joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bdd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4811ab
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push ebx
push esi
push edi
mov eax, dword [0x4a6134]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ecx + 0x2002c]
push eax
push 0
push 0x20000
lea eax, [ecx + 0x14]
push eax
push dword [ecx + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42bef1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x3e5
je 0x42bef1
call fcn.00425f50
push 1
mov ecx, eax
mov edx, dword [eax]
mov edx, dword [edx + 8]
call edx
movzx eax, al
sub eax, 1
jne 0x42bef1
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonlds_rpclds_rpc_src_rpc_instance_rpc_client_instance.cpp
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], al
call fcn.00402fa0
push 3
push 0x4878e8
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.00402fa0
mov byte [ebp - 4], 1
call fcn.00425f50
mov edi, eax
lea ecx, [ebp - 0xd4]
push 0x6a
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00404c30
mov esi, eax
push str.WaitPublish_falied__error_code_:
push esi
mov byte [ebp - 4], 2
call fcn.004060c0
add esp, 8
mov ecx, esi
push ebx
call fcn.00405f60
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xd4]
call fcn.004063e0
lea ecx, [ebp - 0x24]
call fcn.004028c0
lea ecx, [ebp - 0x3c]
call fcn.004028c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fdd2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4452a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00444ee0
Function at 0x4464d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484eb3
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x4a6134]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x80], 0
mov dword [edi], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x7c], 0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004295f0
mov eax, dword [ebp - 0x80]
add esp, 8
test eax, eax
je 0x4466e3
mov esi, dword [sym.imp.OLEAUT32.dll_VariantInit]
push eax
call esi
test eax, eax
je 0x4466e3
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x4466e3
push eax
call esi
test eax, eax
je 0x4466e3
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
push 0x201
push dword [ebp - 0x80]
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
push SysReAllocStringLen
call fcn.00428d50
mov esi, dword [ebp - 0x90]
test eax, eax
jne 0x4466d4
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00459240
add esp, 0xc
mov dword [ebp - 0x78], 0x64
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push dword [ebp - 0x7c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4466d4
mov eax, dword [ebp - 0x84]
cmp eax, 1
je 0x4465fb
cmp eax, 2
jne 0x4466d4
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x44661c
test cl, 1
jne 0x4466d4
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x76], 0
je 0x446622
jmp 0x4466d4
xor eax, eax
mov word [ebp - 0x74], ax
shr ecx, 1
cmp ecx, 0x2d
jne 0x4466d4
lea ecx, [ebp - 0x78]
call fcn.00444950
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x78]
call fcn.00444a20
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0
push eax
lea eax, [ebp - 0x20]
push 0x48d8ac
push eax
call fcn.00446ae0
push 0x2a
push dword [ebp - 0x78]
call fcn.00444ee0
movzx eax, al
add esp, 0x14
cmp dword [ebp - 0x84], eax
jne 0x4466cc
lea edx, [ebp - 0x74]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x446682
sub edx, ecx
lea eax, [ebp - 0x74]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.004447a0
push dword [0x4a620c]
lea eax, [ebp - 0x74]
push dword [0x4a6208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x4466bd
mov dword [edi], 1
lea ecx, [ebp - 0x78]
call fcn.00401470
mov edi, 1
jmp 0x4466d6
lea ecx, [ebp - 0x78]
call fcn.00401470
xor edi, edi
test esi, esi
je 0x4466e5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4466e5
xor edi, edi
push dword [ebp - 0x7c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp - 0x80]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00429b0b
mov esp, ebp
pop ebp
ret
Function at 0x446720
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x446735
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x446740
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4498f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x449961
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x44992f
cmp eax, 2
jne 0x44994b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x44995b
test ecx, ecx
je 0x449956
test cl, 1
jne 0x44994b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x44995b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x475abb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00475938

Function at 0x476084
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x4af8f0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4760c5
cmp byte [edx], 0xa
jne 0x4760c5
or byte [eax + edi + 0x28], 4
jmp 0x4760ca
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x4761bb
mov al, byte [ebx]
cmp al, 0x1a
je 0x47619c
cmp al, 0xd
je 0x4760f3
mov byte [esi], al
inc esi
inc ebx
jmp 0x476191
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x476113
cmp byte [eax], 0xa
jne 0x476108
push 2
mov byte [esi], 0xa
pop eax
jmp 0x47610e
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x476191
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47618a
cmp dword [ebp - 0x14], 0
je 0x47618a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4af8f0]
test byte [eax + edi + 0x28], 0x48
je 0x476161
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x476151
mov byte [esi], dl
jmp 0x47618d
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4af8f0]
mov byte [eax + edi + 0x2a], dl
jmp 0x47618d
cmp byte [ebp - 1], 0xa
jne 0x476173
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x476173
mov byte [esi], 0xa
jmp 0x476110
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00466a2e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x47618e
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x4760dc
jmp 0x4761bb
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4af8f0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4761b6
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4761bb
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4761c6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x4af8f0]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x47620a
cmp word [edx], bx
jne 0x47620a
or byte [edi + eax + 0x28], 4
jmp 0x47620f
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x476363
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x476343
cmp ax, word [ebp - 0x10]
je 0x476248
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x476338
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x47626e
push 0xa
pop ecx
cmp word [eax], cx
jne 0x47625e
push ecx
pop eax
push 4
jmp 0x476263
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x476332
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x476329
cmp dword [ebp - 0x18], 0
je 0x476329
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x4af8f0]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x4762f5
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x4762b9
mov word [esi], ax
jmp 0x4762ed
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x4af8f0]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x4af8f0]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x4af8f0]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x476338
cmp word [ebp - 4], ax
jne 0x47630a
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x47630a
mov word [esi], ax
add esi, 2
jmp 0x476338
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00466a2e
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x476335
jmp 0x47632c
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x476228
jmp 0x476363
mov ecx, dword [ecx*4 + 0x4af8f0]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x47635a
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x476363
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4790bf
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00478d61

