joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014f60
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1006c798
push 0x1004c950
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x10072414]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
pushal
pushfd
xor ebx, ebx
mov ecx, 0xa
mov eax, 0x564d5868
mov dx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete al
movzx eax, al
mov dword [ebp - 0x1c], eax
popfd
popal
mov dword [ebp - 4], 0xfffffffe
jmp 0x10014fe5
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10015000
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1006c778
push 0x1004c950
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x10072414]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
pushal
mov ebx, 0
mov eax, 1
invalid
Function at 0x100151c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x10072414]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x100151f3
xor eax, eax
jmp 0x10015342
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x10015333
mov edx, dword [ebp + 8]
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x244]
add eax, 2
mov dword [ebp - 0x248], eax
mov ecx, dword [ebp - 0x244]
mov dx, word [ecx]
mov word [ebp - 0x24a], dx
add dword [ebp - 0x244], 2
cmp word [ebp - 0x24a], 0
jne 0x1001523c
mov eax, dword [ebp - 0x244]
sub eax, dword [ebp - 0x248]
sar eax, 1
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x104
jae 0x100152d8
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x254], ecx
mov edx, dword [ebp - 0x254]
add edx, 2
mov dword [ebp - 0x258], edx
mov eax, dword [ebp - 0x254]
mov cx, word [eax]
mov word [ebp - 0x25a], cx
add dword [ebp - 0x254], 2
cmp word [ebp - 0x25a], 0
jne 0x10015295
mov edx, dword [ebp - 0x254]
sub edx, dword [ebp - 0x258]
sar edx, 1
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x264], eax
jmp 0x100152e2
mov dword [ebp - 0x264], 0x104
mov ecx, dword [ebp - 0x264]
push ecx
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10044e1c
add esp, 0xc
test eax, eax
jne 0x10015314
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x10015342
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x240], eax
jmp 0x10015217
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10042ec5
mov esp, ebp
pop ebp
ret

Function at 0x10016850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f1ce
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10072414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
call fcn.10017340
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x3c]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x3c]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x10], 0
push 0x10064588
mov ecx, dword [ebp - 0x3c]
add ecx, 0x14
call fcn.10003a9f
mov byte [ebp - 4], 1
push 0x10064588
mov ecx, dword [ebp - 0x3c]
add ecx, 0x30
call fcn.10003a9f
mov byte [ebp - 4], 2
push 0x10064588
mov ecx, dword [ebp - 0x3c]
add ecx, 0x4c
call fcn.10003a9f
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10018c40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e8de
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10072414]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x14
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.100161c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
add ecx, 0x30
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.100161c0
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
add edx, 0x4c
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.100161c0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001f5c0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10072414]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
cmp dword [eax], 0
je 0x1001f5ed
mov ecx, dword [ebp - 0x60]
cmp dword [ecx + 4], 0
je 0x1001f5ed
mov edx, dword [ebp - 0x60]
cmp dword [edx + 8], 0
jne 0x1001f5f4
xor eax, eax
jmp 0x1001f6c0
cmp dword [ebp + 8], 0
jne 0x1001f601
xor eax, eax
jmp 0x1001f6c0
xor eax, eax
mov word [ebp - 0x50], ax
push 0x40
push 0
lea ecx, [ebp - 0x4e]
push ecx
call fcn.100464a0
add esp, 0xc
mov dword [ebp - 4], 0x20
push 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x50]
push eax
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x1001f641
xor eax, eax
jmp 0x1001f6c0
lea edx, [ebp - 0x50]
push edx
call fcn.100434a2
add esp, 4
mov dword [ebp - 0x54], eax
cmp dword [ebp + 0xc], 0
jne 0x1001f65d
mov eax, 1
jmp 0x1001f6c0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x54]
jae 0x1001f673
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x54]
mov dword [edx], eax
xor eax, eax
jmp 0x1001f6c0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.100464a0
add esp, 0xc
mov dword [ebp - 0x5c], 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x1001f6b7
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
cmp eax, dword [ebp - 0x54]
je 0x1001f6bb
xor eax, eax
jmp 0x1001f6c0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10042ec5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10021ff0
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f0c8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10072414]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x38]
call fcn.10022290
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10022041
mov dword [ebp - 0x34], 0x800000
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x10022052
mov dword [ebp - 0x5c], str.wup.browser.qq.com
jmp 0x10022059
mov dword [ebp - 0x5c], str.qbwup.imtt.qq.com
mov edx, dword [ebp - 0x5c]
push edx
lea esi, [ebp - 0x30]
call fcn.1000bc8f
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x16b
add eax, 0x50
mov word [ebp - 0x10], ax
push 0
push 0
push 3
push 0
push 0
movzx ecx, word [ebp - 0x10]
push ecx
lea eax, [ebp - 0x30]
call fcn.10003966
push eax
mov edx, dword [ebp - 0x58]
mov eax, dword [edx + 0x118]
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
push eax
lea ecx, [ebp - 0x38]
call fcn.100222d0
lea ecx, [ebp - 0x38]
call fcn.1001cf40
test eax, eax
jne 0x100220d9
mov byte [ebp - 0x3d], 0
lea esi, [ebp - 0x30]
call fcn.100039c2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100222b0
mov al, byte [ebp - 0x3d]
jmp 0x1002219d
push 0
mov ecx, dword [ebp - 0x34]
push ecx
push 0
push 0
push 0x10068e8c
push 0
push 0x10068ea0
lea ecx, [ebp - 0x38]
call fcn.1001cf40
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x10022127
mov byte [ebp - 0x3e], 0
lea esi, [ebp - 0x30]
call fcn.100039c2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100222b0
mov al, byte [ebp - 0x3e]
jmp 0x1002219d
mov ecx, dword [ebp + 8]
call fcn.10003ad1
push eax
mov eax, dword [ebp + 8]
call fcn.100083f4
push eax
push 0
push 0
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x10022175
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [ebp - 0x3f], 0
lea esi, [ebp - 0x30]
call fcn.100039c2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100222b0
mov al, byte [ebp - 0x3f]
jmp 0x1002219d
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [ebp - 0x40], 1
lea esi, [ebp - 0x30]
call fcn.100039c2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100222b0
mov al, byte [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10042ec5
mov esp, ebp
pop ebp
ret 8
Function at 0x10042ec5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10072414]
jne 0x10042ecf
repz ret
jmp fcn.10049232

