp + 0xd], 0x41
mov byte [esp + 0xe], 0
lea eax, [esp]
push eax
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x4060ec], eax
leave
ret

Function at 0x403576
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push 0x40
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x7ffe53be
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
inc esi
dec esi
not eax
not eax
add al, 0
xor eax, ecx
xor eax, ecx
push es
pop ds
xor eax, ecx
xor eax, ecx
and al, 0xff
not eax
not eax
inc esi
dec esi
push bx
inc esp
inc esp
push es
pop ds
xor eax, ecx
xor eax, ecx
inc esi
dec esi
not eax
not eax
and al, 0xff
not eax
not eax
push es
pop ds
add al, 4
sub al, 4
push eax
pop eax
xor eax, ecx
xor eax, ecx
and al, 0xff
not eax
not eax
inc esi
dec esi
xor eax, ecx
xor eax, ecx
and al, 0xff
not eax
not eax
inc esi
dec esi
add eax, 0
call 0x7ffe541c
pop edx
push es
pop ds
pushf
popf
add al, 0
xor dx, dx
pushal
inc eax
popal
add edx, 0xd5e0
and al, 0xff
xor ecx, ecx
and al, 0xff
clc
mov cl, 0x1e
pushf
popf
inc esi
dec esi
xor byte [ecx + edx], 0x31
loop 0x7ffe5440
add al, 4
sub al, 4
inc esi
dec esi
inc esi
dec esi
clc
push dword fs:[0x24]
add al, 4
sub al, 4
pop dword [edx + 0xa]
push eax
pop eax
not eax
not eax
nop
mov cl, 0xff
push edx
loop 0x7ffe5466
cld
mov dword [edx + 0x11], 0xffffacbb
push eax
pop eax
push es
pop ds
mov ecx, dword [eax + 0x2c]
clc
add al, 0
mov dword [edx + 0x1b], ecx
inc esi
dec esi
mov dword [edx + 0x100], ecx
cld
push es
pop ds
mov dword [eax + 0x2c], esp
xor eax, ecx
xor eax, ecx
push eax
pop eax
push es
pop ds
push 0
inc esi
dec esi
not eax
not eax
lea esp, [esp]
push 0
push eax
pop eax
push 0
and al, 0xff
not eax
not eax
cld
push 0
xor eax, ecx
xor eax, ecx
push 0x30
clc
push 0x20
pushf
popf
push es
pop ds
push eax
pop eax
push 0
nop
push 0
xor eax, ecx
xor eax, ecx
push eax
pop eax
push eax
pop eax
add edx, 0xffff7f33
push eax
pop eax
cld
add al, 0
push edx
push edx
push bx
inc esp
inc esp
inc esi
dec esi
cld
push 0
and al, 0xff
call dword [edx + 0x8210]
not eax
not eax
cld
and al, 0xff
add esp, 0x3f8
push eax
pop eax
pushf
popf
xor eax, eax
inc esi
dec esi
cld
inc eax
add al, 0
not eax
not eax
ret 0xc
Function at 0x40efcd
Capabilities:
Encode data using xor

Disassembly:
add al, 0xa1
mov cl, 0x28
lcall 0x856a, 0x84787e8c
jle 0x40f047
test byte [edx - 0x7b], ch
jle 0x40f047
test byte [edx - 0x7b], ch
test ecx, eax
jo 0x40efc7
sal dword [eax - 0xe], 0x24
outsb dx, byte [esi]
and al, 0x6e
xor esp, edx
mov ecx, 0x72a9bb6d
and dword [edx], ebp
cmc
mov ebp, ecx
sbb ch, al
push ds
mov ecx, 0x6fd38abe
stosd dword es:[edi], eax
xchg edi, eax
xchg ebp, eax
bound esi, qword [ecx - 0xe]
cmpsb byte [esi], byte es:[edi]
lcall 0xb318, 0x7bea4d3e
fild qword [ecx + 0x54]
cld
mov dl, ch
inc ebp
jl 0x40efd1
mov edx, 0x14e4da8c
jp 0x40f088
mov bh, 0x83
inc esp
fidivr dword [ebx - 0x8342695]
jne 0x40f056
push ds
jns 0x40f039
idiv dword [esi + ecx*8 - 0x368bc1d4]
add eax, 0xb7b7aaca
sbb byte [edi + 0x4cac8b75], 0x60
mov bl, 0x60
stc
or dl, byte [edi]
push 0x3b
mov byte [edx + edx*4 - 0x35e96212], ch
inc edx
movsd dword es:[edi], dword [esi]
jo 0x40f021
push ss
retf 0xa542
out 0xe3, eax
pop esi
inc ecx
pushfd
mov cl, 0xd8
push cs
rcl dword [ebp + 0x3ea37845], 0x9f
mov al, 0x87
test eax, 0xb9c3582d
test eax, 0x4b578241
inc eax
inc ecx
adc byte [edi + 0x4b], 0x40
mov edi, 0xa3f90294
inc ebp
mov ebp, 0x673ec467
not byte [0x2ea07ab0]
rcl dword [edx + 0x25b944f0], 0xf5
xchg ebp, eax
lea esp, [ebp - 0x5f]
mov ss, word [edx + 0x3e4d05e3]
sbb ebx, dword [esp + ebx*8]
inc edi
das
mov bh, 0x3a
add eax, 0xf6440080
push ebx
loope 0x40f0d1
not byte [ebx - 0x1f]
inc ebp
