joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c013df0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1c03c020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ecx]
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.1c013890
test eax, eax
jle 0x1c013e8b
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.MSVCR90.dll_malloc]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [esi + 8]
cmp eax, 0x400
mov dword [ebp - 0x18], 0
jg 0x1c013e47
call fcn.1c02bcf0
mov edi, esp
test edi, edi
je 0x1c013e5c
mov dword [edi], 0xcccc
add edi, 8
jmp 0x1c013e5c
push eax
call ebx
add esp, 4
test eax, eax
je 0x1c013e5a
mov dword [eax], 0xdddd
add eax, 8
mov edi, eax
push esi
push 0
push edi
call fcn.1c02b4b0
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x1c013e83
test edi, edi
je 0x1c013e83
push 0
push esi
push edi
push eax
call sub.WS2_32.dll_recv
test eax, eax
jg 0x1c013e95
lea edi, [ebp - 0x18]
call fcn.1c013840
mov eax, 0x2c1
jmp 0x1c013f9f
cmp byte [edi], 0
jne 0x1c013ea4
mov ebx, 0x1c037380
jmp 0x1c013f4e
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1c013eb0
sub eax, edx
mov dword [ebp - 8], eax
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1c013ec1
sub eax, edx
lea edx, [eax + eax*2 + 0xc]
mov eax, edi
cmp edx, 0x400
lea edx, [eax + 1]
jg 0x1c013f03
jmp 0x1c013ee0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1c013ee0
sub eax, edx
lea eax, [eax + eax*2 + 0xc]
call fcn.1c02bcf0
mov ebx, esp
test ebx, ebx
je 0x1c013f25
mov dword [ebx], 0xcccc
add ebx, 8
jmp 0x1c013f25
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1c013f03
sub eax, edx
lea eax, [eax + eax*2 + 0xc]
push eax
call ebx
add esp, 4
test eax, eax
je 0x1c013f23
mov dword [eax], 0xdddd
add eax, 8
mov ebx, eax
lea esi, [ebp - 0x18]
call fcn.1c0137e0
mov eax, dword [ebp - 8]
push 0
lea ecx, [eax + eax*2 + 4]
shr ecx, 1
push ecx
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0
call dword [sym.imp.HncBL90.dll_HncAnsiToUnicode]
test ebx, ebx
je 0x1c013f7f
mov esi, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1c013f62
sub eax, edx
sar eax, 1
lea edi, [ebp - 0x18]
mov esi, eax
call fcn.1c013840
mov eax, esi
jmp 0x1c013f9f
cmp dword [edi - 8], 0xdddd
lea eax, [edi - 8]
jne 0x1c013f95
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
lea edi, [ebp - 0x18]
call fcn.1c013840
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1c01a4c0
mov esp, ebp
pop ebp
ret 8
Function at 0x1c014220
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi]
call fcn.1c013890
test eax, eax
jle 0x1c01424e
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi]
push 0
push eax
push ecx
push edx
call sub.WS2_32.dll_recv
test eax, eax
jle 0x1c01424e
cmp eax, 0x2c1
jne 0x1c014250
xor eax, eax
pop esi
pop ebx
ret 8

Function at 0x1c014260
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, ecx
mov esi, ebp
test ebp, ebp
jle 0x1c01428c
mov edi, dword [esp + 0x14]
mov eax, dword [ebx]
push 0
push esi
push edi
push eax
call sub.WS2_32.dll_send
test eax, eax
jl 0x1c014294
sub esi, eax
add edi, eax
test esi, esi
jg 0x1c014274
mov eax, ebp
sub eax, esi
cmp eax, ebp
je 0x1c014299
mov eax, 0x2c0
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1c0142a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi]
call fcn.1c013890
test eax, eax
jle 0x1c0142c7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi]
push 0
push eax
push ecx
push edx
call sub.WS2_32.dll_recv
test eax, eax
jg 0x1c0142cc
mov eax, 0x2c1
pop esi
pop ebx
ret 8
Function at 0x1c015990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x1c03c020]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
xor eax, eax
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [edi + 0x30]
mov ebx, dword [eax + 0x10]
sub ebx, dword [eax + 0xc]
push 0
push 0x30
sar ebx, 2
push ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.MSVCR90.dll_fseek]
add esp, 0xc
xor esi, esi
test ebx, ebx
jle 0x1c015ad2
lea ebx, [ebx]
mov ebx, dword [edi + 0x30]
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
sar eax, 2
cmp esi, eax
jb 0x1c015a16
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + esi*4]
mov eax, dword [edx + 8]
mov ebx, dword [edi + 0x30]
mov dword [esp + 0x18], eax
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
sar ecx, 2
cmp esi, ecx
jb 0x1c015a39
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov edx, dword [ebx + 0xc]
mov eax, dword [edx + esi*4]
mov cl, byte [eax]
mov ebx, dword [edi + 0x30]
mov byte [esp + 0x14], cl
mov edx, dword [ebx + 0x10]
sub edx, dword [ebx + 0xc]
sar edx, 2
cmp esi, edx
jb 0x1c015a5b
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + esi*4]
mov edx, dword [ecx + 4]
mov ebx, dword [edi + 0x30]
mov dword [esp + 0x1c], edx
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
sar eax, 2
cmp esi, eax
jb 0x1c015a7e
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + esi*4]
mov eax, dword [edx + 0xc]
mov ebx, dword [edi + 0x30]
mov dword [esp + 0x20], eax
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
sar ecx, 2
cmp esi, ecx
jb 0x1c015aa1
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov edx, dword [ebx + 0xc]
mov eax, dword [edx + esi*4]
mov edx, dword [esp + 0x10]
mov cx, word [eax + 0x24]
push edx
push 1
lea eax, [esp + 0x1c]
push 0x20
push eax
mov word [esp + 0x34], cx
call dword [sym.imp.MSVCR90.dll_fwrite]
inc esi
add esp, 0x10
cmp esi, dword [esp + 0xc]
jl 0x1c015a00
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1c01a4c0
mov esp, ebp
pop ebp
ret 4
Function at 0x1c0170b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1c02c20b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1c03c020]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x30]
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
test ecx, 0xfffffffc
jne 0x1c0171dd
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [ebp + 0x10], ebx
jbe 0x1c0171b4
push 0x2c
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], ebx
cmp esi, ebx
je 0x1c017126
lea ecx, [esi + 0x10]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
jmp 0x1c017128
xor esi, esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
mov byte [esi], 0xff
mov dword [esi + 4], ebx
mov eax, dword [edx]
mov edx, dword [eax + ecx*4]
push edx
lea ecx, [esi + 0x10]
mov dword [esp + 0x1c], esi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const__]
mov edi, dword [edi + 0x30]
mov eax, dword [edi + 0xc]
cmp eax, ebx
jne 0x1c01715e
xor ecx, ecx
jmp 0x1c017166
mov ecx, dword [edi + 0x14]
sub ecx, eax
sar ecx, 2
mov ebx, dword [edi + 0x10]
mov edx, ebx
sub edx, eax
sar edx, 2
cmp edx, ecx
jae 0x1c01717e
mov dword [ebx], esi
add ebx, 4
mov dword [edi + 0x10], ebx
jmp 0x1c01719d
cmp eax, ebx
jbe 0x1c017188
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov eax, dword [edi]
push ebx
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
mov eax, edi
call fcn.1c016d00
mov eax, dword [esp + 0x14]
mov edi, dword [ebp + 8]
inc eax
xor ebx, ebx
mov dword [esp + 0x14], eax
cmp eax, dword [ebp + 0x10]
jb 0x1c017103
mov edx, dword [ebp + 0x14]
push edx
lea ecx, [edi + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const__]
mov ecx, edi
call sym.HncBM90.dll_private:_int___thiscall_CHncZIP::_Compress_void_
cmp eax, ebx
jne 0x1c0171df
mov edi, dword [edi + 4]
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0xc]
test ecx, 0xfffffffc
je 0x1c0171df
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1c0176c4
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1c0176ff
mov ecx, dword [eax + 8]
test ecx, ecx
leave
jne 0x1c0176e6
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1c0176f7
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1c017701
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1c0176dc
xor eax, eax
pop edi
pop esi
ret
Function at 0x1c01a4c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1c03c020]
jne 0x1c01a4ca
repz ret
jmp fcn.1c01aa78

Function at 0x1c01bdd0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 8
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.1c02b4b0
add esp, 0xc
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x1c01bdfe
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax]
test ecx, ecx
je 0x1c01be83
cmp dword [ebp - 4], 0x28
jge 0x1c01be83
mov edx, dword [ebp - 4]
and edx, reloc.WS2_32.dll_closesocket
jns 0x1c01be1e
dec edx
or edx, 0xfffffffc
inc edx
mov eax, dword [ebp - 8]
mov cx, word [eax + edx*2]
shl cx, 1
mov edx, dword [ebp - 4]
and edx, reloc.WS2_32.dll_closesocket
jns 0x1c01be38
dec edx
or edx, 0xfffffffc
inc edx
mov eax, dword [ebp - 8]
mov word [eax + edx*2], cx
mov ecx, dword [ebp - 4]
and ecx, reloc.WS2_32.dll_closesocket
jns 0x1c01be4f
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edx, dword [ebp + 0xc]
movzx eax, word [edx]
mov edx, dword [ebp - 8]
movzx ecx, word [edx + ecx*2]
xor ecx, eax
mov edx, dword [ebp - 4]
and edx, reloc.WS2_32.dll_closesocket
jns 0x1c01be6e
dec edx
or edx, 0xfffffffc
inc edx
mov eax, dword [ebp - 8]
mov word [eax + edx*2], cx
mov ecx, dword [ebp + 0xc]
add ecx, 2
mov dword [ebp + 0xc], ecx
jmp 0x1c01bdf5
cmp dword [0x1c0415d0], 0
jne 0x1c01bec7
push 0x1c02d290
push 0x1c03fdd0
call fcn.1c01c2c0
add esp, 8
push 0x1c02d2d0
push 0x1c03f5d0
call fcn.1c01c2c0
add esp, 8
push 0x1c0405d0
call fcn.1c01c170
add esp, 4
mov dword [0x1c0415d0], 1
mov edx, dword [ebp + 8]
add edx, 0x74
push edx
call fcn.1c01bef0
add esp, 4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1c01bfc0
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1c01bfc0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 0x10], 0
jmp 0x1c01bfd9
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x38
jge 0x1c01c020
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + str.91__]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
and eax, 7
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sar ecx, 3
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + ecx]
mov ecx, dword [ebp - 0xc]
and eax, dword [ecx*4 + 0x1c02d5a8]
neg eax
sbb eax, eax
neg eax
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov byte [edx + 4], al
jmp 0x1c01bfd0
mov dword [ebp - 4], 0
jmp 0x1c01c032
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x1c01c068
mov dword [ebp - 0x10], 0
jmp 0x1c01c04a
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 6
jge 0x1c01c066
mov edx, dword [ebp - 4]
imul edx, edx, 6
add edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov byte [eax + edx + 0x4074], 0
jmp 0x1c01c041
jmp 0x1c01c029
mov dword [ebp - 4], 0
jmp 0x1c01c07a
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x10
jge 0x1c01c163
mov dword [ebp - 0x10], 0
jmp 0x1c01c096
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x38
jge 0x1c01c0e8
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x1c02d348]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
xor edx, edx
cmp dword [ebp - 0x10], 0x1c
setge dl
sub edx, 1
and edx, 0xffffffe4
add edx, 0x38
cmp dword [ebp - 8], edx
jge 0x1c01c0cb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
jmp 0x1c01c0d4
mov ecx, dword [ebp - 8]
sub ecx, 0x1c
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov cl, byte [eax + 4]
mov byte [edx + 0x3c], cl
jmp 0x1c01c08d
mov dword [ebp - 0x10], 0
jmp 0x1c01c0fa
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x30
jge 0x1c01c15e
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x1c02d358]
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx + 0x3b]
test eax, eax
je 0x1c01c15c
mov ecx, dword [ebp - 0x10]
and ecx, 7
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
imul edx, edx, 6
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x4074]
mov edx, dword [ebp - 0x10]
sar edx, 3
movzx eax, byte [ecx + edx]
mov ecx, dword [ebp - 8]
or eax, dword [ecx*4 + 0x1c02d5a8]
mov edx, dword [ebp - 0x10]
sar edx, 3
mov ecx, dword [ebp - 4]
imul ecx, ecx, 6
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx + 0x4074]
mov byte [ecx + edx], al
jmp 0x1c01c0f1
jmp 0x1c01c071
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1c01c170
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 4], 0
jmp 0x1c01c189
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x1c01c1db
mov dword [ebp - 0x14], 0
jmp 0x1c01c1a1
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x100
jge 0x1c01c1d9
mov dword [ebp - 8], 0
jmp 0x1c01c1bc
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 4
jge 0x1c01c1d7
mov eax, dword [ebp - 4]
shl eax, 0xa
add eax, dword [ebp + 8]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov byte [eax + ecx*4], 0
jmp 0x1c01c1b3
jmp 0x1c01c198
jmp 0x1c01c180
mov dword [ebp - 4], 0
jmp 0x1c01c1ed
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 4
jge 0x1c01c2b2
mov dword [ebp - 0x14], 0
jmp 0x1c01c209
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x100
jge 0x1c01c2ad
mov dword [ebp - 8], 0
jmp 0x1c01c228
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x20
jge 0x1c01c2a8
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x1c02d588]
sub eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sar ecx, 3
cmp ecx, dword [ebp - 4]
je 0x1c01c24b
jmp 0x1c01c21f
mov edx, dword [ebp - 0xc]
and edx, 7
mov eax, dword [ebp - 0x14]
and eax, dword [edx*4 + 0x1c02d5a8]
jne 0x1c01c25f
jmp 0x1c01c21f
mov ecx, dword [ebp - 8]
and ecx, 7
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
shl edx, 0xa
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
lea ecx, [edx + eax*4]
mov edx, dword [ebp - 8]
sar edx, 3
movzx eax, byte [ecx + edx]
mov ecx, dword [ebp - 0x10]
or eax, dword [ecx*4 + 0x1c02d5a8]
mov edx, dword [ebp - 8]
sar edx, 3
mov ecx, dword [ebp - 4]
shl ecx, 0xa
add ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
lea ecx, [ecx + esi*4]
mov byte [ecx + edx], al
jmp 0x1c01c21f
jmp 0x1c01c200
jmp 0x1c01c1e4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1c01c400
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push esi
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
shl eax, 1
mov dword [ebp - 4], eax
push 8
push 0
lea ecx, [ebp - 0x24]
push ecx
call fcn.1c02b4b0
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
jmp 0x1c01c44a
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 4]
jge 0x1c01c497
mov eax, dword [ebp - 8]
cdq
mov ecx, 7
idiv ecx
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + edx]
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 8]
movzx eax, byte [edx]
xor ecx, eax
mov byte [ebp - 0x19], cl
movzx ecx, byte [ebp - 0x19]
shl ecx, 1
movzx edx, byte [ebp - 0x19]
sar edx, 7
and edx, 1
or ecx, edx
mov eax, dword [ebp - 8]
cdq
mov esi, 7
idiv esi
mov eax, dword [ebp - 0x18]
mov byte [eax + edx], cl
jmp 0x1c01c441
push 8
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x80]
push edx
call fcn.1c02b5c0
add esp, 0xc
lea eax, [ebp - 0x80]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x84], 0
jmp 0x1c01c4e0
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x84]
add eax, 1
mov dword [ebp - 0x84], eax
cmp dword [ebp - 8], 0x38
jge 0x1c01c59a
mov ecx, dword [ebp - 0x84]
and ecx, 0x80000007
jns 0x1c01c4fd
dec ecx
or ecx, 0xfffffff8
inc ecx
cmp ecx, 7
jne 0x1c01c511
mov edx, dword [ebp - 0x84]
add edx, 1
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 8]
shr eax, 3
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + eax]
mov ecx, dword [ebp - 8]
and ecx, 7
mov eax, 0x80
sar eax, cl
and edx, eax
je 0x1c01c562
mov edx, dword [ebp - 0x84]
shr edx, 3
mov ecx, dword [ebp - 0x84]
and ecx, 7
mov eax, 0x80
sar eax, cl
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
or edx, eax
mov eax, dword [ebp - 0x84]
shr eax, 3
mov ecx, dword [ebp - 0x14]
mov byte [ecx + eax], dl
jmp 0x1c01c595
mov edx, dword [ebp - 0x84]
shr edx, 3
mov ecx, dword [ebp - 0x84]
and ecx, 7
mov eax, 0x80
sar eax, cl
not eax
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + edx]
and edx, eax
mov eax, dword [ebp - 0x84]
shr eax, 3
mov ecx, dword [ebp - 0x14]
mov byte [ecx + eax], dl
jmp 0x1c01c4c8
cmp dword [0x1c0415d0], 0
jne 0x1c01c5de
push 0x1c02d290
push 0x1c03fdd0
call fcn.1c01c2c0
add esp, 8
push 0x1c02d2d0
push 0x1c03f5d0
call fcn.1c01c2c0
add esp, 8
push 0x1c0405d0
call fcn.1c01c170
add esp, 4
mov dword [0x1c0415d0], 1
mov edx, dword [ebp + 8]
add edx, 0x74
push edx
call fcn.1c01bef0
add esp, 4
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1c01bfc0
add esp, 8
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1c01cb30
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
pop ebp
ret
Function at 0x4014a2
Capabilities:
Check for time delay via queryperformancecounter
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
and dword [ebp - 0x44c], 0
mov dword [0x41a534], 0x6538
push 0x6538
call fcn.0040384e
pop ecx
mov dword [0x41a52c], eax
push 0x6538
push 0x405030
push dword [0x41a52c]
jmp loc.0041b000
Function at 0x4038be
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4038e7
cmp al, 0x22
je 0x4038df
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4038d3
cmp byte [esi], 0x22
jne 0x4038f1
inc esi
jmp 0x4038f1
cmp al, 0x20
jle 0x4038f1
inc esi
cmp byte [esi], 0x20
jg 0x4038eb
mov al, byte [esi]
test al, al
je 0x4038fb
cmp al, 0x20
jle 0x4038e4
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00403969
push 0x405004
push section..data
call fcn.0040394f
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40392b
movzx eax, word [ebp - 0x14]
jmp 0x40392e
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00403981
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
mov edi, 0x10003030
push edi
push dword [0x10003020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [0x10003036], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002040]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x1000117f
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x100011aa
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push ebx
cmp eax, 0xffffffff
jne 0x100011fd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x401000
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401029
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401021
cmp al, 0x22
jne 0x401015
cmp byte [esi], 0x22
jne 0x401033
inc esi
jmp 0x401033
cmp al, 0x20
jle 0x401033
inc esi
cmp byte [esi], 0x20
jg 0x40102d
mov al, byte [esi]
test al, al
je 0x40103d
cmp al, 0x20
jle 0x401026
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004018d4
push 0x404004
push section..data
call fcn.004018ba
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40106d
movzx eax, word [ebp - 0x14]
jmp 0x401070
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00401123
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0xde0800
Capabilities:
Encode data using xor

Disassembly:
jmp 0xde080a
pushal
call 0xde0810
pop ebp
sub ebp, 0x10
sub ebp, 0x9e0800
jmp 0xde0826
mov eax, 0x9e0800
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c6
mov edx, 0x4294b7c0
xor byte [eax], dl
inc eax
dec ecx
jne 0xde083d
jmp 0xde0850
dec ebx
or eax, 0xc0fc494b
rol al, 0x41
add dword [eax], edi
rol al, 0xc0
ret