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2a2d50af
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x11d12e26
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
mov ecx, 0x3a686964
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x675c0d60
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001016
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
push edi
push 0x10003010
push 0x65
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10001061
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x10001065
xor eax, eax
jmp 0x100010a7
push ebx
mov ebx, dword [esi]
push 0
push 4
push 2
push 0
push 2
push 0x40000000
push 0x10003038
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100010a3
lea eax, [esp + 0xc]
push 0
push eax
add esi, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x100010ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
xor edx, edx
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], edx
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push 0x8000000
push edx
push edx
push edx
push 0x10003038
push edx
mov word [ebp - 0x24], dx
mov dword [ebp - 0x28], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x10001110
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x10]
call esi
pop esi
xor eax, eax
leave
ret

Function at 0x74cbe7
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0074cc66
jae 0x74cbf3
xor ecx, ecx
call fcn.0074cc66
jae 0x74cc1d
xor eax, eax
call fcn.0074cc66
jae 0x74cc2e
mov al, 0x10
call fcn.0074cc66
adc al, al
jae 0x74cc0f
jne 0x74cc5b
stosb byte es:[edi], al
jmp 0x74cbf4
call fcn.0074cc72
dec ecx
loop 0x74cc3a
mov eax, ebp
call fcn.0074cc70
jmp 0x74cc5c
lodsb al, byte [esi]
shr eax, 1
je 0x74cc82
adc ecx, 2
mov ebp, eax
jmp 0x74cc5c
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0074cc70
cmp eax, 0x7d00
jae 0x74cc5a
cmp eax, 0x500
jae 0x74cc5b
cmp eax, 0x7f
ja 0x74cc5c
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x74cbf4
pop ebp
ret 8
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0x30
lea edi, [ebp - 0xc8]
mov esi, 0x402108
lea eax, [ebp - 0xcc]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x40
push 3
lea eax, [ebp - 0xc8]
movsw word es:[edi], word [esi]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc8]
call eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040105b
mov esp, ebp
pop ebp
ret

Function at 0x401866
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018a5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018a5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018a5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018a5
cmp dword [ecx + 0x74], 0xe
jbe 0x4018a5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x403bec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x404240
sub eax, eax
test esi, esi
je 0x403cc4
sub eax, 1
test ecx, ecx
je 0x403cc2
test esi, 3
je 0x403c2a
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x403c0f
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x403ca9
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x403c34
mov ecx, edx
test ecx, ecx
je 0x403cc2
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x403caf
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x438c86
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
mov ebx, 0xb4bbbc31
call fcn.00438cc3
and ecx, ebx
xor dword [esi], edx
mov ecx, 0x14bbf3a0
add esi, 1
add ebx, ebx
inc ebx
add ebx, ebx
cmp esi, edi
jne fcn.00438c86
and ebx, ebx
ret
Function at 0x100108ed
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10010955
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10010941
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001093f
push 0x5b28
push 0
push 1
push 0x22ea
push 1
call fcn.1001e4ed
add esp, 0x14
jmp 0x10010953
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10010967
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push 0
push dword [ebp - 0x14]
call fcn.100135da
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001353e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100135ba
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100135a4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 1
jmp 0x10013584
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x100135a2
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100135a0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10013579
jmp 0x100135b8
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x100135b8
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x100135d6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0
push dword [ebp - 0x1c]
call fcn.1000edea
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100149f0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10014a8f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10014a42
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10014a40
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x10014a8d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10014a70
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10014a8d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1000b0e1
mov dword [eax], 0xb9b55bb2
jmp 0x10014a65
jmp 0x10014ab1
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push 0x40ae
push 0x7735
push dword [ebp - 0x2c]
push 1
push 0x1619
call fcn.100133dc
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1001859e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10018613
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100185ee
mov byte [ebp - 1], 0
push 0x3180
push 0x7715
push 1
push 1
lea eax, [ebp - 1]
push eax
push 1
push 0x71fe
push 0x1460
call fcn.10015224
add esp, 0x20
jmp 0x10018611
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10018611
push 0x1663
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1001863a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 0x7159
push 0x5044
push 0x9ad
push 0
push dword [ebp - 0x18]
push 0x6dbd
call fcn.10012676
add esp, 0x18
mov esp, ebp
pop ebp
ret