joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5507e1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00550978
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x550950
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x550950
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x550905
jg 0x55083d
test eax, eax
je 0x5508fb
push 1
push 0x1000
call fcn.004fa0db
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x550860
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5508f2
push 0x8000
push ebx
call fcn.005506db
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x550889
jg 0x550884
cmp ecx, 0x1000
jb 0x550889
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00547eb8
add esp, 0x10
cmp eax, 0xffffffff
je 0x5508ce
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x550884
jl 0x5508b5
test ecx, ecx
jne 0x550876
push dword [ebp - 0xc]
push ebx
call fcn.005506db
push esi
call fcn.004fa138
add esp, 0xc
xor ebx, ebx
jmp 0x55095e
cmp byte [edi + 0x24], 0
je 0x5508e5
cmp dword [edi + 0x20], 5
jne 0x5508e5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5508f0
mov ebx, dword [edi + 0x18]
jmp 0x5508f2
xor ebx, ebx
push esi
call fcn.004fa138
pop ecx
jmp 0x55095e
test ecx, ecx
jg 0x5508c7
jl 0x550905
test eax, eax
jae 0x5508c7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00525c4d
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x550925
cmp byte [edi + 0x1c], 0
je 0x5508c7
jmp 0x550956
push ebx
call fcn.0052c43d
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x5508c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x55095e
cmp byte [edi + 0x1c], 0
je 0x55095b
mov ebx, dword [edi + 0x18]
jmp 0x55095e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00525c4d
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4032f0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x460c2c]
mov ecx, dword [0x4606bc]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403369
mov edi, dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
mov esi, ecx
mov dword [ebp - 4], eax
cmp dword [0x460c2c], 0x959
jne 0x40335a
push 0
push 0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push esi
call fcn.004030b0
add esi, 8
sub dword [ebp - 4], 1
jne 0x40331a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408710
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4585b8]
jne 0x40871a
repz ret
jmp fcn.0040cf1b

Function at 0x40cc3e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004095f1
and dword [ebp - 4], 0
cmp dword [0x45e670], 0
mov ebx, eax
jne 0x40ccef
push 0x401b68
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40cda0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b5c
push edi
call esi
test eax, eax
je 0x40cda0
push eax
call fcn.0040957f
mov dword [esp], 0x401b4c
push edi
mov dword [0x45e670], eax
call esi
push eax
call fcn.0040957f
mov dword [esp], 0x401b38
push edi
mov dword [0x45e674], eax
call esi
push eax
call fcn.0040957f
mov dword [esp], 0x401b1c
push edi
mov dword [0x45e678], eax
call esi
push eax
call fcn.0040957f
pop ecx
mov dword [0x45e680], eax
test eax, eax
je 0x40ccef
push 0x401b04
push edi
call esi
push eax
call fcn.0040957f
pop ecx
mov dword [0x45e67c], eax
mov eax, dword [0x45e67c]
cmp eax, ebx
je 0x40cd47
cmp dword [0x45e680], ebx
je 0x40cd47
push eax
call fcn.004095fa
push dword [0x45e680]
mov esi, eax
call fcn.004095fa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40cd47
test edi, edi
je 0x40cd47
call esi
test eax, eax
je 0x40cd3e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40cd3e
test byte [ebp - 0xc], 1
jne 0x40cd47
or dword [ebp + 0x10], 0x200000
jmp 0x40cd80
mov eax, dword [0x45e674]
cmp eax, ebx
je 0x40cd80
push eax
call fcn.004095fa
pop ecx
test eax, eax
je 0x40cd80
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40cd80
mov eax, dword [0x45e678]
cmp eax, ebx
je 0x40cd80
push eax
call fcn.004095fa
pop ecx
test eax, eax
je 0x40cd80
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45e670]
call fcn.004095fa
pop ecx
test eax, eax
je 0x40cda0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40cda2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cb854
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, ebx
call fcn.00403fa4
mov eax, dword [ebp - 4]
add eax, 0x10
mov edx, esi
call fcn.00403fa4
mov eax, dword [ebp - 4]
add eax, 0x14
mov edx, dword [ebp + 0x18]
call fcn.00403fa4
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 4]
add eax, 0x20
xor edx, edx
call fcn.00405514
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004879ec
xor eax, eax
push ebp
push 0x4cb913
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 1
xor ebx, ebx
jmp 0x4cb8d4
inc ebx
push 0xa
call sub.KERNEL32.DLL_Sleep
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 0
je 0x4cb8e5
cmp ebx, 0x1770
jl 0x4cb8cc
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb91a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004879f4
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
add edx, 0x20
call fcn.00404efc
ret

Function at 0x4ce86c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4ce92f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402db0
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], si
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, edi
call fcn.00404394
mov ebx, eax
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x4ce90c
cmp byte [ebp - 1], 0
je 0x4ce904
push 0
mov eax, dword [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
jne 0x4ce8ee
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4ce921
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 8], eax
jmp 0x4ce921
push esi
push 0
push 0
push ebx
push 0x4ce940
push 0
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce936
ret
Function at 0x4cebe0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push esi
push edi
push eax
push edx
mov eax, dword [eax]
mov edx, dword [edx]
mov ebx, 0
mov esi, 0
mov edi, dword [0x506c94]
shl edi, 2
xor edx, dword [esi + 0x505c0c]
ror edx, 0x10
mov bl, dh
mov ecx, dword [ebx*4 + 0x505c94]
mov bl, dl
add ecx, dword [ebx*4 + 0x506094]
rol edx, 0x10
mov bl, dh
xor ecx, dword [ebx*4 + 0x506494]
mov bl, dl
add ecx, dword [ebx*4 + 0x506894]
xor eax, ecx
xchg edx, eax
add esi, 4
cmp esi, edi
jne 0x4cebfd
xchg edx, eax
xor eax, dword [esi + 0x505c0c]
xor edx, dword [esi + 0x505c10]
mov ebx, edx
pop edx
mov dword [edx], ebx
mov ebx, eax
pop eax
mov dword [eax], ebx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x4cec54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push esi
push eax
push edx
mov eax, dword [eax]
mov edx, dword [edx]
mov ebx, 0
mov esi, dword [0x506c94]
inc esi
shl esi, 2
xor edx, dword [esi + 0x505c0c]
ror edx, 0x10
mov bl, dh
mov ecx, dword [ebx*4 + 0x505c94]
mov bl, dl
add ecx, dword [ebx*4 + 0x506094]
rol edx, 0x10
mov bl, dh
xor ecx, dword [ebx*4 + 0x506494]
mov bl, dl
add ecx, dword [ebx*4 + 0x506894]
xor eax, ecx
xchg edx, eax
sub esi, 4
cmp esi, 4
jne 0x4cec6c
xchg edx, eax
xor eax, dword [0x505c10]
xor edx, dword [0x505c0c]
mov ebx, edx
pop edx
mov dword [edx], ebx
mov ebx, eax
pop eax
mov dword [eax], ebx
pop esi
pop ecx
pop ebx
ret
Function at 0x4e0904
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4e0932
mov eax, ebx
call fcn.004e13a8
cmp dword [ebx + 0x3c], 0
je 0x4e092b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4e09a3
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4e0995
cmp dword [ebx + 8], 0
je 0x4e0954
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4e0966
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4e0995
cmp dword [ebx + 8], 0
je 0x4e0947
cmp eax, 3
je 0x4e0979
dec eax
jne 0x4e0947
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4e0947
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4e0947
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4e09c1
cmp dword [ebx + 0x10], 0xcc
je 0x4e09c1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004e09cc
pop ebx
ret

Function at 0x4f1474
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404384
mov eax, dword [ebp - 8]
call fcn.00404384
xor eax, eax
push ebp
push 0x4f153f
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, dword [ebp - 8]
call fcn.00404394
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x4f154c
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404394
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1546
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403f74
ret
Function at 0x4f1554
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404384
mov eax, dword [ebp - 8]
call fcn.00404384
mov eax, dword [ebp - 0xc]
call fcn.00404384
mov eax, dword [ebp + 0xc]
call fcn.00404384
xor eax, eax
push ebp
push 0x4f1661
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x14
mov dword [ebp - 0x20], 0x14
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x38], 2
mov eax, dword [ebp - 8]
call fcn.00404394
mov edi, eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 3
mov eax, 0x4f1674
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404394
push eax
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00404394
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404394
push eax
mov ax, word [ebp + 8]
push eax
push edi
push ebx
call sub.wininet.dll_InternetConnectA
push esi
lea eax, [ebp - 0x20]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1668
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403f74
lea eax, [ebp + 0xc]
call fcn.00403f50
ret

Function at 0x4f2ce0
Capabilities:
Create http request

Disassembly:
push ebx
push esi
add esp, 0xffffffc8
mov esi, 0x14
mov dword [esp], 0x14
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 3
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 2
mov eax, 0x4f2d74
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 3
mov eax, 0x4f2d78
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], eax
push 0
push 0
push 0
push 1
push 0x4f2d74
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push esi
lea eax, [esp + 4]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
add esp, 0x38
pop esi
pop ebx
ret
Function at 0x4f2d3f
Capabilities:
Create http request

Disassembly:
push ebx
push esi
add esp, 0xffffffc8
mov esi, 0x14
mov dword [esp], 0x14
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 3
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 3
mov dword [esp + 0x20], 2
mov eax, 0x4f2d74
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 3
mov eax, 0x4f2d78
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], eax
push 0
push 0
push 0
push 1
push 0x4f2d74
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push esi
lea eax, [esp + 4]
push eax
push 0x4b
push ebx
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
push ebx
call sub.wininet.dll_InternetSetOptionA
push ebx
call sub.wininet.dll_InternetCloseHandle
add esp, 0x38
pop esi
pop ebx
ret

Function at 0x4f2ec8
Capabilities:
Get geographical location

Disassembly:
add esp, 0xfffffff4
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.00402db0
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
cmp byte [esp], 0x31
jne 0x4f2ef6
mov al, 1
jmp 0x4f2ef8
xor eax, eax
add esp, 0xc
ret

Function at 0x4f2ee0
Capabilities:
Get geographical location

Disassembly:
add esp, 0xfffffff4
mov eax, esp
xor ecx, ecx
mov edx, 0xa
call fcn.00402db0
push 0xa
lea eax, [esp + 4]
push eax
push 0xd
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
cmp byte [esp], 0x31
jne 0x4f2ef6
mov al, 1
jmp 0x4f2ef8
xor eax, eax
add esp, 0xc
ret
Function at 0x4f9d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404384
xor eax, eax
push ebp
push 0x4f9e78
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00409d30
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00403fe8
mov eax, dword [ebp - 4]
call fcn.004041d0
test al, 1
je 0x4f9d95
mov eax, esi
mov edx, 0x4f9e90
call fcn.00403fa4
jmp 0x4f9e48
mov eax, esi
call fcn.00403f50
mov edi, 1
jmp 0x4f9e14
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x18]
call fcn.00402c70
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov cl, 2
call fcn.00402c40
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.00404174
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4f9ea0
call fcn.0040421c
mov eax, dword [ebp - 0x24]
call fcn.0040a1dc
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.004040f8
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.004041d8
add edi, 2
mov eax, dword [ebp - 4]
call fcn.004041d0
cmp edi, eax
jle 0x4f9da3
mov bl, 0x78
mov eax, dword [esi]
call fcn.004041d0
test eax, eax
jle 0x4f9e48
mov edi, 1
mov edx, dword [esi]
mov dl, byte [edx + edi - 1]
mov byte [ebp - 5], dl
mov edx, dword [esi]
xor byte [edx + edi - 1], bl
mov bl, byte [ebp - 5]
inc edi
dec eax
jne 0x4f9e32
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9e7f
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403f74
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403f74
lea eax, [ebp - 4]
call fcn.00403f50
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0xad179a8
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x32827854
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x40894a
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
call fcn.0040896d
mov edx, 0x9d4bf559
xor dword [edi], ebx
and edx, edx
add eax, 0xb54555f8
inc edi
cmp edi, ecx
jne fcn.0040894a
or edx, eax
ret

Function at 0x438ca2
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
sub ecx, 1
sub ecx, ecx
dec ecx
call fcn.00438ceb
inc edx
and edx, edx
add ecx, 0x688c32ad
xor dword [eax], esi
and ecx, ecx
sub ecx, 1
inc eax
sub edx, 1
mov edx, 0xe44b2096
sub edx, 0x62810355
cmp eax, edi
jne fcn.00438ca2
sub edx, ecx
add edx, edx
sub ecx, edx
ret

Function at 0x40895c
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
add ecx, ecx
call fcn.00408974
or ecx, ebx
xor dword [eax], edi
mov ebx, ebx
inc eax
cmp eax, esi
jne fcn.0040895c
ret
Function at 0x10001070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
jmp 0x1000113c
lea eax, [ebp - 0x104]
push eax
call fcn.100012e8
push 0x1000107e
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_LoadLibraryA
test eax, eax
jne 0x10001209
lea eax, [ebp - 0x108]
push eax
push 0x20019
push 0
push 0x1000109d
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
cmp eax, 0
jne 0x1000126e
mov dword [ebp - 0x10c], 0x103
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x100010b7
push dword [ebp - 0x108]
call sub.ADVAPI32.DLL_RegQueryValueExA
push eax
push dword [ebp - 0x108]
call sub.ADVAPI32.DLL_RegCloseKey
pop eax
cmp eax, 0
jne 0x1000126e
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x100011ee
mov word [ebx], 0x5c
push 0x10001088
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_LoadLibraryA
test eax, eax
je 0x1000126e
mov dword [0x1000300c], eax
push 0x10001092
push eax
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x10001263
push eax
push 0x3ea
call eax
pop edx
test eax, eax
je 0x10001263
mov dword [fcn.10003008], eax
push 0x3eb
mov ebx, 0x10003000
call edx
test eax, eax
je 0x10001263
mov dword [0x10003000], edx
call 0x1000124a
add dword [esp], 0x3db6
call eax
mov dword [fcn.10003004], eax
sub esp, 4
pop dword [0x10003010]
leave
ret
push dword [0x1000300c]
call sub.KERNEL32.DLL_FreeLibrary
mov dword [0x1000300c], 0
mov dword [0x10003000], 0xffffffff
mov dword [0x10003010], 0
mov dword [fcn.10003004], 0
mov dword [fcn.10003008], 0
push 0x10
push 0x10001136
push 0x100010bc
push 0
call sub.USER32.DLL_MessageBoxA
push 0xffffffffffffffff
call sub.KERNEL32.DLL_ExitProcess
leave
ret

Function at 0x1000d50a
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.1000d589
jae 0x1000d516
xor ecx, ecx
call fcn.1000d589
jae 0x1000d540
xor eax, eax
call fcn.1000d589
jae 0x1000d551
mov al, 0x10
call fcn.1000d589
adc al, al
jae 0x1000d532
jne 0x1000d57e
stosb byte es:[edi], al
jmp 0x1000d517
call fcn.1000d595
dec ecx
loop 0x1000d55d
mov eax, ebp
call fcn.1000d593
jmp 0x1000d57f
lodsb al, byte [esi]
shr eax, 1
je 0x1000d5a5
adc ecx, 2
mov ebp, eax
jmp 0x1000d57f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.1000d593
cmp eax, 0x7d00
jae 0x1000d57d
cmp eax, 0x500
jae 0x1000d57e
cmp eax, 0x7f
ja 0x1000d57f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1000d517
pop ebp
ret 8