bswap ebp
clc
in eax, dx
mov byte [eax - 0x1a49671b], bh
dec ecx
xchg dword [eax + 0x26], edx
test byte [edi + 0x69fc9869], 0xde
out 0x9b, al
push ebx
hlt
mov esp, 0x35fa9dc4
push 0xffffffffffffff96
aad 0xbd
clc
into
das
pop ss
shr ch, 0xce
xchg ebx, eax
dec ebx
pop ds
test al, 0xf5
xor dword [ebx], edi
iretd
and cl, byte [edx + 0x1e277c67]
dec ecx
test dword [ebp + 0x33], 0xd6430fe
push ebp
sbb al, 0x46
add ch, al
jnp 0x40f0b8
in al, dx
and esp, dword [ebx + 0x62848437]
fcom qword [edi]
add byte [ebx - 0x71], cl
push ecx
adc eax, 0xd13984c4
in eax, dx
and byte [eax + esi*4 - 0x3b], al
jb 0x40f102
aas
push eax
das
add ecx, edx
add byte [edi + 0x77], ah
loope 0x40f17a
mov byte [0x63a15cfa], al
stosd dword es:[edi], eax
add ebx, esp
out 0x28, al
invalid
pushal
dec eax
dec ebx
out 0xec, al
mov cs, eax
add al, 0xb0
cmp dword [ebp - 0xbf7f315], ebp
lcall 0x7460, 0xda3016c1
pop es
mov bl, 0xfd
cmp cl, ch
cmp byte [eax - 0x6ff622e6], ah
shl dword [ebx - 0x3ecaddc6], 0xb3
cmc
push 0xffffffffffffffce
je 0x40f1d2
ret
mov dh, 0xdf
adc al, 0x9d
sbb ah, byte [edx + 0x6ecb3454]
or dword [ebx + esi*2], esp
mov eax, dword [0xadb72104]
sub bl, cl
invalid

Function at 0x49dc81
Capabilities:
Encode data using xor

Disassembly:
wait
add dword [edi + 0x49830d5b], esp
cmc
lahf
jae 0x49dcba
aas
daa
int1
mov eax, dword fs:[0xf68aaa36]
inc edx
cmpsb byte [esi], byte es:[edi]
pop es
pop edi
sar byte [ecx + 0x43], cl
mov esi, 0xa7cb8030
cmp byte [ebx + 0x2d545070], ah
push edi
cmp al, 2
int3
pop ecx
sub edx, dword [esi]
xchg edi, eax
push ebx
xor eax, 0x67c0cdee
pcmpgtw mm4, qword [ecx]
rcl byte [ebp + 0x6a]
cmp bl, byte [edx - 0x2fcc51a]
push ebx
invalid
Function at 0x627cf1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303c0
cmp edx, dword [eax]
je 0x627d13
add eax, 8
inc ecx
cmp eax, 0x630450
jl 0x627d04
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303c0]
xchg esi, eax
rol byte [ebx], 0x63
add byte [edi], cl
test dword [ecx + eax], ebx
add byte [eax], al
Function at 0x10060780
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1006096d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3d000]
push edi
jmp 0x100607aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100607b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100607a0
mov eax, 1
add ebx, ebx
jne 0x100607c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100607d4
jne 0x100607f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100607f3
dec eax
add ebx, ebx
jne 0x100607e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100607b8
add ebx, ebx
jne 0x100607ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10060845
xor ecx, ecx
sub eax, 3
jb 0x1006080b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1006087a
sar eax, 1
mov ebp, eax
jmp 0x10060816
add ebx, ebx
jne 0x10060816
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100607e4
inc ecx
add ebx, ebx
jne 0x10060824
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100607e4
add ebx, ebx
jne 0x10060831
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10060826
jne 0x10060842
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10060826
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10060864
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10060856
jmp 0x100607a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10060864
add edi, ecx
jmp 0x100607a6
pop esi
mov edi, esi
mov ecx, 0x19c7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10060882
cmp byte [edi], 9
jne 0x10060882
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10060887
lea edi, [esi + 0x5c000]
mov eax, dword [edi]
or eax, eax
je 0x100608ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x604fc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x60610]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100608b4
mov ecx, edi
jns 0x100608e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x60614]
or eax, eax
je 0x100608f9
mov dword [ebx], eax
add ebx, 4
jmp 0x100608d1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10060930
cmp al, 0xef
ja 0x10060923
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x10060905
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10060912
mov ebp, dword [esi + 0x60618]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10060964
sub esp, 0xffffff80
jmp 0x10027dbd
Function at 0x10001f10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10001fa2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x10001f94
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x10001f8c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x10001f55
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x10002050
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x10002091.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x10002091.2
jmp dword [eax*4 + 0x1000211c]
mov word [esp + 0x48], di
jmp 0x100020ca
mov word [esp + 0x48], 2
jmp 0x100020ca
mov word [esp + 0x48], 3
jmp 0x100020ca
mov word [esp + 0x48], 4
jmp 0x100020ca
mov word [esp + 0x48], 7
jmp 0x100020ca
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x10002114
cmp dword [esp + 0x70], edi
je 0x10002100
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret
Function at 0x10002140
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
ja 0x100021c1
je 0x100021b2
cmp eax, 0x80000101
ja 0x100021ab
je 0x100021b2
cmp eax, 0x80000004
je 0x1000218c
cmp eax, 0x80000005
jne 0x100021d6
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 3
test eax, eax
je 0x10002223
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x10002223
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 1
push eax
call dword [0x101562f0]
mov ebp, dword [esp + 0x44]
mov ebx, eax
add esp, 4
inc ebx
jmp 0x10002223
cmp eax, 0x80000201
jne 0x100021d6
mov ebx, 4
lea ebp, [esp + 0x40]
mov dword [esp + 8], ebx
jmp 0x10002223
cmp eax, 0x80000401
je 0x1000220e
cmp eax, 0x80000501
je 0x100021f6
cmp eax, 0x80000601
je 0x100021de
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.10003868
mov dword [esp + 0xc], eax
jmp 0x1000221f
fld dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.10003868
mov dword [esp + 0xc], eax
jmp 0x1000221f
mov ecx, dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea ebp, [esp + 0xc]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.100031a0
mov esi, eax
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0
call dword [0x101562f0]
add esp, 8
test esi, esi
je 0x100022fc
test eax, eax
je 0x100022fc
inc eax
push edi
push eax
call fcn.10003857
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10003830
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000229e
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100022f2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100022e7
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.10003819
add esp, 4
pop edi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10002890
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x1000289d
xor eax, eax
pop esi
ret
push esi
call dword [0x101562f0]
add esp, 4
test eax, eax
jne 0x100028ad
pop esi
ret
cmp eax, 1
jne 0x100028bb
cmp byte [esi], 0x5c
jne 0x100028bb
xor eax, eax
pop esi
ret
push esi
call fcn.10002640
add esp, 4
test eax, eax
je 0x100028cf
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219