joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100148d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x14], 0x65
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x14], 0x74
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x74
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x14], 0x47
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x14], 0
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x14], 0x65
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x14], 0x65
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x14], 0x53
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x14], 0x69
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x14], 0x6d
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x14], 0x54
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x79
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x14], 0x73
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x14], 0x6d
lea eax, [ebp - 0x14]
push eax
call fcn.10013320
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100149ab
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100149b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0xc], 0
call fcn.10013220
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10014b76
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x2c], 0x72
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x2c], 0x74
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x2c], 0x69
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x2c], 0x69
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x2c], 0x69
mov ecx, 1
imul edx, ecx, 0x16
mov byte [ebp + edx - 0x2c], 0x72
mov eax, 1
imul ecx, eax, 0x12
mov byte [ebp + ecx - 0x2c], 0x44
mov edx, 1
imul eax, edx, 0x17
mov byte [ebp + eax - 0x2c], 0x69
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x2c], 0x63
mov eax, 1
imul ecx, eax, 0x18
mov byte [ebp + ecx - 0x2c], 0x70
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x2c], 0x61
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x2c], 0x6e
mov edx, 1
imul eax, edx, 0x1c
mov byte [ebp + eax - 0x2c], 0
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x2c], 0x65
mov eax, 1
imul ecx, eax, 0x11
mov byte [ebp + ecx - 0x2c], 0x79
mov edx, 1
imul eax, edx, 0x15
mov byte [ebp + eax - 0x2c], 0x63
mov ecx, 1
imul edx, ecx, 0x14
mov byte [ebp + edx - 0x2c], 0x73
mov eax, 1
imul ecx, eax, 0x19
mov byte [ebp + ecx - 0x2c], 0x74
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x2c], 0x53
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x2c], 0x75
mov eax, 1
imul ecx, eax, 0x1a
mov byte [ebp + ecx - 0x2c], 0x6f
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x2c], 0x74
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x2c], 0x7a
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x2c], 0x69
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x2c], 0x6c
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x2c], 0x65
mov edx, 1
imul eax, edx, 0x1b
mov byte [ebp + eax - 0x2c], 0x72
mov ecx, 1
imul edx, ecx, 0x13
mov byte [ebp + edx - 0x2c], 0x65
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x2c], 0x49
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10014b6c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10014b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x14], 0x65
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x14], 0
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x14], 0x46
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x6c
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x72
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x14], 0x6f
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x14], 0x4c
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x14], 0x63
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x14], 0x61
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x14], 0x65
lea edx, [ebp - 0x14]
push edx
call fcn.10013320
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10014c30
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10014c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0x4f
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x14], 0x6e
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x14], 0x6f
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x14], 0x70
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x50
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x14], 0x72
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x14], 0x73
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x14], 0x65
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x14], 0x73
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x14], 0
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x14], 0x63
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x14], 0x65
lea edx, [ebp - 0x14]
push edx
call fcn.10013320
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10014d13
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10014d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x18], 0x50
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x18], 0
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x18], 0x69
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x18], 0x6d
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0x70
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x18], 0x61
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x18], 0x65
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x18], 0x6b
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x50
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x4e
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x18], 0x65
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x18], 0x65
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x18], 0x64
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x18], 0x65
lea eax, [ebp - 0x18]
push eax
call fcn.10013320
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10014e19
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10014e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
call fcn.10013220
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10014fc7
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x28], 0x72
mov edx, 1
imul eax, edx, 0x15
mov byte [ebp + eax - 0x28], 0x44
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x28], 0x70
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x28], 0x65
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x28], 0x63
mov eax, 1
imul ecx, eax, 0x18
mov byte [ebp + ecx - 0x28], 0x6c
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x28], 0x79
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x28], 0x44
mov eax, 1
shl eax, 4
mov byte [ebp + eax - 0x28], 0x69
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x28], 0x53
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x28], 0x65
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x28], 0x73
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x28], 0x69
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x28], 0x72
mov eax, 1
imul ecx, eax, 0x16
mov byte [ebp + ecx - 0x28], 0x61
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x28], 0x74
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x28], 0x6f
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x28], 0x53
mov ecx, 1
imul edx, ecx, 0x12
mov byte [ebp + edx - 0x28], 0x74
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x28], 0x74
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x28], 0x75
mov ecx, 1
imul edx, ecx, 0x19
mov byte [ebp + edx - 0x28], 0
mov eax, 1
imul ecx, eax, 0x14
mov byte [ebp + ecx - 0x28], 0x72
mov edx, 1
imul eax, edx, 0xe
mov byte [ebp + eax - 0x28], 0x63
mov ecx, 1
imul edx, ecx, 0x17
mov byte [ebp + edx - 0x28], 0x63
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x28], 0x65
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10014fbd
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10015050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
call fcn.100134f0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001511b
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x18], 0x74
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x18], 0x72
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x18], 0x6f
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], 0x54
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x18], 0x49
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x18], 0x57
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x18], 0x74
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x18], 0x53
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x18], 0x6e
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10015111
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x10015130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x20], 0x79
mov ecx, 1
imul edx, ecx, 0x11
mov byte [ebp + edx - 0x20], 0x69
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x73
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x20], 0x69
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x20], 0x74
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x20], 0x54
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x20], 0x6d
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x20], 0x65
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x20], 0x46
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x20], 0x54
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x20], 0x6c
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x20], 0x54
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x20], 0x6d
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x20], 0x53
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x20], 0x69
mov edx, 1
imul eax, edx, 0x13
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 0x14
mov byte [ebp + edx - 0x20], 0
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x20], 0x65
mov edx, 1
imul eax, edx, 0x12
mov byte [ebp + eax - 0x20], 0x6d
lea ecx, [ebp - 0x20]
push ecx
call fcn.10013320
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10015274
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10015280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0x57
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x14], 0
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x14], 0x65
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x14], 0x65
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x14], 0x72
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x14], 0x69
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x14], 0x69
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x14], 0x6c
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x14], 0x74
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x14], 0x46
lea ecx, [ebp - 0x14]
push ecx
call fcn.10013320
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10015341
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10015350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0xffffffff
call fcn.100136c0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10015435
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x18], 0x63
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x18], 0
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x18], 0x6c
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x18], 0x6b
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], 0x73
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x18], 0x63
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x18], 0x6f
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x18], 0x6f
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x18], 0x73
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x65
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x18], 0x74
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1001542b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10027f37
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10027bf7
Function at 0x424c30
Capabilities:
Create pipe

Disassembly:
mov eax, dword [0x436b20]
sub esp, 0x14
push ebx
mov ebx, dword [0x2bdbf9c]
push edi
mov edi, dword [0x2bde41c]
call fcn.00424bb0
cmp dword [0x2bde41c], 0x2f
jne 0x424c92
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00424be0
pop edi
pop ebx
add esp, 0x14
ret
Function at 0x424f70
Capabilities:
Get disk information
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x436004]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0x424f95
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x424fde
mov dword [0x2bde084], 0x8e46a6f0
cmp dword [0x2bde41c], 0x3dc
jne 0x424fdc
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x424f8c
mov dword [ebp - 0x10], 0
jmp 0x424ff0
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x425083
cmp dword [0x2bde41c], 0xa5f
jne 0x42503a
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x820]
push ecx
push str.lewujuyenehuzehiji
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x10], 0x84620b
jne 0x42505e
mov edx, dword [0x437940]
mov dword [0x2bde41c], edx
mov eax, dword [0x2bde41c]
add eax, 0xa231
mov dword [0x2bde41c], eax
cmp dword [0x2bde41c], 0x141
jne 0x42507e
mov dword [0x438f08], 0xec58acac
mov dword [0x438f0c], 0xffffffff
jmp 0x424fe7
call fcn.00424ca0
jmp dword [0x2bdbf9c]
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x9ce058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9ce1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9ce07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ce06a
add dl, dl
jne 0x9ce089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ce0dc
xor eax, eax
add dl, dl
jne 0x9ce096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ce17d
add dl, dl
jne 0x9ce0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ce0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ce0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ce0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9ce0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9ce075
mov eax, 1
add dl, dl
jne 0x9ce0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ce0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ce0e1
sub eax, ebx
mov ebx, 1
jne 0x9ce128
mov ecx, 1
add dl, dl
jne 0x9ce10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9ce119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ce105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ce075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9ce13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9ce14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ce136
cmp eax, 0x7d00
jae 0x9ce16d
cmp eax, 0x500
jb 0x9ce168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ce075
cmp eax, 0x7f
ja 0x9ce170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ce075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9ce19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9ce075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x8de150
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de156
pop ebp
sub ebp, 6
sub ebp, 0x4de150
jmp 0x8de1b4
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
invalid
jmp 0x8de1bd
mov eax, 0x4de150
add eax, ebp
add eax, 0x93
mov ecx, 0x641
mov edx, 0x276e6481
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de1d4
jmp 0x8de1e7
jmp 0x8de1aa
Function at 0x46c331
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x52166c]
cmp eax, 0xffffffff
jne 0x46c43d
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa2cea0
call sub.msvcrt.dll_memset
mov dword [0xa2cea0], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa2cee4
call sub.msvcrt.dll_memset
mov dword [esp + 0x24], 0xa2cee4
mov dword [esp + 0x20], 0xa2cea0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe__c_ver
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x46c433
mov eax, dword [0xa2cee4]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa2cee4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa2cee8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0x52166c], 1
jmp 0x46c43d
mov dword [0x52166c], 0
mov eax, dword [0x52166c]
leave
ret
Function at 0x47d42a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0047d026
test eax, eax
sete al
test al, al
je 0x47d456
mov eax, 0xfffffffe
mov edx, 0xffffffff
jmp 0x47d509
mov edx, dword [0x69273c]
mov eax, dword [ebp + 8]
shl eax, 3
mov ecx, eax
shl ecx, 4
mov edi, ecx
sub edi, eax
mov eax, edi
add eax, edx
mov dword [0xa1c1ac], eax
mov eax, dword [0xa1c1ac]
movzx eax, byte [eax + 0x70]
test al, al
je 0x47d48d
mov eax, 0xfffffffc
mov edx, 0xffffffff
jmp 0x47d509
mov eax, dword [0x692738]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa1c1b0], eax
mov edi, 0xa1c1b8
mov eax, dword [0xa1c1b0]
mov eax, dword [eax]
mov dword [esp + 4], 0xa1c1bc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [edi], eax
mov eax, dword [0xa1c1b8]
mov edx, dword [0xa1c1bc]
mov ebx, eax
and bh, 0xff
mov esi, edx
and esi, 0
mov eax, ebx
xor eax, 0xffffffff
or eax, esi
test eax, eax
jne 0x47d4fe
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
setne al
test al, al
je 0x47d4fe
mov eax, 0xfffffffd
mov edx, 0xffffffff
jmp 0x47d509
mov eax, dword [0xa1c1b8]
mov edx, dword [0xa1c1bc]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret