joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d20
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
pop es
bound edx, qword [eax - 0x6fd66f70]
nop
push ebp
mov ebp, esp
push 0x53
pop eax
push esi
std
inc ebp
test al, 0x57
mov ebp, dword [ecx]
adc byte [ebp - 0x74afb7b3], cl
inc ebp
or al, 0x8d
push ebp
or al, 0x51
mov ecx, dword [ebp + 8]
push edx
lds edi, [esi + 0x51]
call 0x40e3c0
jnp 0x407da9
add byte [eax], al
mov ecx, dword [ebp + 0x57]
mov edx, dword [ebp + 0x14]
add esp, 0xffffffa5
mov dword [ebp - 8], eax
test ecx, ecx
mov esi, edx
je 0x407d5d
mov byte [edx], 0x2d
lea esi, [edx + 1]
lea ecx, [edi - 1]
push ebx
test ecx, ecx
jle 0x407d97
and byte [ecx + eax], bh
xor byte [ebp - 0x7aefb019], bl
leave
jg 0x407d65
mov ecx, esi
adc byte [ebx - 0x2421f3ea], cl
invalid
add byte [eax], al
add byte [edi - 0x64], ch
sub ecx, edi
cmp ecx, 4
jno 0x407d17
mov al, 0x6f
add byte [edi - 0x7b], ah
fstp xword [edi + 0x3b]
cmp byte [eax], 0x30
je 0x407d41
adc ecx, dword [esi - 0x247ab9d2]
inc esi
test ebx, ebx
jge 0x407dcb
mov ecx, ebx
mov eax, 0x30303030
neg ecx
mov dword [ebp + 0x5d], ecx
jo 0x407d7c
mov eax, dword [edx - 0xc5e163f]
stosd dword es:[edi], eax
test edx, 0xf361e183
stosb byte es:[edi], al
mov edx, dword [eax + edx]
mov eax, edx
mov edx, dword [ebp + 0x14]
or byte ss:[ebx], al
invalid
mov ecx, 1
cmp edi, ecx
jl 0x407dea
xor al, 0x10
mov byte [edx], bh
inc eax
cmp edx, dword [eax + 0x63704d1]
jne 0x407e26
test eax, 0xed7ecf3b
mov ecx, dword [ecx + 0x14]
cmp edi, ebx
jge 0x407e10
sub ebx, eax
mov eax, 0x3030be24
mov ecx, ebx
mov edi, esi
mov esp, dword [edx - 0x3f]
jmp 0x7eec7195
inc esi
call [ebx + 0x3c]
adc dh, byte [ebp + eax*4 + 0x97]
mov eax, dword [ebp + 0x18]
test eax, eax
mov esp, dword [edi + ecx + 0x47f28c85]
inc edi
add dh, al
inc esi
inc dword [eax]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
wait
inc ebp
cld
push eax
push 0x809266a2
push ecx
mov byte [0x51809266], al
mov dword [ebp - 4], 0xca008a
call dword [ecx - 0x4c]
rol dword [eax], 0xa6
clc
xor dword [ebp + 0x1e], 0xd8358b56
rol dword [eax], 0xff
salc
test eax, eax
jne 0x408bdc
dec edi
push edi
out dx, al
pop ebp
ret

Function at 0x408db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [ebx], dh
fimul word [eax - 0x74547967]
push edx
adc al, 0x90

Function at 0x40a580
Capabilities:
Encode data using xor

Disassembly:
push ebp
in al, dx
cli
push ebx
mov ebp, dword [esi + 0x400800]
sub byte [edi - 0x1f], bl
jge 0x40a597
push 0x2f
push edi
call ebx
push 0x5c
invalid
mov esi, eax
pop esp
call dword [ebp - 0x39c4ef1d]
jbe 0x40a5a4
mov esp, dword [eax*4 + 0x6a0e75f6]
cmp dl, byte [edi - 1]
ror dword [ebx - 0x6f3b7c10], cl
test esi, esi
jne 0x40a5b6
push 0x3a
push edi
call ebx
mov esi, eax
add esp, 0xffffff90
test esi, esi
je 0x40a5c0
lea eax, [esi + 1]
pop ebx
pop esi
pop ebx
pop ebp
ret 4
mov ebp, dword [eax + 0x5f]
pop esi
pop ebx
pop ebp
jo 0x40a5cc
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x35
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
xchg esi, eax
invalid
Function at 0x405760
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x40e520]
cmp eax, dword [0x40d800]
je 0x40577d
mov dword [0x40d810], 0x271
mov eax, dword [0x40d810]
cmp eax, 0x270
jl 0x4058b9
cmp eax, 0x271
jne 0x4057af
mov eax, dword [0x40e520]
call fcn.00407520
mov eax, dword [0x40e520]
not eax
mov dword [0x40e520], eax
mov dword [0x40d800], eax
mov dword [ebp - 0xc], 0
dec dword [ebp - 0xc]
lea esi, [esi]
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax*4 + 0x40ed80]
and edx, 0x80000000
inc eax
mov eax, dword [eax*4 + 0x40ed80]
and eax, 0x7fffffff
or eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add eax, 0x18d
mov edx, dword [ebp - 8]
shr edx, 1
xor edx, dword [eax*4 + 0x40ed80]
mov eax, dword [ebp - 8]
and eax, 1
xor edx, dword [eax*4 + 0x40d820]
mov eax, dword [ebp - 0xc]
mov dword [eax*4 + 0x40ed80], edx
cmp eax, 0xe2
jl 0x4057bc
mov dword [ebp - 0xc], 0xe3
dec dword [ebp - 0xc]
mov esi, esi
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax*4 + 0x40ed80]
and edx, 0x80000000
inc eax
mov eax, dword [eax*4 + 0x40ed80]
and eax, 0x7fffffff
or eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add eax, 0xffffff1d
mov edx, dword [ebp - 8]
shr edx, 1
xor edx, dword [eax*4 + 0x40ed80]
mov eax, dword [ebp - 8]
and eax, 1
xor edx, dword [eax*4 + 0x40d820]
mov eax, dword [ebp - 0xc]
mov dword [eax*4 + 0x40ed80], edx
cmp eax, 0x26e
jl 0x405820
mov eax, dword [0x40f73c]
and eax, 0x80000000
mov edx, dword [0x40ed80]
and edx, 0x7fffffff
or edx, eax
mov dword [ebp - 8], edx
shr edx, 1
xor edx, dword [0x40f3b0]
mov eax, dword [ebp - 8]
and eax, 1
xor edx, dword [eax*4 + 0x40d820]
mov dword [0x40f73c], edx
mov dword [0x40d810], 0
mov eax, dword [0x40d810]
mov eax, dword [eax*4 + 0x40ed80]
mov dword [ebp - 8], eax
inc dword [0x40d810]
mov eax, dword [ebp - 8]
shr eax, 0xb
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
shr eax, 0x12
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
leave
ret
Function at 0x407520
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], eax
mov dword [0x40ed80], eax
mov dword [ebp - 8], 1
dec dword [ebp - 8]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
dec eax
mov edx, dword [eax*4 + 0x40ed80]
shr edx, 0x1e
xor edx, dword [eax*4 + 0x40ed80]
imul edx, edx, 0x6c078965
add edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x40ed80], edx
cmp eax, 0x26f
jl 0x407538
mov dword [0x40d810], 0x270
leave
ret

Function at 0x40c630
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 4], al
cmp al, 7
jb 0x40c67f
sub al, 7
je 0x40c6e1
dec al
je 0x40c66a
sub al, 2
je 0x40c653
sub al, 3
je 0x40c65e
jmp 0x40c67f
inc dword [0x410160]
jmp 0x40c6e1
mov eax, dword [0x4100a0]
mov dword [0x410170], eax
jmp 0x40c6e1
mov eax, dword [0x410170]
cmp eax, dword [0x4100a0]
jbe 0x40c6e1
dec dword [0x410170]
jmp 0x40c6e1
mov eax, dword [0x410170]
dec eax
mov word [ebp - 8], ax
mov eax, dword [0x410160]
dec eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 1
lea eax, [ebp - 4]
push eax
call fcn.0040c810
push eax
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteConsoleOutputCharacterA
movzx ax, byte [0x40dbd0]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.0040c810
push eax
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteConsoleOutputAttribute
inc dword [0x410170]
mov eax, dword [0x410170]
cmp eax, dword [0x4100c0]
jbe 0x40c710
mov eax, dword [0x4100a0]
mov dword [0x410170], eax
inc dword [0x410160]
jmp 0x40c710
mov eax, 1
call fcn.0040c770
dec dword [0x410160]
mov eax, dword [0x410160]
cmp eax, dword [0x4100d0]
ja 0x40c700
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10003020]
jne 0x1000143a
repz ret
jmp fcn.100017d0

Function at 0x1000148d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000149c
pop dword [ebp - 8]
mov eax, 0x4e4aaddb
add eax, 0xc1b566c1
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xfb250506
add dword [ebp - 0x18], 0x532d4045
mov dword [ebp - 0x14], 0x1b68e2ea
add dword [ebp - 0x14], 0x16ca695b
mov dword [ebp - 0x10], 0x8653a81b
sub dword [ebp - 0x10], 0x3a0763ed
mov dword [ebp - 0xc], 0xd532405c
sub dword [ebp - 0xc], 0xd532405c
lea eax, [ebp - 0x18]
push eax
mov eax, 0x7acf1274
add eax, 0x9530fddc
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xcbbab253
add dword [ebp - 0x18], 0xa8b7b703
mov dword [ebp - 0x14], 0x7bb70b2d
add dword [ebp - 0x14], 0xc5b55648
mov dword [ebp - 0x10], 0x54ec3585
add dword [ebp - 0x10], 0xe8336e7
mov dword [ebp - 0xc], 0x5e9bf3ea
add dword [ebp - 0xc], 0xa1640c16
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x966d0a4a
sub eax, 0x866cfa0a
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3882f
push 0
call eax
mov ecx, 0x326067ba
add ecx, 0xcd9fe867
mov edi, eax
mov edx, 0xc74594b7
add edx, 0x48babd49
add edx, dword [ebp - 8]
mov esi, 0xbc4cf87f
add esi, 0xd8f53c6c
xor dword [ebp - 4], 0x56660c6e
mov ebx, dword [edx]
add dword [ebp - 4], 0xa2d2a35
sub ebx, esi
mov dword [ebp - 4], 0xad762936
mov dword [edi], ebx
add edi, 0x89d51c4b
add edi, 0x762ae3b9
add edx, 4
loop 0x100015be
add eax, 0x13357
mov ebx, eax
add eax, 5
mov ecx, 0x4fb20e95
sub ecx, 0x3fb20e95
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10009157
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10009166
pop dword [ebp - 0x2c]
mov eax, 0x24b017f0
add eax, 0xeb507976
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xbac161d1
add dword [ebp - 0x3c], 0x9390e37a
mov dword [ebp - 0x38], 0x89d7a3f8
add dword [ebp - 0x38], 0xa85ba84d
mov dword [ebp - 0x34], 0xcdf69ae4
add dword [ebp - 0x34], 0x7e55a94a
mov dword [ebp - 0x30], 0xf6a58fa3
add dword [ebp - 0x30], 0x95a705d
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x6354b9a6
add eax, 0xacac06ca
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x965143ed
add dword [ebp - 0x3c], 0xde212569
mov dword [ebp - 0x38], 0xeef631c8
add dword [ebp - 0x38], 0x52762fad
mov dword [ebp - 0x34], 0xbe806913
add dword [ebp - 0x34], 0xa4ef0359
mov dword [ebp - 0x30], 0x90ce67a2
add dword [ebp - 0x30], 0x6f31985e
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xcffee0c8
sub eax, 0xbffe2064
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x362a6
push 0
call eax
mov ecx, 0x415a
mov ebx, eax
mov edx, 0x6b218238
sub edx, 0x5b1fde38
add edx, dword [ebp - 0x2c]
mov edi, 0x5cfd9f0
add edi, 0x1c397e92
mov dword [ebp - 0xc], 0x208804ff
mov esi, dword [edx]
xor dword [ebp - 0x18], 0x36ffbf0d
xor esi, edi
sub dword [ebp - 0x14], eax
mov dword [ebx], esi
add ebx, 4
add edx, 4
loop 0x10009282
add eax, 0xf83b
xor ebx, ebx
add ebx, eax
add eax, 0xc90acfd0
add eax, 0x36f53035
mov ecx, 0x344a9f41
add ecx, 0xdbb560bf
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40cc70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40cc92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40cc99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40cc88
mov eax, 1
add ebx, ebx
jne 0x40ccab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40cca0
jne 0x40ccbc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40cca0
xor ecx, ecx
sub eax, 3
jb 0x40ccd0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40cd42
mov ebp, eax
add ebx, ebx
jne 0x40ccdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40cce8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40cd0c
inc ecx
add ebx, ebx
jne 0x40ccf8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40cced
jne 0x40cd09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40cced
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40cd2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40cd1d
jmp 0x40cc8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40cd2c
add edi, ecx
jmp 0x40cc8e
pop esi
mov edi, esi
mov ecx, 0xe8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40cd4a
cmp byte [edi], 1
jne 0x40cd4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40cd4f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40cdbe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd1e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd334]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40cd7c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd33c]
or eax, eax
je 0x40cdb8
mov dword [ebx], eax
add ebx, 4
jmp 0x40cd99
call dword [esi + 0xd338]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40cdef
cmp al, 0xef
ja 0x40cde2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40cdc4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40cdd1
mov ebp, dword [esi + 0xd340]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0xce4a]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40ce3b
sub esp, 0xffffff80
jmp 0x4039a9
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000983f
pop dword [ebp - 0x10]
mov eax, 0x1000983f
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3bac3
push 0
mov eax, 0x932b7499
add eax, 0x7cd5cbcb
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xf4503c08
sub ecx, 0xf44fe959
mov ebx, eax
mov edx, 0xc67cbe2f
add edx, 0x4984c7d1
add edx, dword [ebp - 0x10]
mov edi, 0x6ec84cd1
add edi, 0x8bc85afb
sub dword [ebp - 0xc], 0xa4a97649
mov esi, dword [edx]
sub dword [ebp - 4], eax
sub esi, edi
xor dword [ebp - 0xc], 0xf920cecb
mov dword [ebx], esi
sub dword [ebp - 8], 0x1eeab009
add ebx, 0x1c001873
sub ebx, 0x1c00186f
add edx, 0xe8e6b3da
add edx, 0x17194c2a
loop 0x10009899
add eax, 0xe8d3ec4
sub eax, 0xe8c0135
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6ee87d1
sub ecx, 0xf6ee87d1
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x432498
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00420a69
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4324cf
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004324f0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4d6de7
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x5648a7
call fcn.0053af27
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0040c240
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x56df74
call fcn.0040d2d0
cmp eax, 0xffffffff
jne 0x4d6e9b
push 0
push 0x5711d8
lea ecx, [ebp - 0x4d0]
call fcn.0040d2d0
cmp eax, 0xffffffff
jne 0x4d6e9b
push 0
push 0x574640
lea ecx, [ebp - 0x4d0]
call fcn.0040d2d0
cmp eax, 0xffffffff
jne 0x4d6e9b
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.0040c240
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4d6e77
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.0041efb8
jmp 0x4d6eca
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0041f8dd
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.0041efb8
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4d6ec1
mov ebx, dword [ebp - 0x4cc]
jmp 0x4d6eca
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.0041efb8
mov eax, ebx
call fcn.0053aed6
ret

Function at 0x5502d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0054f5cd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0054f582
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
invalid
Function at 0x4010a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f0ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8c
push esi
mov dword [ebp - 0x7c], 0x83ec8b55
mov dword [ebp - 0x78], 0x335714ec
mov dword [ebp - 0x74], 0xec45c7ff
mov dword [ebp - 0x70], 0x4e007edf
mov dword [ebp - 0x6c], 0x534eb8
mov dword [ebp - 0x68], 0xf045c700
mov dword [ebp - 0x64], 0x56fd7956
mov dword [ebp - 0x60], 0xcf445c7
mov dword [ebp - 0x5c], 0xc7632fff
mov dword [ebp - 0x58], 0x5174f845
mov dword [ebp - 0x54], 0x89664e2d
mov dword [ebp - 0x50], 0x7d39fc45
mov dword [ebp - 0x4c], 0x8b377e0c
mov dword [ebp - 0x48], 0x8b531045
mov dword [ebp - 0x44], 0x2b56085d
mov dword [ebp - 0x40], 0x1f0fd8
mov dword [ebp - 0x3c], 0xb807348d
mov dword [ebp - 0x38], 0x38e38e39
mov dword [ebp - 0x34], 0xc78be7f7
mov dword [ebp - 0x30], 0x2eac147
mov dword [ebp - 0x2c], 0x3d20c8d
mov dword [ebp - 0x28], 0x8ac12bc9
mov dword [ebp - 0x24], 0x32ec0544
mov dword [ebp - 0x20], 0x6883304
mov dword [ebp - 0x1c], 0x3b10458b
mov dword [ebp - 0x18], 0xd87c0c7d
mov dword [ebp - 0x14], 0x8b5f5b5e
mov word [ebp - 0x10], 0x5de5
mov byte [ebp - 0xe], 0xc3
mov dword [ebp - 0x84], 0xf
mov dword [ebp - 0x88], 0
mov byte [ebp - 0x98], 0
lea eax, [ebp - 0x98]
mov dword [ebp - 4], 0
push eax
push ecx
call fcn.004014d0
mov ecx, dword [ebp - 0x88]
add esp, 8
mov eax, dword [0x4184e0]
cmp ecx, eax
ja 0x4011e6
cmp dword [0x4184e4], 0x10
mov eax, 0x4184d0
mov dword [0x4184e0], ecx
cmovae eax, dword [0x4184d0]
mov byte [eax + ecx], 0
jmp 0x4011ef
push ecx
sub ecx, eax
push ecx
call fcn.00401ac0
lea eax, [ebp - 0x80]
push eax
push 0x40
push 0x6f
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp - 0x84], 0x10
lea esi, [ebp - 0x98]
lea edx, [ebp - 0x98]
cmovae esi, dword [ebp - 0x98]
lea eax, [ebp - 0x7c]
cmovae edx, dword [ebp - 0x98]
push esi
push dword [ebp - 0x88]
push edx
call eax
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push 0x6f
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
push 0x3e8
call esi
jmp 0x401250

Function at 0x40990e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004095ce
Function at 0x1002fed6
Capabilities:
Copy file

Disassembly:
push 0x724
mov eax, 0x1005f727
call fcn.1004555b
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 8
mov edi, dword [ebp + 8]
mov dword [ebp - 0x72c], edi
mov dword [ebp - 0x728], esi
jb 0x1002ff01
mov eax, dword [esi]
jmp 0x1002ff03
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x1002ff0d
mov ecx, dword [edi]
jmp 0x1002ff0f
mov ecx, edi
xor edx, edx
cmp byte [ebp + 0x10], dl
sete dl
push edx
push eax
push ecx
mov dword [ebp - 0x730], edx
call dword [sym.imp.kernel32.dll_CopyFileW]
test eax, eax
jne 0x1002ffd7
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
call ebx
cmp eax, 5
jne 0x1002ffa0
and dword [ebp - 4], 0
push 1
push 0x80
push esi
call fcn.100469e0
cmp dword [esi + 0x14], 8
jb 0x1002ff56
mov ecx, dword [esi]
jmp 0x1002ff58
mov ecx, esi
cmp dword [edi + 0x14], 8
jb 0x1002ff62
mov eax, dword [edi]
jmp 0x1002ff64
mov eax, edi
push dword [ebp - 0x730]
push ecx
push eax
call dword [sym.imp.kernel32.dll_CopyFileW]
test eax, eax
jne 0x1002ffd7
or dword [ebp - 4], 0xffffffff
jmp 0x1002ffa0
push esi
push edi
push 0x10003e08
call ebx
push eax
push 0xf
lea ecx, [ebp - 0x724]
call fcn.100469e0
mov esi, eax
push 0x100629b4
lea eax, [ebp - 0x39c]
mov ecx, 0xe2
lea edi, [ebp - 0x39c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.100469e0
call fcn.100455b4
ret 0xc