joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104a79f
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebx
push ebp
push esi
xor ebx, ebx
xor esi, esi
cmp dword [esp + 0x10], ebx
mov ebp, ecx
mov ecx, 0x80070057
jne 0x104a7b5
mov esi, ecx
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x104a7c2
cmp word [eax], bx
jne 0x104a7c4
mov esi, ecx
cmp esi, ebx
jl 0x104a89c
push edi
mov ecx, ebp
call fcn.0104a4d5
push dword [esp + 0x14]
lea eax, [ebp + 0x20]
push eax
call fcn.01001c83
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0x40
push 1
push ebx
push ebx
lea edi, [ebp + 0x24]
push edi
call esi
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x104a825
call ebx
cmp eax, 0x80090016
je 0x104a816
test eax, eax
jle 0x104a87f
and eax, 0xffff
or eax, 0x80070000
jmp 0x104a87f
push 0x48
push 1
push 0
push 0
push edi
call esi
test eax, eax
je 0x104a877
lea esi, [ebp + 0x2c]
push esi
push 0
push 0
push 0x8003
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x104a877
push 0
push dword [esp + 0x1c]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
push eax
push dword [esp + 0x20]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x104a877
lea eax, [ebp + 0x28]
push eax
push 1
push dword [esi]
push 0x6801
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x104a895
call ebx
test eax, eax
jg 0x104a883
call ebx
mov esi, eax
jmp 0x104a897
call ebx
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x104a897
xor esi, esi
test esi, esi
pop edi
jge 0x104a8a3
mov ecx, ebp
call fcn.0104a4d5
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x104a9fe
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
je 0x104aa15
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
cmp byte [ebp + 0x10], al
push esi
sete al
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x104aa4d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x104aa3f
call esi
jmp 0x104aa4f
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x104aa4f
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x104beae
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [ebp + 0xc]
push 0x419
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
je 0x104bf05
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x41d
push dword [ebp + 8]
call esi
test eax, eax
je 0x104bf05
mov eax, dword [edi]
cmp eax, dword [ebp - 0x10]
jg 0x104bf05
mov eax, dword [edi + 8]
cmp eax, dword [ebp - 8]
jl 0x104bf05
mov eax, dword [edi + 4]
cmp eax, dword [ebp - 0xc]
jg 0x104bf05
mov eax, dword [edi + 0xc]
cmp eax, dword [ebp - 4]
jl 0x104bf05
xor al, al
jmp 0x104bf07
mov al, 1
pop esi
leave
ret 8
Function at 0x104d926
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1069786
call fcn.010016d0
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [esi + 8], edi
call fcn.01002ee9
lea eax, [esi + 0x24]
mov dword [ebp - 4], edi
mov dword [eax], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
push edi
push eax
mov byte [ebp - 4], 5
call fcn.01001c83
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1050a17
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x106a493
call fcn.010016d0
push ecx
push ecx
push esi
mov esi, ecx
push edi
lea eax, [ebp - 0xd]
xor edi, edi
push eax
lea ecx, [esi + 0x14]
mov dword [ebp - 0x14], esi
mov dword [esi + 0xc], edi
call fcn.010505bf
lea eax, [ebp - 0xd]
push eax
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
call fcn.0100febc
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x2c], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1057c21
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.010046ac
push 0
push 1
mov ecx, ebx
call fcn.01055a77
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.01054b9f
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
je 0x1057c6f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
and byte [ebx + 0x44], 0
and byte [ebx + 0x38], 0
push esi
push 1
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x1057cb5
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x1057cb5
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x1057b93
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
jne 0x1057cd9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1057cc7
call esi
mov esi, eax
jmp 0x1057cdd
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1057cdd
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x10588a9
Capabilities:
Delete directory
Move file

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x54], ebx
push edi
je 0x10588da
mov eax, dword [esi + 0x64]
cmp eax, ebx
je 0x10588ca
push eax
push 0x102cac8
push dword [esi + 0x60]
call fcn.010256c8
mov eax, dword [esi + 0x54]
cmp eax, ebx
je 0x10588da
mov dword [esi + 0x54], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x50]
cmp eax, ebx
je 0x10588ea
mov dword [esi + 0x50], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x60]
cmp eax, ebx
je 0x10588fa
mov dword [esi + 0x60], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x68]
cmp eax, ebx
je 0x105890a
mov dword [esi + 0x68], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x1058918
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [esi + 0x8c]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x105892c
mov dword [eax], ebx
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [esi + 0x84], ebx
je 0x105894b
push 1
push 1
lea edi, [esi + 0x7c]
push edi
call fcn.0100853b
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.0102b2da
cmp dword [esi + 0x74], ebx
je 0x1058989
mov eax, dword [esi + 0x70]
add esi, 0x6c
cmp eax, ebx
mov edi, 0x102b8d8
jne 0x1058961
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x105897f
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x1058975
mov eax, edi
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.0102b2da
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1059613
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x106b585
call fcn.010016d0
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea eax, [esi + esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.010057d1
xor edi, edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
inc esi
push esi
push dword [ebp - 0x18]
mov byte [ebp - 4], 1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x102b8d8
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [ebp + 0x10]
cmp esi, edi
je 0x10596c9
mov eax, dword [esi]
cmp eax, edi
je 0x10596c9
movzx edi, word [eax]
test edi, edi
je 0x10596c9
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp + 0x10], eax
je 0x10596c9
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [esi]
push dword [ebp + 0x10]
mov ecx, edi
mov edi, eax
mov eax, ecx
inc esi
shr ecx, 2
inc esi
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0x10]
push eax
push 1
push dword [ebp + 0x10]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [ebx]
push 0
push 0x102bcf4
push 0
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x10]
mov ecx, ebx
push dword [ebx + 4]
push dword [ebp - 0x18]
call dword [eax + 0xc]
test eax, eax
jl 0x10596ff
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push 0x106dd60
push eax
call dword [ecx]
test eax, eax
jge 0x1059726
mov eax, dword [ebp - 0x10]
and byte [ebp - 4], 0
test eax, eax
je 0x1059710
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1059721
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or eax, 0xffffffff
jmp 0x1059799
push dword [ebp - 0x1c]
push 0xffffffffffffffeb
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x105976c
mov esi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xffffffffffffffec
push eax
call esi
mov edi, 0x10000
test edi, eax
je 0x105976c
push 0xffffffffffffffec
push dword [ebx + 4]
call esi
or eax, edi
push eax
push 0xffffffffffffffec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp + 0x14]
and byte [ebp - 4], 0
mov dword [eax], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1059786
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1059797
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1060b19
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
cmp ebx, eax
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
je 0x1060be7
cmp dword [ebp + 0xc], eax
je 0x1060be7
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
push 0x40
call edi
test eax, eax
mov dword [ebp - 4], eax
jne 0x1060b63
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x1060bee
push eax
push ebx
mov ecx, esi
call fcn.01060ac3
test eax, eax
mov dword [ebp + 8], eax
jne 0x1060c03
mov esi, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
lea eax, [ebp - 8]
push eax
push 0
push 1
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x1060b55
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
push 0x40
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
je 0x1060b55
lea eax, [ebp - 8]
push eax
push edi
push 1
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1060bc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x1060bd9
mov eax, dword [ebp - 8]
cmp word [edi + eax*2 - 2], 0xa
jne 0x1060bd9
lea eax, [edi + eax*2 - 4]
cmp word [eax], 0xd
jne 0x1060bd9
and word [eax], 0
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x1060bee
mov dword [ebp + 8], 0x57
cmp dword [ebp + 8], 0
je 0x1060c03
cmp dword [ebp - 0xc], 0
je 0x1060c03
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x1060c15
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
leave
ret 8