Function at 0x10056424
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10072414]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1004a255
and dword [ebp - 0x14], 0
cmp dword [0x10075238], 0
mov dword [ebp - 0x18], eax
jne 0x100564d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1005657f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1005657f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10075238], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1007523c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10075240], eax
call edi
push eax
call esi
mov dword [0x10075248], eax
test eax, eax
je 0x100564d7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10075244], eax
mov eax, dword [0x10075244]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10056530
cmp dword [0x10075248], ecx
je 0x10056530
push eax
call esi
push dword [0x10075248]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10056530
test ebx, ebx
je 0x10056530
call edi
test eax, eax
je 0x10056527
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10056527
test byte [ebp - 8], 1
jne 0x10056530
or dword [ebp + 0x10], 0x200000
jmp 0x10056563
mov eax, dword [0x1007523c]
cmp eax, dword [ebp - 0x18]
je 0x10056563
push eax
call esi
test eax, eax
je 0x10056563
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10056563
mov eax, dword [0x10075240]
cmp eax, dword [ebp - 0x18]
je 0x10056563
push eax
call esi
test eax, eax
je 0x10056563
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10075238]
call esi
test eax, eax
je 0x1005657f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10056581
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10042ec5
leave
ret
Function at 0x2ec336a
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov word [esp + 4], bx
lea esp, [esp + 0x18]
je 0x2ec919d
stc
test cl, ah
add eax, edi
pushal
cmp eax, edx
push ebp
pushal
pushfd
call fcn.032d3243
cmp bl, byte [ecx - 0x6ffd789c]
xchg dword fs:[edx], eax
nop
rol byte [edx], 1
aad 0xfd
mov dh, 0xff
xchg edx, eax
outsd dx, dword [esi]
and ebp, dword [esi]
xor cl, byte [esi]
jae 0x2ec338c
sub byte [edi + 0x7e0b22cc], 0x16
daa
test eax, 0xb3e44921
mov al, 0x99
mov gs, word [edi - 0x26b3d98]
out dx, eax
hlt

Function at 0x2ec9660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
clc
bt sp, dx
pushal
cmp edi, ebx
pushfd
pushfd
lea esp, [esp + 0x34]
ja 0x32d4f2e
sal al, 7
test bh, 0x36
sbb al, ah
sub ebx, edi
shl di, cl
movzx di, cl
add ebx, esp
stc
adc al, 0x42
sal al, cl
mov edi, ebx
shr al, cl
mov al, 0x2e
push edx
bt bx, si
mov word [esp], si
clc
repne scasb al, byte es:[edi]
jmp 0x2ebcebe
lea esp, [esp + 4]
jne 0x25ecd74
setno ah
push 0xbb0c5e95
movzx ax, al
mov byte [edi - 1], 0
mov byte [esp], bl
movzx ax, bl
mov dword [esp], ebx
movzx ax, cl
lahf
push 0xca334860
lea eax, [edx - 0x24e28048]
lea eax, [0x32d59d0]
mov dword [esp], edx
pushal
mov dword [esp + 0x20], 0x2ebf161
call fcn.032d8abd
bt ax, di
sub ecx, ebx
push dword [esp]
rcl si, 0xd
not si
cmc
lea esi, [esp + 8]
cmc
cmc
sub edi, 4
push dword [esp + 4]
pushfd
clc
push dword [edi]
pop dword [esp + 0xc]
jmp 0x24d6e53

Function at 0x32d20b9
Capabilities:
Encode data using xor

Disassembly:
sti
sub al, 0xe0
aas
push es
sub dword [ebp + 0x5243af6f], ebp
add al, 0xa0
add ah, bh
xchg edx, eax
add dword [ecx], ebx
sbb ebx, esp
aas
rcl byte [ebx + ecx*2]
cmp esi, edi
insd dword es:[edi], dx
inc ecx
and ebx, esp
inc ebx
or al, 0xa2
pop ebp
mov byte [0x935d336c], al
or eax, 0x135149a2
rcl ah, 0x64
and eax, dword [eax]
add byte [ebx + 0x65], dl
je 0x32d20ee
jne 0x32d2121
imul ebp, dword [esi + 0x65], 0x68507373
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte gs:[ebx - 0x17f3dba4], cl
mov ebx, dword [esp + 0xc]
invalid
mov ebx, dword [esp + 0xc]
call 0x25edd26
fstp xword [ecx]
mov esp, 0x39dbff31
aaa
adc ebp, dword [edx]
xchg ebp, eax
mov esp, 0x1c9076c1
jo 0x32d213d
jno 0x32d214f
inc eax
or al, 0x51
cld
cmp byte [ebp + 0x3f], 0x40
mov ebp, ebp
pop ds
fnstsw word [esi]
dec eax
jbe 0x32d20be
loop 0x32d2075
je 0x32d211f
add dword [esi + 0x7bf234], ebx
inc ebx
mov dh, 0x6e
clc
jae 0x32d20a7
invalid
mov word [edx], gs
lea esi, [0xba161f9a]
or ebx, esi
stosb byte es:[edi], al
sub dword [ecx - 0x6097d140], 0xb7d88b9d
pop ebp
popfd
push edx
and byte [ebp + 0x128d7e62], bh
mov ebp, 0xdd13cd13
popfd
adc ch, ch
inc ebx
popfd
xchg esi, eax
push ecx
adc eax, ecx
or ebp, dword [ecx]
dec edx
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x17183e1f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x56d84215
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4092d0
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0052eb20
mov eax, dword [0x5c2b80]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x409335
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x409335
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.0052dfcb
add eax, 0x40
push eax
call fcn.0052f283
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0052ab62
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.0052f1bc
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4093c4
call fcn.00409190
test eax, eax
jle 0x4093c4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0052ab62
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0052ab62
add esp, 0x108
ret

Function at 0x409420
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x409444
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x409436
pop esi
movzx eax, cl
pop edi
ret

Function at 0x410830
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x410877
mov al, byte [edx]
test al, al
je 0x410877
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x410847
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x413ae0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.0052eb20
mov eax, dword [0x5c2b80]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x30]
dec ebp
lea edx, [ebp - 0x29]
cmp ebx, edx
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
jle 0x413b45
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.00405740
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0052ab62
add esp, 0x20
ret
cmp ebp, 0x29
jge 0x413b73
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.00405740
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0052ab62
add esp, 0x20
ret
push esi
mov byte [edi], 0
lea esi, [edi + 1]
push 0
add edi, 0x15
call fcn.00420c60
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x50]
push 0
push edi
push eax
push ecx
call fcn.00427fe0
mov edx, ebp
sub edx, ebx
sub edx, 0x29
push edx
lea eax, [edi + 0x14]
push 0
push eax
call fcn.0052ebd0
mov edx, dword [esp + 0x34]
mov ecx, edi
sub ecx, ebx
lea eax, [ecx + ebp]
push ebx
mov byte [eax - 0x15], 1
push edx
add eax, 0xffffffec
push eax
call fcn.0052e420
push 0x14
push esi
call fcn.0040b350
add esp, 0x38
test eax, eax
jle 0x413c05
push 0x48
add ebp, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebp
call fcn.00408010
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x413c1a
push 0x4b
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.00405740
add esp, 0x14
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0052ab62
add esp, 0x20
ret
call fcn.00420c60
push eax
push 0x14
push esi
push ebp
push ebx
call fcn.00413960
add esp, 0x14
test eax, eax
jl 0x413c05
test ebp, ebp
jle 0x413c4b
mov ecx, ebx
mov eax, edi
sub ecx, edi
mov edx, ebp
lea ecx, [ecx]
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
sub edx, 1
jne 0x413c40
call fcn.00420c60
push eax
push ebp
push edi
lea eax, [esp + 0x24]
push 0x14
push eax
call fcn.00413960
add esp, 0x14
test eax, eax
jl 0x413c05
lea ecx, [esp + 0x18]
lea edi, [esp + 0x19]
lea ebp, [esp + 0x1a]
lea edx, [esp + 0x1b]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x1c]
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
nop
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
sub esi, 1
jne 0x413c90
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004081b0
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [esi + 1]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0052ab62
add esp, 0x20
ret
Function at 0x4142d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x41439c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4142f1
cmp al, 0x6b
jne 0x41439c
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x41435d
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x414311
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x414311
cmp al, 0xbb
jne 0x41433a
inc ecx
cmp ecx, esi
jl 0x414301
sub esi, ecx
test ecx, ecx
jne 0x414360
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00405740
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00405740
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x414389
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00405740
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.0052e420
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00405740
add esp, 0x14
or eax, 0xffffffff
pop esi
ret