joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
mov eax, 1
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
mov ecx, edi
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW

Function at 0x40a056
Capabilities:
Encode data using xor

Disassembly:
call fcn.00409f26
sub ecx, ecx
sub cx, 0xff72
call 0x40a056
rcr byte [esi - 0x7f], 0x76
push cs
adc dword [ecx], ebx
lcall 0xf4e2, 0xfcee8353
cmp dl, al
sub ebx, ebx
enter 0x43f7, 0x27
xor eax, 0x62d2c1ed
or ch, byte [edx + 0x194d8509]
mov eax, 0x9f6efbed
invalid

Function at 0x10047265
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x10047284
cmp eax, dword [esp + 0x28]
je 0x1004729b
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x1004727b
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
mov dword [esp + 0x1c], edx
popal
ret 8
Function at 0x100019a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10038be8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10039668]
cmp eax, dword [ecx + 4]
jle 0x100019f8
push 0x10039668
call fcn.1000a963
add esp, 4
cmp dword [0x10039668], 0xffffffff
jne 0x100019f8
push 0x40
push 0x1000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x10039668
mov dword [0x10039664], eax
call fcn.1000a924
add esp, 4
mov edx, dword [0x10039664]
push esi
lea esi, [edx + 0x1000]
cmp edx, esi
je 0x10001a23
nop dword [eax]
lea ecx, [edx + 0x1c]
call fcn.10001990
test eax, eax
je 0x10001a27
add edx, 0x20
cmp edx, esi
jne 0x10001a10
xor eax, eax
pop esi
ret
mov eax, edx
pop esi
ret

Function at 0x10001a30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 0xc], edx
cmp byte [edi], 0xe9
jne 0x10001a51
lea ecx, [edi + 5]
add ecx, dword [edi + 1]
call fcn.10001a30
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
call fcn.100019a0
mov ebx, eax
xor esi, esi
mov dword [ebp - 4], ebx
nop
lea ecx, [esi + edi]
call fcn.10001750
add esi, eax
cmp esi, 5
jl 0x10001a60
test esi, esi
jle 0x10001a91
mov ecx, ebx
mov edx, esi
mov ebx, edi
sub ebx, ecx
nop dword [eax + eax]
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10001a80
mov ebx, dword [ebp - 4]
lea ecx, [esi + ebx]
lea eax, [edi - 5]
mov byte [ecx], 0xe9
sub esi, ecx
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 1], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
mov eax, dword [ebp - 0xc]
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
pop esi
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100020a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [eax + 0x40]
mov edx, eax
and edx, 7
mov cl, byte [edx + ebx]
mov byte [eax + edi], cl
inc eax
sub esi, 1
jne 0x100020b0
mov ebx, 0x100
mov edx, esi
and edx, 0x3f
movzx eax, byte [edx + edi]
movzx eax, byte [eax + 0x10033218]
movzx ecx, byte [eax + 0x10033218]
movzx eax, byte [esi + 0x10033318]
inc esi
movzx eax, byte [eax + 0x10033318]
xor ecx, eax
mov al, byte [ecx + 0x10033318]
mov byte [edx + edi], al
sub ebx, 1
jne 0x100020c6
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10002e00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
jmp 0x10002e19
jmp 0x10002e2b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x10002e70
call fcn.10002e00
cmp dword [ebp - 4], 0x103
jne 0x10002e81
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002fc0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c94
call fcn.1000b950
mov eax, dword [0x10037070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x2c90], ecx
jmp 0x10002ff2
jmp 0x10003004
lea eax, [ebp - 0x2c8c]
mov dword [ebp - 0x2c8c], 0x2880
push eax
lea eax, [ebp - 0x2c88]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x10003039
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000a7d4
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x2af4], 0
lea eax, [ebp - 0x2c88]
jne 0x10003088
nop dword [eax + eax]
cmp byte [eax + 0x195], 0
jne 0x10003088
cmp byte [eax + 0x196], 0
jne 0x10003088
cmp byte [eax + 0x197], 0
jne 0x10003088
cmp byte [eax + 0x198], 0
jne 0x10003088
cmp byte [eax + 0x199], 0
jne 0x10003088
mov eax, dword [eax]
cmp byte [eax + 0x194], 0
je 0x10003050
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x408]
push 0x3e8
push eax
call fcn.10002110
add esp, 0x24
lea eax, [ebp - 0x408]
push 0x3e8
push eax
push 0x3e8
push dword [ebp - 0x2c90]
push 0
call fcn.100120e8
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.1000a7d4
mov esp, ebp
pop ebp
ret
Function at 0x100060f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x10037070]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100062e4
cmp byte [ebx + 0x3d], 0
je 0x100062e4
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x1000613d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1000a7d4
mov esp, ebp
pop ebp
ret
push 0
push 8
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.10005d30
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
nop word [eax + eax]
mov ecx, dword [ebx + 0x38]
lea edi, [esp + 0x14]
cmp edx, 0x10
lea esi, [esp + 0x14]
cmovae esi, eax
cmovae edi, eax
mov edx, dword [ecx]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x28]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100061bc
sub eax, 1
je 0x100061c0
mov edx, dword [esp + 0x28]
sub eax, 2
mov eax, dword [esp + 0x14]
je 0x10006299
xor bl, bl
jmp 0x1000629b
mov byte [ebx + 0x3d], 0
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp edx, 0x10
mov esi, dword [esp + 0x10]
cmovae ecx, eax
sub esi, ecx
je 0x100061ff
push dword [ebx + 0x4c]
cmp edx, 0x10
lea ecx, [esp + 0x18]
push esi
cmovae ecx, eax
push 1
push ecx
call fcn.100119ed
mov edx, dword [esp + 0x38]
add esp, 0x10
cmp esi, eax
mov eax, dword [esp + 0x14]
jne 0x100061b5
cmp byte [ebx + 0x3d], 0
je 0x10006299
test esi, esi
jne 0x10006170
mov edi, dword [esp + 0x24]
or ecx, 0xffffffff
sub ecx, edi
cmp ecx, 8
jbe 0x100062f8
lea esi, [edi + 8]
cmp esi, 0xfffffffe
ja 0x100062f8
cmp edx, esi
jae 0x1000627f
push edi
push esi
lea ecx, [esp + 0x1c]
call fcn.10001ec0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
test esi, esi
je 0x10006170
cmp edx, 0x10
lea ecx, [esp + 0x14]
xorps xmm0, xmm0
cmovae ecx, eax
mov eax, dword [esp + 0x24]
movq qword [ecx + eax], xmm0
lea eax, [esp + 0x14]
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x24], esi
cmovae eax, dword [esp + 0x14]
mov byte [eax + esi], 0
jmp 0x1000615f
test esi, esi
jne 0x1000624e
cmp edx, 0x10
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x14]
cmovae ecx, eax
mov byte [ecx], 0
jmp 0x1000615f
mov bl, 1
cmp edx, 0x10
jb 0x100062d0
lea ecx, [edx + 1]
cmp ecx, 0x1000
jb 0x100062c7
test byte [esp + 0x14], 0x1f
jne 0x10006302
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x10006307
sub eax, ecx
cmp eax, 4
jb 0x1000630c
cmp eax, 0x23
ja 0x10006311
mov eax, ecx
push eax
call fcn.1000a818
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1000a7d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000a7d4
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.10007919
call fcn.1000fc51
call fcn.1000fc51
call fcn.1000fc51
call fcn.1000fc51
int3
Function at 0x10007240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x10038be8]
mov ebx, ecx
push edi
mov dword [ebp - 8], edx
mov esi, dword [eax + esi*4]
mov eax, dword [0x10039a78]
cmp eax, dword [esi + 4]
jle 0x100072e8
push 0x10039a78
call fcn.1000a963
add esp, 4
cmp dword [0x10039a78], 0xffffffff
jne 0x100072e5
mov eax, dword [0x10039a88]
cmp eax, dword [esi + 4]
jle 0x100072ce
push 0x10039a88
call fcn.1000a963
add esp, 4
cmp dword [0x10039a88], 0xffffffff
jne 0x100072ce
push ecx
lea eax, [ebp - 0x40c]
push eax
call fcn.10007520
mov esi, eax
mov ecx, 0x100
mov edi, 0x10039670
rep movsd dword es:[edi], dword [esi]
push 0x10039a88
call fcn.1000a924
add esp, 0xc
push 0x10039a78
mov dword [0x10039a84], 0x10039670
call fcn.1000a924
add esp, 4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1000730a
mov esi, dword [0x10039a84]
mov al, byte [edx]
lea edx, [edx + 1]
xor al, bl
shr ebx, 8
movzx eax, al
xor ebx, dword [esi + eax*4]
sub ecx, 1
jne 0x100072f5
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007690
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ecx, 0x80
mov ebx, edx
push esi
mov esi, 1
mov dword [ebp - 4], ecx
mov ax, cx
push edi
movzx edi, word [ebp + 8]
cmp ax, si
jbe 0x100076dd
or ecx, esi
movzx edx, cx
mov ecx, edx
and ecx, edi
movzx ecx, cx
cmp cx, ax
je 0x100076c8
cmp cx, si
jne 0x100076ca
xor edi, edx
shr ax, 1
add esi, esi
mov word [ebp - 4], ax
cmp ax, si
jbe 0x100076dd
mov ecx, dword [ebp - 4]
jmp 0x100076b2
movzx eax, di
mov esi, 8
mov dword [ebp + 8], eax
mov di, ax
nop dword [eax + eax]
movzx edx, di
xor ecx, ecx
shl edx, 0x1f
xor edx, dword [ebx]
mov eax, edx
shr eax, 0x1f
test al, al
mov eax, 0x4c11db7
cmovne ecx, eax
lea eax, [edx + edx]
xor ecx, eax
shr di, 1
mov dword [ebx], ecx
sub esi, 1
jne 0x100076f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007740
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [ebp + 0xc], edi
jbe 0x100077a4
push ebx
push esi
movzx esi, byte [ecx + 1]
movzx eax, byte [ecx]
movzx edx, byte [esi + ecx + 2]
add edx, eax
movzx eax, dl
mov bl, byte [eax + ecx + 2]
mov byte [ecx], bl
mov dl, byte [esi + ecx + 2]
movzx eax, bl
movzx eax, byte [eax + ecx + 2]
movzx eax, byte [eax + ecx + 2]
inc eax
movzx eax, al
mov dh, byte [eax + ecx + 2]
movzx eax, bl
mov al, byte [eax + ecx + 2]
mov byte [esi + ecx + 2], al
movzx eax, byte [ecx]
mov byte [eax + ecx + 2], dl
mov eax, dword [ebp - 4]
inc byte [ecx + 1]
xor byte [eax + edi], dh
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x10007751
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000840b
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x100260cc
call fcn.1000b14a
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10008528
cmp byte [ebx + 0x3e], 0
je 0x10008528
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.1000b0ea
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x10008457
xor al, al
jmp 0x1000852a
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.10005d30
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x10008487
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.1000b0ea
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x100084bc
sub eax, 1
je 0x100084c0
dec eax
sub eax, 1
je 0x10008516
xor bl, bl
jmp 0x10008518
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x100084d0
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x100084f8
cmp eax, 0x10
jae 0x100084df
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.100119ed
add esp, 0x10
cmp esi, eax
jne 0x100084b8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x10008516
test esi, esi
jne 0x1000847b
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10005e00
jmp 0x10008475
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10001b60
mov al, bl
jmp 0x1000852a
mov al, 1
call fcn.1000b105
ret
Function at 0x10008cfe
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x10026149
call fcn.1000b14a
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x10008d23
xor eax, eax
jmp 0x10008e9c
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10008d4f
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x10008d4f
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x10008e9c
cmp dword [esi + 0x4c], 0
je 0x10008e99
mov ecx, esi
call fcn.10008703
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x10008d82
push dword [esi + 0x4c]
push edi
call fcn.10007e72
pop ecx
pop ecx
test al, al
je 0x10008e99
movzx ebx, di
jmp 0x10008e99
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.10005d30
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x10008dba
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.1000b0ea
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x10008e8d
cmp eax, 1
jg 0x10008e68
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x10008e03
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x10008e30
cmp eax, 0x10
jae 0x10008e12
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.100119ed
add esp, 0x10
cmp edi, eax
jne 0x10008e63
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x10008e33
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x10008e5d
test edi, edi
jne 0x10008dae
cmp dword [ebp - 0x18], 0x20
jae 0x10008e87
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.10005e00
jmp 0x10008da8
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x10008e87
cmp eax, 3
jne 0x10008e8d
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.10007e72
pop ecx
pop ecx
test al, al
je 0x10008e87
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10001b60
mov ax, bx
call fcn.1000b105
ret 4

Function at 0x1001a00a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10019ccd

Function at 0x1001a015
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10019e4e
Function at 0x4016f8
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x4016fa
ret

Function at 0x404a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp - 0x77]
push ebx
push esi
push edi
sub edx, dword [eax + 7]
and edx, 0xfffffff8
invalid

Function at 0x405eaf
Capabilities:
Allocate thread local storage

Disassembly:
adc bh, cl
mov eax, dword cs:[ebx]
adc edx, dword [edx + 0x71]
call 0x10fabf0
mov edx, dword [ebp - 4]
mov eax, dword [edi]
das
push esi
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
mov ecx, 1
insb byte es:[edi], dx
loop 0x405edb
cmp ebx, ecx
test byte [edi], 0x7e
sub ebx, ebx
pop edx
dec dword [ebp + 0x4d310447]
or al, 0x41
mov edx, dword [eax - 0x75]
add edx, 2
mov dword [eax], edx
ja 0x405f1d
mov dl, byte [esi]
inc esi
mov ecx, dword [esi - 0x77]
xor byte [ebp - 0xb], dh
mov edx, dword [ebp + 0xc]
add eax, 4
sahf
mov dword [ebp + 0xc], edx
jo 0x405ee3
mov eax, dword [ebp + 8]
mov dword [edi + ecx*4], 0x16000000
mov dword [eax], edi
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
fadd st(3), st(0)
nop
xor dword [eax - 0x6f6f6f70], edx
nop
nop
nop
push ebp
mov ebp, esp
mov ch, 0xec
cwde
nop
add byte [eax], al
ror byte [eax + 0x14144103], 0x45
inc eax
add al, 0xc9
mov dword [0x3c0388], eax
je 0x405f40
xor edx, dword [esi - 0x3ca21a75]
lea edx, [ebp - 8]
push edi
call fcn.0040a6e6
add esp, 4
test eax, eax
sbb byte [ebp + 0x82], al
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x410954], eax
call 0xd4404940
test dword [ebx + 0x75], ebx
jae 0x405fde
push eax
push eax
lea eax, [ebp - 0x60]
push eax
call 0xf73fa760
test dword [eax + 0x22b80974], esp
dec esi
mov dl, 0
jmp 0x8c03bce6
movsd dword es:[edi], dword [esi]
nop
cld
lds eax, [ebx + 0x41]
add byte [ecx - 0x5d], cl
mov byte [ebx], al
inc ecx
add byte [ebp + 0x75], dh
call 0x3fa620
adc dword [0x40c15e], 0x419854a1
add byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_TlsFree
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0xac01d20
Capabilities:
Write file on windows

Disassembly:
push ebp
push esi
push edi
add esp, 0xfffffef4
mov edi, dword [esp + 0x11c]
mov al, byte [edi]
test al, al
je 0xac01d42
xor esi, esi
inc esi
mov al, byte [edi + esi]
test al, al
jne 0xac01d38
jmp 0xac01d44
xor esi, esi
test esi, esi
je 0xac01dee
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebp, eax
cmp ebp, 0xffffffff
je 0xac01d95
call fcn.0ac02110
test al, al
jne 0xac01d95
push 0
lea eax, [esp + 0x10c]
push eax
push esi
push edi
push ebp
mov dword [esp + 0x11c], esi
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [esp + 0x10c]
push ecx
push 2
push 0xac07848
push ebp
call sub.KERNEL32.DLL_WriteFile
jmp 0xac01ddf
push 0
mov dword [esp + 0x10c], esi
call sub.KERNEL32.DLL_GetModuleHandleA
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
test eax, eax
jne 0xac01dbb
mov byte [esp], 0
push 0xac07858
call sub.KERNEL32.DLL_LoadLibraryA
push str.MessageBoxA
push eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x12010
lea ecx, [esp + 4]
push ecx
push edi
push 0
call eax
mov eax, dword [0xac0d010]
test eax, eax
je 0xac01dee
push edi
call fcn.0ac020b0
sub esp, 0xfffffef4
pop edi
pop esi
pop ebp
ret 4

Function at 0xac01fa0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
add esp, 0xfffffaec
mov al, byte [0xac0d014]
test al, al
je 0xac01fb6
mov al, 1
jmp 0xac020a6
push dword [0xac0d010]
push str.SYSTEMCurrentControlSetServicesEventLogApplication_s
lea ecx, [esp + 0x11c]
push ecx
call fcn.0ac01c90
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x11c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x13c]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0xfffffff4
test eax, eax
je 0xac0200b
xor al, al
jmp 0xac020a6
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 0x104
lea ecx, [esp + 8]
push ecx
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA
test eax, eax
je 0xac020a4
lea eax, [esp + 4]
push eax
call fcn.0ac023e0
inc eax
push eax
lea ecx, [esp + 8]
push ecx
push 2
push 0
push str.EventMessageFile
mov eax, dword [esp + 0x120]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
mov ecx, eax
mov eax, dword [esp + 0x10c]
test ecx, ecx
je 0xac02064
push eax
call sub.ADVAPI32.DLL_RegCloseKey
xor al, al
jmp 0xac020a6
push 4
lea ecx, [esp + 4]
push ecx
push 4
push 0
push str.TypesSupported
push eax
mov dword [esp + 0x18], 7
call sub.ADVAPI32.DLL_RegSetValueExA
mov edx, eax
mov eax, dword [esp + 0x10c]
test edx, edx
je 0xac02099
push eax
call sub.ADVAPI32.DLL_RegCloseKey
xor al, al
jmp 0xac020a6
mov byte [0xac0d014], 1
mov al, 1
jmp 0xac020a6
xor al, al
sub esp, 0xfffffaec
ret

Function at 0xac02130
Capabilities:
Parse pe header

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp word [edi], 0x5a4d
je 0xac02146
push str.Invalid_DOS_signature
call fcn.0ac01e00
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
je 0xac0215b
push str.Invalid_PE_signature
call fcn.0ac01e00
mov eax, edi
pop edi
ret 4