joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453748
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f78
xor eax, eax
push ebp
push 0x4537e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00408d68
mov eax, dword [ebp - 8]
call fcn.00403f88
mov esi, eax
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403f88
push eax
push 1
push 2
push 0x110
push 0xf01ff
push esi
push esi
push ebx
call sub.advapi32.dll_CreateServiceA
push eax
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4537e7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b68
ret

Function at 0x453c3c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453d23
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x453ced
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403b44
push 0x65
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x453caf
pop dword fs:[0]
add esp, 8
jmp 0x453d02
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x453cd7
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x204]
call fcn.00409094
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 8]
call fcn.00403dcc
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x453cb6
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x453cf7
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00403b98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453d2a
lea eax, [ebp - 0x204]
call fcn.00403b44
lea eax, [ebp - 8]
call fcn.00403b44
ret

Function at 0x454cd8
Capabilities:
Terminate process

Disassembly:
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
test eax, eax
je 0x454cee
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
ret
Function at 0x4550a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4551d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40d398]
call fcn.00402e08
mov esi, eax
mov dl, 1
mov eax, dword [0x455c30]
call fcn.00402e08
mov edi, eax
lea edx, [ebp - 0xc]
mov eax, dword [0x4589e4]
mov eax, dword [eax]
call fcn.0044649c
mov ebx, 0x44
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403cec
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0x4551f0
call fcn.00403e10
mov eax, dword [ebp - 4]
call fcn.00403f88
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
jne 0x4551a6
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
lea eax, [ebp - 8]
mov ecx, 0x4551fc
mov edx, dword [ebp - 4]
call fcn.00403e10
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00455d90
lea eax, [ebp - 0x10]
call fcn.00453e64
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00455c8c
mov edx, 0x455210
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov edx, 0x455224
call fcn.00403e10
mov edx, dword [ebp - 0x18]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea edx, [ebp - 0x1c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0045617c
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00408c74
inc ebx
cmp ebx, 0x46
jne 0x4550f5
mov eax, esi
call fcn.00402e38
mov eax, edi
call fcn.00402e38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4551e0
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00403b68
ret
Function at 0x455e14
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f78
xor eax, eax
push ebp
push 0x455f8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4496d8]
call fcn.00402e08
mov ebx, eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403bdc
lea eax, [ebp - 0x14c]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0044972c
mov eax, dword [ebp - 0x14c]
mov edx, 0x455fa4
call fcn.00403ed4
je 0x455ebe
push dword [ebp - 4]
push 0x455fa4
push 0x455fb0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403e84
lea eax, [ebp - 8]
mov ecx, 0x455fa4
mov edx, dword [ebp - 4]
call fcn.00403e10
jmp 0x455ecb
lea eax, [ebp - 4]
mov edx, 0x455fb0
call fcn.00403dcc
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
call fcn.00403f88
push eax
call sub.KERNEL32.DLL_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x455f63
mov eax, dword [ebp - 0x148]
add eax, 0xfffffff0
sub eax, 8
jb 0x455efd
add eax, 0xffffffe8
sub eax, 8
jae 0x455f4c
lea eax, [ebp - 0x11c]
cmp eax, 0x2e
je 0x455f4c
lea eax, [ebp - 0x11c]
cmp eax, 0x455fb4
je 0x455f4c
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403d74
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 8]
call fcn.00403e10
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.KERNEL32.DLL_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x455ee7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455f95
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00403b68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b68
ret

Function at 0x455fb8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x45602e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x43
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403cec
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x456044
call fcn.00403e10
mov eax, dword [ebp - 4]
call fcn.00403f88
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
jne 0x45600d
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00455e14
inc ebx
cmp ebx, 0x57
jne 0x455fd6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456035
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b68
ret
Function at 0x456320
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x456328
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4564f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40d398]
call fcn.00402e08
mov esi, eax
mov dword [ebp - 0x10], 1
mov ebx, 0x43
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403cec
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, 0x456510
call fcn.00403e10
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00403cec
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 0x45651c
call fcn.00403e10
mov eax, dword [ebp - 4]
call fcn.00403f88
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
jne 0x4564c5
mov eax, dword [0x45891c]
mov eax, dword [eax]
mov edx, 0x456528
call fcn.00403ed4
jne 0x456446
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00455e14
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x4564c5
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4564c5
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00408aa8
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x456534
call fcn.00403e10
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0045670c
inc dword [ebp - 0x10]
mov eax, dword [0x4589e4]
mov eax, dword [eax]
call fcn.00445e28
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x4563f8
jmp 0x4564c5
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00455e14
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x4564c5
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4564c5
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0xc]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2c]
push eax
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00408aa8
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x456534
call fcn.00403e10
mov edx, dword [ebp - 0x30]
pop eax
call fcn.00456570
inc dword [ebp - 0x10]
mov eax, dword [0x4589e4]
mov eax, dword [eax]
call fcn.00445e28
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x456479
inc ebx
cmp ebx, 0x57
jne 0x45635b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4564fe
lea eax, [ebp - 0x34]
mov edx, 8
call fcn.00403b68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b68
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x40de38
mov ecx, 0x1e6e1608
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x62612a29
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401010
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ccb0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x38
push esi
push edi
mov eax, dword [0x413004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], edx
mov edi, ecx
push 0x411b70
push dword [ebx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004041f0
add esp, 0xc
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
push edx
push edi
push ecx
mov eax, dword [ecx]
call dword [eax + 0xb4]
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
push 0
push 0
push 0xc
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edi, eax
lea eax, [ebp - 0x48]
push eax
call esi
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
call esi
mov byte [ebp - 4], 1
lea eax, [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
movups xmm0, xmmword [ebp - 0x48]
push eax
push edi
mov edx, dword [ecx]
sub esp, 0x10
mov eax, esp
push ecx
movups xmmword [eax], xmm0
call dword [edx + 0x94]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x38]
push eax
call esi
lea eax, [ebp - 0x48]
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x401140
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push 0x411b7c
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 0x411b80
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 0
test eax, eax
je 0x4011d2
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0x411c20
push 0x411c30
call eax
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x4011ca
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x411c40
push str.v4.0.30319
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4011ca
mov eax, dword [ecx]
lea edx, [esp + 4]
push edx
push 0x411bf0
push 0x411c10
push ecx
call dword [eax + 0x24]
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4011f1
lea eax, [esp + 4]
push eax
push 0x411bf0
push 0x411c10
push 0
push 0
push 0
call dword [sym.imp.mscoree.dll_CorBindToRuntimeEx]
mov ecx, dword [esp + 4]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x28]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push 0x411c00
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
push str._RESOLVER
call fcn.00401010
mov edx, dword [esp + 0x10]
add esp, 4
mov ecx, dword [ebp + 8]
push str._ENTRYPOINT
call fcn.00401010
add esp, 4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40206c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x42dbb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x42dc61
test eax, edx
je 0x42dc64
push 0
push 0
cmp word [eax - 0xa], 2
je 0x42dbe1
push edx
mov edx, eax
mov eax, esp
call fcn.00445d8c
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x42dbf7
push eax
lea eax, [esp + 8]
call fcn.00445d8c
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42dc06
movzx eax, word [eax]
sub eax, ecx
jmp 0x42dc2d
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42dc47
add ecx, 4
js 0x42dc1e
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x42dc44
push eax
mov eax, ecx
mov edx, 2
call fcn.00445158
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x42dc2b
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x42dc2d
xor eax, eax
ret
test eax, eax
je 0x42dc74
test edx, edx
jne 0x42dbc8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4350af
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0044548c
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.004c8ed2
mov edi, eax
cmp edi, 0x104
jbe 0x4350d2
mov eax, edi
add eax, eax
call fcn.00443324
mov esi, eax
jmp 0x4350d4
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.004c8ed2
push edi
push esi
call fcn.004c92de
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x43510d
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4350f7
mov eax, esp
cmp esi, eax
je 0x43511a
mov eax, esi
call fcn.00443340
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x435154
cmp bl, 0
je 0x435150
cmp bl, 0x41
jl 0x43514b
cmp bl, 0x5a
jg 0x43514b
or bl, 0x20
xor al, bl
inc esi
jmp 0x43512f
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x435094
Function at 0x4665e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4665ea
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
push eax
push 0x40
push 0xa
push str.shellcode
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.NtTestAlert
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
push str.shellcode
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00401064
mov esp, ebp
pop ebp
ret

Function at 0x40186a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018a9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018a9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018a9
cmp dword [ecx + 0x74], 0xe
jbe 0x4018a9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x70a370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x70a38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x733074
push ecx
mov edi, eax
call fcn.0071e198
mov esi, eax
add esp, 8
test esi, esi
jne 0x70a3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0071e02e
push esi
call fcn.0071dfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x70d850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x70d8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x738720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x70d8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0071e1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x70d8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x738720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x70d92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0071f082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x70d957
mov word [eax], si
add eax, 2
push eax
call fcn.0071f030
add esp, 4
jmp 0x70d959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x70d8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x70d8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x70dff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x70e080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x70e0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x733458
push ecx
call fcn.0071e1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.0071e1e1
add esp, 0x10
jmp 0x70e0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0071e20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.0071ddff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0070e050
mov eax, dword [0x738728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x70e13b
push esi
call fcn.0070dfb0
add esp, 4
mov dword [0x738728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x70e14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.0070dff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x711440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x7114b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x71148e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x711471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x71147e
add edx, ecx
cmp ebx, edx
jb 0x71148a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x711467
xor ecx, ecx
jmp 0x7114a2
test eax, eax
jne 0x711492
xor ecx, ecx
jmp 0x7114a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.007113c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret