joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41073e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004105b4

Function at 0x414780
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004142d3

Function at 0x10544058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.105441a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1054407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1054406a
add dl, dl
jne 0x10544089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x105440dc
xor eax, eax
add dl, dl
jne 0x10544096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1054417d
add dl, dl
jne 0x105440a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105440b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105440bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105440c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x105440d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10544075
mov eax, 1
add dl, dl
jne 0x105440ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x105440f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x105440e1
sub eax, ebx
mov ebx, 1
jne 0x10544128
mov ecx, 1
add dl, dl
jne 0x1054410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10544119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10544105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10544075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1054413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1054414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10544136
cmp eax, 0x7d00
jae 0x1054416d
cmp eax, 0x500
jb 0x10544168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10544075
cmp eax, 0x7f
ja 0x10544170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10544075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1054419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10544075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40102b
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0x1505
jmp 0x40104f
mov eax, dword [ebp - 4]
shl eax, 5
mov edx, eax
mov eax, dword [ebp - 4]
add edx, eax
mov eax, dword [ebp - 8]
add eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
movzx eax, byte [eax]
movsx eax, al
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40103a
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4010fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x78]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
jmp 0x4011af
mov eax, dword [ebp - 8]
lea edx, [eax*4]
mov eax, dword [ebp - 0x20]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [esp], eax
call fcn.0040102b
cmp dword [ebp + 0xc], eax
jne 0x4011ab
mov eax, dword [ebp - 8]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x24]
add eax, edx
movzx eax, word [eax]
movzx eax, ax
lea edx, [eax*4]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x4011ba
add dword [ebp - 8], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
cmp dword [ebp - 8], eax
jb 0x401164
cmp dword [ebp - 4], 0
je 0x4011d6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
jmp 0x4011d9
mov eax, dword [ebp - 4]
leave
ret
Function at 0x401215
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 4], 0
jmp 0x40124b
mov eax, dword [ebp - 4]
mov ecx, eax
lea edx, [ebp - 0x11e]
mov eax, dword [ebp - 4]
add eax, edx
mov byte [eax], cl
add dword [ebp - 4], 1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jl 0x401235
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
jmp 0x4012d1
lea edx, [ebp - 0x11e]
mov eax, dword [ebp - 8]
add eax, edx
movzx eax, byte [eax]
movzx edx, al
mov eax, dword [ebp - 0xc]
lea ecx, [edx + eax]
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0x14]
mov eax, edx
mov edx, eax
mov eax, dword [ebp + 0x14]
add eax, edx
movzx eax, byte [eax]
movzx eax, al
add eax, ecx
cdq
idiv dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x11e]
mov dword [esp + 8], eax
mov eax, dword [ebp - 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x11e]
mov dword [esp], eax
call fcn.004011db
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jl 0x401271
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp 0x40139e
mov eax, dword [ebp - 8]
add eax, 1
cdq
idiv dword [ebp - 0x18]
mov dword [ebp - 8], edx
lea edx, [ebp - 0x11e]
mov eax, dword [ebp - 8]
add eax, edx
movzx eax, byte [eax]
movzx edx, al
mov eax, dword [ebp - 0xc]
add eax, edx
cdq
idiv dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x11e]
mov dword [esp + 8], eax
mov eax, dword [ebp - 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x11e]
mov dword [esp], eax
call fcn.004011db
lea edx, [ebp - 0x11e]
mov eax, dword [ebp - 8]
add eax, edx
movzx eax, byte [eax]
movzx edx, al
lea ecx, [ebp - 0x11e]
mov eax, dword [ebp - 0xc]
add eax, ecx
movzx eax, byte [eax]
movzx eax, al
add eax, edx
cdq
idiv dword [ebp - 0x18]
mov eax, edx
mov byte [ebp - 0x1d], al
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, edx
movzx edx, byte [eax]
movzx eax, byte [ebp - 0x1d]
movzx eax, byte [ebp + eax - 0x11e]
xor eax, edx
mov byte [ebp - 0x1e], al
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add edx, eax
movzx eax, byte [ebp - 0x1e]
mov byte [edx], al
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
jl 0x4012f3
nop
nop
leave
ret
Function at 0x40140c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0x30
mov eax, dword [ebp - 0x10]
mov eax, dword fs:[eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 2]
test al, al
je 0x401441
mov dword [esp], 1
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov byte [0x6297aa], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
call eax
sub esp, 0x14
test eax, eax
je 0x40148b
mov dword [esp], 2
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov byte [0x6297aa], 0
mov dword [esp + 4], 0x400
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalFlags]
call eax
sub esp, 4
cmp eax, 0x8000
jne 0x4014cd
mov dword [esp], 3
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov byte [0x6297aa], 0
nop
leave
ret 0xc
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x4018c4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401903
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401903
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401903
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401903
cmp dword [ecx + 0x74], 0xe
jbe 0x401903
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x27620227
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x42f3f8
nop
mov ecx, 0x1564770e
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4a270c7a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2f377b1d
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x432001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
mov ecx, 0x4ecb5243
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x6d56632a
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x12b412d6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x574e110f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4015f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.004023a0
add esp, 4
mov ecx, eax
jmp 0x403440
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4033c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x44a03c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 8], 0xfffffffe
jne 0x403429
push 0x13
xor eax, eax
mov dword [ebp - 0xc], 0
push str.https:__wxgsoft.com
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
call fcn.00407e30
cmp dword [ebp - 0xc], 0
je 0x403421
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 0xa
cmovae eax, dword [ebp - 0x1c]
push 0
push 0
push eax
push 0x43b3dc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
call fcn.00402c20
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0040ed5f
mov esp, ebp
pop ebp
ret 8
Function at 0x406cf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4395e8
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x44a03c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
jne 0x406d30
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00405700
mov ecx, eax
test ecx, ecx
je 0x406db5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x406d55
mov esi, dword [esi]
push esi
lea eax, [ebp + 8]
push str._select___s_
push eax
call fcn.00404e30
mov esi, dword [ebp + 8]
add esp, 0xc
push 0xa
push 0
push esi
push str.explorer.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
mov dword [ebp - 4], 0xffffffff
setne bl
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x406da2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403bf0
int3

Function at 0x406f60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x406fb9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406fb9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x406faa
cmp esi, edx
jae 0x406fb9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x406f98
cmp esi, edx
jae 0x406fb9
cmp word [esi], 0
je 0x406fb9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40a0f0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x44a03c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40a139
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken___failed__Error___d_SeDebugPrivilege_is_not_available._n
call fcn.0040c640
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ed5f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x40a15c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LookupPrivilegeValue___failed__Error___d_SeDebugPrivilege_is_not_available._n
jmp 0x40a19b
mov eax, dword [ebp - 0x20]
push 0
push 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40a1a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AdjustTokenPrivileges___failed__Error___d_SeDebugPrivilege_is_not_available._n
call fcn.0040c640
add esp, 8
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040ed5f
mov esp, ebp
pop ebp
ret