Function at 0x1061b29
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x106fa40
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1061b81
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x106fa7c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1061b74
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1061b83
xor eax, eax
pop esi
leave
ret 4
Function at 0x1061cbd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x2d], 0
je 0x1061cda
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
jmp 0x1061d1a
cmp dword [ebp + 8], 0
jne 0x1061ce4
xor eax, eax
jmp 0x1061d0c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.010057d1
mov eax, esp
push 0
push esi
push dword [ebp + 8]
push eax
call fcn.0102498d
mov esi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1061d11
sub eax, edx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1061d4d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1061d3f
call esi
jmp 0x1061d4f
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x1061d4f
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
leave
ret 4

Function at 0x1065184
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x106ce8c
call fcn.010016d0
sub esp, 0x4c
push ebx
push esi
push edi
lea eax, [ebp + 0xb]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.01003112
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], 0x3c
call fcn.010026b3
xor edi, edi
mov esi, eax
inc edi
cmp esi, ebx
jl 0x1065239
mov eax, dword [ebp - 0x18]
cmp eax, ebx
mov dword [ebp - 0x54], 0x400
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], 0x106fd1c
mov dword [ebp - 0x48], 0x102b8d8
je 0x10651ed
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x10651fc
cmp word [eax], bx
mov dword [ebp - 0x44], eax
jne 0x10651ff
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1065237
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1065225
call esi
mov esi, eax
jmp 0x1065239
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1065239
xor esi, esi
cmp dword [ebp - 0x20], ebx
je 0x1065247
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea ecx, [ebp - 0x1c]
call fcn.01001890
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x10aac36
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, ebx
mov esi, ebx
mov eax, ebx
add eax, dword [ebx + 0x3c]
jmp 0x10afa7d
nop
push 0
pop eax
mov esi, esi
imul eax, eax, 0xf
push eax
nop
cmc
mov al, al
cmc
test ebp, 0xa68dab4a
cld
cmc
mov esi, esi
movzx eax, byte [edi]
jmp 0x10aaeeb
ret
lea esi, [esi]
cmp ecx, dword [edx + 0x18]
lea esi, [esi]
lea edi, [eax + ebx]
nop
je 0x10aacd4
jmp 0x10aac66
nop
pop eax
ja 0x10aac6c
lea esi, [esi]
xor eax, 0xf7d32f55
jmp 0x10aaefd
wait
mov esi, esi
cld
sub dword [esp], eax
lea edi, [edi + 1]
cmp byte [edi], 1
jmp 0x10aadb6
cld
sbb eax, dword [esp + 4]
nop
cld
jne 0x10aaf17
lea esi, [ebx]
jmp 0x10aaf3b
pop ecx
mov al, al
add dh, 0
inc ecx
lodsd eax, dword [esi]
jmp 0x10aada0
nop
lea edi, [ebx]
add edi, dword [edx + 0x1c]
mov al, 0x34
add esi, dword [edx + 0x24]
mov dl, 0x41
lea edx, [esp + ebp*8]
sub edx, 0x8a6a8ab1
push ebx
lea esi, [esi + ecx*2]
jmp 0x10afa39
inc edx
movzx eax, word [esi]
xchg edx, edx
inc edx
pop esi
add esi, dword [edi + eax*4]
add cl, 0x8f
ret 4
test ecx, edx
xchg edi, edi
add edx, dword [eax + 0x78]
push 0xffffffffffffffff
dec edi
add esi, dword [edx + 0x20]
jmp 0x10aaf11

Function at 0x10aac91
Capabilities:
Encode data using xor

Disassembly:
xor edi, eax
rdtsc
ret
inc dword [ebp + 0x4aad]
mov edx, 0xba3cb373
call esi
xor eax, edi
je fcn.010aac91
jmp 0x10aac52

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x409e8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x409e9b
pop dword [ebp - 0x38]
mov eax, 0x409e9b
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x8aea15bb
sub dword [ebp - 0x48], 0x3c97d070
mov dword [ebp - 0x44], 0x2d645da5
sub dword [ebp - 0x44], 0xfb311160
mov dword [ebp - 0x40], 0xb9d3518c
add dword [ebp - 0x40], 0x9278f2a2
mov dword [ebp - 0x3c], 0x1e71d416
sub dword [ebp - 0x3c], 0x1e71d416
lea eax, [ebp - 0x48]
push eax
mov eax, 0xb35b030
sub eax, 0xaf4dfdc
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x236ad250
sub dword [ebp - 0x48], 0xaef868fa
mov dword [ebp - 0x44], 0x3afb6ef2
sub dword [ebp - 0x44], 0xf98f0d7d
mov dword [ebp - 0x40], 0x38d2da0
add dword [ebp - 0x40], 0x5fe23ecc
mov dword [ebp - 0x3c], 0x3ed6689d
add dword [ebp - 0x3c], 0xc1299763
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x26b7433
add eax, 0xfdd55c19
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3860a
push 0
call eax
mov ecx, 0xb47ce8e5
sub ecx, 0xb47ca5ee
xor edx, edx
add edx, eax
mov ebx, 0x61a05487
add ebx, 0x9ea15b79
add ebx, dword [ebp - 0x38]
mov esi, 0xce6451d4
sub esi, 0xf6e6d761
xor dword [ebp - 0x28], 0xdcb0e6da
mov edi, dword [ebx]
sub edi, esi
sub dword [ebp - 0x18], 0x91fbafda
mov dword [edx], edi
sub dword [ebp - 4], 0x999f6469
add edx, 4
add ebx, 4
loop 0x409fba
add eax, 0xfeaf
mov ebx, eax
add eax, 0x997b251e
add eax, 0x6684dae7
mov ecx, 0x90ceb9f2
add ecx, 0x6f71460e
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x657564
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
push ebp
push 0x65767a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x66fc58]
mov edx, dword [0x670468]
mov edx, dword [edx]
call fcn.0040b204
je 0x657664
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407dac
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
mov eax, 0x657688
mov dword [ebp - 0x30], eax
mov eax, dword [0x66fc58]
call fcn.0040ae60
mov dword [ebp - 0x2c], eax
mov eax, dword [0x67057c]
add eax, 0x130a
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x40]
mov eax, dword [0x66fc58]
call fcn.00425d10
mov eax, dword [ebp - 0x40]
call fcn.0040ae60
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
je 0x657653
mov eax, dword [ebp - 4]
test eax, eax
je 0x657664
xor edx, edx
push ebp
push 0x65764c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xffffffffffffffff
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [0x67057c]
movzx eax, byte [eax + 0x230b]
mov edx, dword [0x67057c]
mov byte [edx + 0x230b], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657664
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
call sub.kernel32.dll_GetLastError
mov edx, eax
mov eax, dword [0x66fc58]
call fcn.00657060
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x657681
lea eax, [ebp - 0x40]
call fcn.0040a3bc
ret

Function at 0x659468
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov byte [ebp - 5], 0
xor eax, eax
mov dword [edi], eax
xor eax, eax
mov dword [esi], eax
push ebx
mov eax, dword [ebp - 4]
call fcn.0040ae60
push eax
push 0
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
je 0x6594d0
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6594d0
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov dword [esi], eax
cmp dword [esi], 0
je 0x6594d0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LockResource
mov dword [edi], eax
cmp dword [edi], 0
setne byte [ebp - 5]
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x45af82
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045ac33

Function at 0x45af8d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045adbd

Function at 0x45d112
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045cd8f

Function at 0x401411
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x150
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
call esi
push edx
mov dword [ebp - 0x124], eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x118], 6
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push edx
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x11c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push ecx
push ecx
mov dword [esp], 0
mov dword [ebp - 0x120], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea eax, [ebp - 0x134]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push eax
mov dword [esp], 0
call esi
lea esi, [ebp - 0x10c]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathA]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
sub esp, 0x1c
call ebx
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 5]
push esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x40162e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.00401411
test eax, eax
jne 0x4016c8
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x402132
sub eax, 0x4016d0
mov dword [esp], 0x4016d0
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4016c8
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401382
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004015b7
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b400
mov dword [esp], 0x40300c
call fcn.00401e35
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret