joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402fee
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4150a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push eax
push 0x30
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.00401f0c
add esp, 0xc
test eax, eax
jne 0x4031bf
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.004037c1
pop ecx
pop ecx
test eax, eax
jne 0x4031bf
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x40304f
xor eax, eax
inc eax
jmp 0x4031bf
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ebp - 0x18]
add eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], ebx
push 6
push eax
mov dword [ebp - 0x20], ebx
call fcn.00401f0c
add esp, 0xc
test eax, eax
jne 0x4031bf
push 0x410978
lea ecx, [ebp - 0x24]
call fcn.00402575
test al, al
je 0x40316b
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], ebx
push 6
push eax
call fcn.00401f0c
add esp, 0xc
test eax, eax
jne 0x4031bf
push 0x410980
lea ecx, [ebp - 0x24]
call fcn.00401beb
test al, al
je 0x4030ce
push 3
pop ecx
mov esi, 0x100
jmp 0x403102
push 0x410988
lea ecx, [ebp - 0x24]
call fcn.0040253e
test al, al
je 0x4030e9
push 2
pop ecx
mov esi, 0x180
jmp 0x403102
push 0x410990
lea ecx, [ebp - 0x24]
call fcn.0040253e
test al, al
je 0x403167
xor ecx, ecx
mov esi, 0x209
inc ecx
mov eax, dword [edi]
push ecx
push dword [ebp + 0x10]
mov ecx, edi
call dword [eax + 0x20]
test eax, eax
jne 0x4031bf
mov edx, dword [ebp - 8]
mov eax, edx
mov ecx, dword [ebp - 0xc]
sub eax, ecx
cmp eax, 1
jb 0x403047
mov al, byte [ecx]
inc ecx
mov dword [ebp - 0xc], ecx
cmp al, 4
je 0x403139
push 0x2f
jmp 0x4031be
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
sub edx, ecx
mov dword [ebp - 0x20], ebx
push eax
push edx
lea ecx, [ebp - 0xc]
call fcn.004024a0
test eax, eax
jne 0x4031bf
movzx ecx, word [ebp - 0x20]
lea edx, [esi + 7]
shr edx, 3
add edx, edx
cmp ecx, edx
je 0x4031a3
jmp 0x403047
push 0x2c
jmp 0x4031be
push 0x41096c
lea ecx, [ebp - 0x24]
call fcn.00401c22
test al, al
je 0x4031bc
lea eax, [ebp - 0x14]
push 5
push eax
call fcn.004032c0
pop ecx
pop ecx
test eax, eax
jne 0x4031bf
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push edi
push 0x30
push eax
call fcn.004025ac
add esp, 0x10
test eax, eax
jne 0x4031bf
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jne 0x403047
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp ecx, dword [ebp - 8]
setne al
jmp 0x4031bf
push 0x25
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e250
mov esp, ebp
pop ebp
ret
Function at 0x403bb2
Capabilities:
Encrypt data using openssl ecdsa
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
push dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.0040378b
pop ecx
pop ecx
test eax, eax
jne 0x403cee
push 0x410bac
lea ecx, [ebp - 8]
call fcn.00401c22
test al, al
je 0x403bee
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
jmp 0x403c08
push 0x410b94
lea ecx, [ebp - 8]
call fcn.00401beb
test al, al
je 0x403c16
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov eax, dword [ebp + 0x10]
mov dword [eax], 3
jmp 0x403ce7
push 0x410bd0
lea ecx, [ebp - 8]
call fcn.00401c22
test al, al
jne 0x403cd9
push 0x410be4
lea ecx, [ebp - 8]
call fcn.00402575
test al, al
je 0x403c4a
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
jmp 0x403cde
push 0x410b9c
lea ecx, [ebp - 8]
call fcn.00401beb
test al, al
je 0x403c66
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
jmp 0x403c9c
push 0x410ba4
lea ecx, [ebp - 8]
call fcn.00401beb
test al, al
je 0x403c86
mov eax, dword [ebp + 0xc]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
jmp 0x403ce7
push 0x410bb8
lea ecx, [ebp - 8]
call fcn.00401c22
test al, al
je 0x403ca7
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
jmp 0x403ce7
push 0x410bc4
lea ecx, [ebp - 8]
call fcn.00401c22
test al, al
je 0x403cc8
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
jmp 0x403ce7
push 0x410bdc
lea ecx, [ebp - 8]
call fcn.0040253e
test al, al
je 0x403ceb
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], 4
xor eax, eax
jmp 0x403cee
push 6
pop eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4050f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ax, word [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x1c], ebx
cmp ax, 4
je 0x40511d
cmp ax, 0x10
je 0x40511d
xor eax, eax
inc eax
jmp 0x4051f5
mov cx, word [ebp + 0x14]
cmp cx, 8
je 0x40512d
cmp cx, 0x20
jne 0x405115
movzx eax, ax
movzx edx, cx
add eax, eax
cmp eax, edx
je 0x405143
mov byte [ebx], 0
xor eax, eax
jmp 0x4051f5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
add eax, edx
push esi
mov dword [ebp - 4], eax
xor esi, esi
lea eax, [ebp - 0x10]
shr cx, 1
push eax
movzx eax, cx
lea ecx, [ebp - 8]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.004058a3
test eax, eax
jne 0x4051f4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
mov ax, word [ebp + 0x14]
lea ecx, [ebp - 8]
shr ax, 1
movzx eax, ax
push eax
mov dword [ebp - 0x14], esi
call fcn.004058a3
test eax, eax
jne 0x4051f4
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x4051a0
xor eax, eax
inc eax
jmp 0x4051f4
movzx esi, word [ebp + 0xc]
mov edx, dword [ebp + 8]
add esi, edx
mov ebx, dword [ebp - 0x18]
push edi
mov edi, dword [ebp - 0x10]
mov eax, esi
sub eax, edx
cmp eax, 1
jb 0x4051f0
mov eax, dword [ebp - 0xc]
mov ch, byte [edx]
sub eax, edi
inc edx
cmp eax, 1
jb 0x4051f0
mov eax, dword [ebp - 0x14]
mov cl, byte [edi]
sub eax, ebx
inc edi
cmp eax, 1
jb 0x4051f0
mov al, byte [ebx]
xor cl, ch
and cl, al
inc ebx
mov eax, dword [ebp - 0x1c]
neg cl
sbb cl, cl
add cl, 1
mov byte [eax], cl
je 0x4051ec
cmp edx, esi
jne 0x4051b0
xor eax, eax
jmp 0x4051f3
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407f35
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4150a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push 1
push 0x412790
push eax
call fcn.00407ba7
add esp, 0xc
mov ecx, esi
push eax
call fcn.00407c96
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040823b
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040e250
mov esp, ebp
pop ebp
ret

Function at 0x408883
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4150a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x34]
push 1
push 0
push 0x4127c0
push eax
call fcn.00407ba7
add esp, 0xc
push eax
lea eax, [ebp - 0x1c]
push 4
push eax
call fcn.00407f35
pop ecx
push eax
mov ecx, esi
call fcn.00407cbc
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040823b
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.0040823b
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040e250
mov esp, ebp
pop ebp
ret
Function at 0x40a020
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4150a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
jne 0x40a05a
push 0x1ec
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_security_pkix_test_lib_pkixtestutil.cpp
push 0x412ba8
call esi
add esp, 0xc
lea eax, [ebp - 0x4c]
push str.MOZILLA_PKIX_TEST_LOG_DIR
push eax
call fcn.00409e65
cmp dword [ebp - 0x3c], 0
pop ecx
pop ecx
je 0x40a1ab
push 1
push 2
lea ecx, [ebp - 0x114]
call fcn.004090f3
push dword [0x415114]
lea ecx, [ebp - 0x114]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
mov eax, dword [ebp - 0x114]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x108], 6
je 0x40a0c1
push 0x1f8
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_security_pkix_test_lib_pkixtestutil.cpp
push str.false
call esi
add esp, 0xc
jmp 0x40a1a0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x110]
call fcn.0040c625
push 0x2d
push 1
lea ecx, [ebp - 0x34]
call fcn.0040b8d0
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0x1c]
push eax
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
call fcn.0040b551
push str..der
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00408f8b
add esp, 0xc
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00408f8b
add esp, 0xc
lea ecx, [ebp - 0x7c]
push 0
push 1
call fcn.0040b77c
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.0040b77c
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.0040b77c
inc dword [0x415114]
lea ecx, [ebp - 0x34]
push 0x412bdc
call fcn.0040917c
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0040a37d
add esp, 0xc
lea ecx, [ebp - 0x34]
mov esi, eax
push 0
push 1
call fcn.0040b77c
test esi, esi
je 0x40a194
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x40a17f
mov edi, dword [edi]
push esi
push 1
push eax
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.0040b77c
lea ecx, [ebp - 0x114]
call fcn.00409392
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.0040b77c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e250
mov esp, ebp
pop ebp
ret
Function at 0x40d715
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.0040dac1
shr eax, 0x1f
pop ecx
pop ecx
test al, 1
je 0x40d75d
push 0
push 0xffffe8d5
call dword [sym.imp.nss3.dll_PR_SetError]
push str.PR_Recv_failed
call fcn.0040d961
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea eax, [ebp - 8]
push eax
call fcn.0040d9c1
shr eax, 0x1f
not al
pop ecx
test al, 1
je 0x40d77a
lea eax, [ebp - 8]
push eax
call fcn.0040da3a
pop ecx
cmp dword [ebp - 8], 0
je 0x40d78a
push dword [ebp - 8]
call dword [sym.imp.nss3.dll_PR_Close]
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10001131
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
push esi
push edi
push 0xa
push 0x66
xor esi, esi
push dword [0x100032ac]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, esi
je 0x1000125a
push edi
push dword [0x100032ac]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov dword [ebp - 8], eax
push dword [0x100032ac]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x1000125a
cmp dword [ebp - 8], esi
je 0x1000125a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x1000125a
lea eax, [ebp - 0x168]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x168]
push eax
push esi
lea eax, [ebp - 0x168]
push 0x100030d0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push esi
push esi
push 2
push esi
push 1
lea eax, [ebp - 0x168]
pop ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000125a
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x10], esi
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], eax
call edi
cmp dword [ebp - 4], ebx
jne 0x1000125a
push 0x44
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.10001cc0
add esp, 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x64], 0x44
mov dword [ebp - 0x38], ebx
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x168]
push esi
push eax
push esi
mov word [ebp - 0x34], si
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x1000125a
push dword [ebp - 0x1c]
call edi
push dword [ebp - 0x20]
call edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10001262
Capabilities:
Check mutex on windows

Disassembly:
push edi
push 0x10003240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x1000127d
push 1
pop eax
pop edi
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
sub esi, 0xb7
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop edi
ret
Function at 0x10001740
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
push esi
xor esi, esi
push esi
push 4
push esi
push 0x1000161b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffff1
push eax
mov dword [0x100032b4], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x10001777
push dword [0x100032b4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1000178a
push esi
push dword [0x100032b4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x100032b4], esi
pop esi
ret

Function at 0x10001855
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
and byte [ebp - 0x11], 0
and byte [ebp - 4], 0
lea eax, [ebp - 0x24]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 0x24], 0x47
push eax
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x6d
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 0x12], 0x41
mov byte [ebp - 0x10], 0x4b
mov byte [ebp - 0xf], 0x45
mov byte [ebp - 0xe], 0x52
mov byte [ebp - 0xd], 0x4e
mov byte [ebp - 0xc], 0x45
mov byte [ebp - 0xb], 0x4c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0x2e
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6c
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x128]
push 0x104
push ecx
call eax
lea eax, [ebp - 0x128]
push 0x1000310c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x128]
push eax
call esi
test eax, eax
mov dword [0x100032b0], eax
pop esi
je 0x10001932
call fcn.1000101f
xor eax, eax
cmp dword [0x100032b0], eax
setne al
leave
ret
Function at 0x1d5f108
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1d5f258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1d5f12e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1d5f11a
add dl, dl
jne 0x1d5f139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1d5f18c
xor eax, eax
add dl, dl
jne 0x1d5f146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1d5f22d
add dl, dl
jne 0x1d5f155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d5f160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d5f16b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d5f176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1d5f182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1d5f125
mov eax, 1
add dl, dl
jne 0x1d5f19a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1d5f1a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1d5f191
sub eax, ebx
mov ebx, 1
jne 0x1d5f1d8
mov ecx, 1
add dl, dl
jne 0x1d5f1be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1d5f1c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1d5f1b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1d5f125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1d5f1ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1d5f1fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1d5f1e6
cmp eax, 0x7d00
jae 0x1d5f21d
cmp eax, 0x500
jb 0x1d5f218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1d5f125
cmp eax, 0x7f
ja 0x1d5f220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1d5f125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1d5f24e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1d5f125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push str.HeapSetInformation
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401035
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ebx, 0x406474
push ebx
call edi
test esi, esi
mov dword [0x406474], esi
je 0x40446d
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push ebx
call edi
pop edi
pop esi
mov dword [section..data], 0x44bf19b1
pop ebx
leave
ret
mov dword [0x406474], 0xbb40e64e
jmp 0x401093

Function at 0x401496
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x406474]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0040159b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x401517
cmp dword [ebp - 0x1c], 5
jb 0x4014e7
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4062f8
call fcn.0040152b
test eax, eax
jl 0x40469e
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401dc8
add ebp, 0x78
leave
ret
cmp dword [ebp - 0x10], 1
je 0x404689
jmp 0x4014e7
cmp dword [ebp - 0x18], 0
ja 0x4014e3
jmp 0x4014e7
cmp dword [ebp - 0x1c], 4
ja 0x4014e3
je 0x401523
jmp 0x4014e7
mov byte [0x40946c], 1
jmp 0x401505
Function at 0x401d15
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
mov eax, dword [0x406474]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea edi, [ebp - 0x61d]
call fcn.00401d4b
test al, al
je 0x402e9e
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00401dc8
leave
ret
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x61c]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x402fcd
lea eax, [ebp - 0x61c]
push 0x5c
push eax
call dword [sym.imp.MSVCR80.dll_wcsrchr]
cmp eax, edi
pop ecx
pop ecx
je 0x402fcd
push ebx
push esi
mov word [eax + 2], di
lea eax, [ebp - 0x414]
push edi
push eax
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.MSVCR80.dll_wcscpy_s]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push esi
push eax
call edi
mov ebx, dword [sym.imp.MSVCR80.dll_wcscat_s]
push str.GrooveMigrator.exe
lea eax, [ebp - 0x414]
push esi
push eax
call ebx
push esi
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.MSVCR80.dll_memset
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call edi
add esp, 0x3c
cmp byte [ebp - 0x61d], 0
lea eax, [ebp - 0x20c]
je 0x402f4e
push str.__c__r
jmp 0x402f53
push 0x406a7c
push esi
push eax
call ebx
add esp, 0xc
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x674]
push esi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x61c]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x674], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop ebx
je 0x402fcd
push 0xffffffffffffffff
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x62c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x630]
call esi
lea edi, [ebp - 0x61d]
call fcn.00401d4b
pop esi
jmp 0x401d3e
Function at 0x10030760
Capabilities:
Encode data using xor

Disassembly:
je 0x10030759
and al, 0x84
inc esi
pop ebx
das
sub esp, dword [eax + 0x7b]
out dx, al
sub ah, byte [0x338ff8b7]
xchg ebx, eax
hlt
mov ah, 0x70
mov eax, dword [0xf025b6ba]
inc esi
and al, 0xdb
jns 0x1003075d
into
pop ds
jge 0x1003070a
sbb bl, byte [ebp + 0x2e]
invalid
sbb dword [ebp - 0x79], esi
jbe 0x100307d1
jae 0x10030780
and edx, edx
rcr byte [0x84c2bbf6], cl
lcall 0xb770, 0xf437832d
jl 0x1003075d
out dx, eax
sbb eax, dword [ebx]
mov dl, 0x2f
sbb edx, dword [edx - 0x4c84d314]
pop ebx
pop ss
xor dword [ebp - 0xd66e3eb], esi
fild qword [ebp - 0x6e]
fild qword [ebp - 0x6e]
mov ecx, 0xcb6d30aa
test dword [ebp + 0x71], esp
jge 0x1003076d
and byte gs:[ebp - 0x6348ccf5], 0x6f
test eax, 0xb5166605
mov al, 0x15
xchg ecx, eax
sub byte [ecx + 0x251a3462], ch
bound esi, qword [edx + ebx]
and eax, 0x3e511e81
mov edx, 0xbef7678e
pop esi
das
sbb eax, 0xa22b59bf
jnp 0x100307cb
push esi
and bh, byte [eax - 0x67]
push edx
xor esi, dword [edx - 0x72]
adc eax, 0x5bd975dd
or bx, word [eax]
sti
or al, 0x58
cmp al, 0x4b
mov bh, 3
fdiv dword [ebx - 0x5b]
xor edx, dword [edx - 0xc]
insb byte es:[edi], dx
std
mov eax, 0xc8b47f7a
dec dword [ebx]
invalid
push edx
invalid
invalid
push edx
hlt

Function at 0x10030dd0
Capabilities:
Encode data using xor

Disassembly:
mov word [edx + edi], ds
sbb dword [ecx + ebx*2 + 0x6c], ebx
jnp 0x10030dfc
push 0x33
loopne 0x10030e28
dec ebx
xchg esi, eax
mov edi, 0xa82a4ea9
inc esi
movsb byte es:[edi], byte [esi]
test al, 0x4b
sti
inc ecx
lcall 0x9447, 0x597f1dd6
xor ch, byte [ecx]
ja 0x10030ddc
fld dword [ebx - 0x6d]
sbb eax, 0xdc5053c5
push ecx
das
pop ecx
push ebx
outsd dx, dword [esi]
or byte [ebp + eax*2 + 0x7e553c4e], cl

Function at 0x10030f50
Capabilities:
Encode data using xor

Disassembly:
cmp esi, dword [edx]
in al, dx
dec esp
lahf
xor bl, ah
insd dword es:[edi], dx
fldenv [ecx - 0x1c]
wait
mov al, byte [0x6051eb60]
popal
wait
aad 0xc4
cmp al, 0xac
pushal
jle sym.Main.dll__vscprintf_p_l

Function at 0x10032460
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x43
invalid
xchg byte [ecx], dl
jge 0x1003240d
pop edi
fld1
popal
mov esp, 0x716a3726
lodsd eax, dword [esi]
xlatb
lahf
pop eax
invalid