joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x818208]
sub esp, 0x20c
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x40324d
cmp dword [0x81820c], 0
jne 0x403239
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.00401c00
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x4030f0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41c0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x403100
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41c0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x403135
push 0x200
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00401c00
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x403194
sub edx, esi
sar edx, 1
je 0x40324d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x4031b0
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x200
ja 0x40324d
xor eax, eax
push ebx
test edx, edx
je 0x4031e8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x4031e8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x4031d1
xor eax, eax
test edx, edx
je 0x403202
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x403202
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x4031f0
xor eax, eax
test edx, edx
je 0x40321f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x40321f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x403210
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x818208]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x403830
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x403858
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x403866
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x40387f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x40388d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x4038a6
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x4038b4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x4038cd
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x4038db
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x403922
add dword [esp], 5
retf
Function at 0x41b3e2
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x404278
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x42c
lea ebx, [esp + 0xf]
and ebx, 0xfffffff0
xor eax, eax
lea esi, [esi]
mov dword [ebx + eax*4], eax
inc eax
cmp eax, 0x100
jne 0x404290
jmp loc.00489e88

Function at 0x40437c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x37c
mov ebx, dword [ebp + 0xc]
xor esi, esi
jmp 0x404399
jmp loc.00486e18

Function at 0x404698
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x13c
mov dword [esp + 8], str.zzzzzzzz
mov dword [esp + 4], 0
mov dword [esp], 0x1f0001
call sub.KERNEL32.dll_OpenMutexA
sub esp, 0xc
test eax, eax
je 0x4046d4
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret 0x10
mov dword [esp + 8], str.zzzzzzzz
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov dword [esp + 8], 0x104
lea ebx, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
xor esi, esi
jmp 0x404721
inc esi
cmp esi, 0x2faf080
je 0x404730
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x63
jne 0x404718
cmp esi, 0x63
jne 0x404718
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_FindResourceA
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x4046c7
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_SizeofResource
sub esp, 8
mov dword [ebp - 0x12c], eax
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.KERNEL32.dll_LoadResource
sub esp, 8
test eax, eax
je 0x4046c7
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
push esi
mov edi, eax
test eax, eax
je 0x4046c7
mov dword [esp + 8], 2
mov dword [esp + 4], 2
mov dword [esp], 0
call sub.KERNEL32.dll_FindResourceA
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x4046c7
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_SizeofResource
sub esp, 8
mov dword [ebp - 0x130], eax
jmp 0x488d58

Function at 0x4048e8
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov eax, dword [0x411070]
lea edx, [eax - 2]
lea eax, [ebx + eax]
nop
dec edx
mov cl, byte [eax - 3]
dec eax
cmp cl, 0xcc
je 0x404900
sub edx, 4
lea eax, [ebx + edx]
mov esi, eax
jmp loc.00489c30
Function at 0x407c00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x407c26
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x407cba
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x407c75
cmp eax, 0x40
je 0x407c75
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x407c19
cmp eax, 0x40
je 0x407c19
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x407c19
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
jmp 0x486580

Function at 0x407f30
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00407f10
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
je 0x407fd0
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x407fdf
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00404698
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret

Function at 0x4082f8
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x416798]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x408334
mov dword [ebx + 0x24], eax
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00408ed0
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x28], eax
jmp loc.00484320
call sub.KERNEL32.dll_GetLastError
jmp 0x408322
Function at 0x408458
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x1c], edx
mov eax, dword [esi]
jmp 0x408481
mov dword [eax + 0x20], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
test eax, eax
je 0x408548
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, 0xa
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [ebp - 0x20]
test eax, eax
jne 0x40856c
cmp edi, 5
je 0x408571
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x40850b
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 8], eax
jmp 0x485a90
mov eax, dword [esi]
mov edi, dword [eax]
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x40855c
test edx, edx
je 0x408478
mov dword [esp + 4], edi
mov eax, dword [eax + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
jne 0x40847b
call sub.KERNEL32.dll_GetLastError
jmp 0x40847b
mov dword [ebp - 0x2c], 0
mov edi, 5
mov al, 0x1a
jmp 0x408496
call fcn.0040833c
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
jmp 0x40851b
mov edi, 2
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x40857c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [edx]
mov eax, dword [0x416798]
mov ecx, dword [eax + 0x28]
test ecx, ecx
js 0x4085d0
test ecx, ecx
jne 0x4085a8
mov dword [eax + 0x20], ebx
mov edx, dword [edx]
jmp 0x48a0e0
mov dword [esp + 4], ebx
mov eax, dword [eax + 0x24]
mov dword [esp], eax
mov dword [ebp - 0xc], edx
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
test eax, eax
mov edx, dword [ebp - 0xc]
jne 0x408598
call sub.KERNEL32.dll_GetLastError
mov edx, dword [ebp - 0xc]
jmp 0x408598
mov dword [ebp - 0xc], edx
call fcn.0040833c
mov eax, dword [0x416798]
mov ecx, dword [eax + 0x28]
mov edx, dword [ebp - 0xc]
jmp 0x408591
Function at 0x40874c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x408831
test edx, edx
jne 0x4087d0
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4087c3
lea esi, [ebp - 0x20]
jmp 0x408783
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4087ba
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 1
mov dword [esp], 1
call eax
cmp eax, 6
je 0x4087f8
cmp eax, 8
jne 0x408824
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
jne 0x408780
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov edi, dword [eax + 0x24]
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edi
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push ecx
mov eax, dword [ebp - 0x2c]
jmp 0x40876f
mov dword [ebx + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, esi
mov eax, ebx
call fcn.004083b4
cmp eax, 7
jne 0x4087c8
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.0040857c
nop
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
call fcn.0040833c
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
jmp 0x408768
Function at 0x408844
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x408868
mov dword [esp], ebx
call fcn.0040874c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x4088bc
test edx, edx
jne 0x408898
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.00408458
cmp eax, 7
je 0x4088cc
jmp loc.00488bc8
mov edi, dword [eax + 0x24]
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x40887b
call fcn.0040833c
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
jmp 0x408874
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.0040857c
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x408958
test edx, edx
jne 0x408934
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
lea esi, [ebp - 0x1c]
jmp 0x40890d
cmp ebx, 5
je 0x40892a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
cmp eax, 1
sbb ebx, ebx
and ebx, 5
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], esi
call edi
test eax, eax
je 0x408900
mov ebx, 3
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov esi, dword [eax + 0x24]
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
mov dword [esp], esi
call sub.KERNEL32.dll_TlsGetValue
push esi
mov dword [esp], ebx
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push ebx
mov eax, dword [ebp - 0x2c]
jmp 0x4088f7
call fcn.0040833c
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
jmp 0x4088f0

Function at 0x408968
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
test edx, edx
js 0x4089ec
test edx, edx
jne 0x4089c8
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x4089ac
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.004083b4
cmp eax, 7
je 0x4089bd
jmp 0x48a1a8
lea esi, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.00408458
cmp eax, 7
jne 0x4089a5
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.0040857c
nop
mov edi, dword [eax + 0x24]
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [esp], edi
call sub.KERNEL32.dll_TlsGetValue
push edx
mov dword [esp], esi
mov dword [ebp - 0x2c], eax
call sub.KERNEL32.dll_SetLastError
push eax
mov eax, dword [ebp - 0x2c]
jmp 0x408987
call fcn.0040833c
mov eax, dword [0x416798]
mov edx, dword [eax + 0x28]
jmp 0x408980

Function at 0x408d00
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
jmp loc.004892d0
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x615f0050
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x681575f
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push esi
push edi
xor edi, edi
cmp dword [0x2afa6dc], 0x594
mov dword [ebp - 8], eax
jne 0x40103b
push edi
lea eax, [ebp - 0x830]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x421c68]
mov dword [ebp - 0x20], eax
mov eax, dword [0x421c6c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
call fcn.00401000
mov eax, dword [0x421c70]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x421c74]
add esi, 0x23f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
cmp dword [0x2afa6dc], 0xc
mov dword [ebp - 4], eax
jne 0x4010b6
push edi
lea eax, [ebp - 0x430]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push edi
lea eax, [ebp - 0x30]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push edi
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2afa6dc]
cmp eax, 0xfa9
jne 0x4010d2
mov dword [0x2afa6d8], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ed
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x2afa08c], edi
mov ecx, dword [ebp - 0xc]
mov edx, ebx
lea eax, [esi + ebx]
shr edx, cl
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [0x2afa6d4], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor edx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
lea ecx, [esi + eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
shr eax, cl
add eax, dword [ebp - 0x24]
mov ecx, eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
xor dword [ebp - 4], ecx
sub ebx, dword [ebp - 4]
add esi, 0x61c88647
dec dword [ebp - 0x1c]
jne 0x401076
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x4036da
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42129c]
jne 0x4036e4
repz ret
jmp fcn.00405ebb

Function at 0x405823
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402ef5
and dword [ebp - 4], 0
cmp dword [0x425f84], 0
mov ebx, eax
jne 0x4058d4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405985
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405985
push eax
call fcn.00402e83
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425f84], eax
call esi
push eax
call fcn.00402e83
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425f88], eax
call esi
push eax
call fcn.00402e83
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x425f8c], eax
call esi
push eax
call fcn.00402e83
pop ecx
mov dword [0x425f94], eax
test eax, eax
je 0x4058d4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402e83
pop ecx
mov dword [0x425f90], eax
mov eax, dword [0x425f90]
cmp eax, ebx
je 0x40592c
cmp dword [0x425f94], ebx
je 0x40592c
push eax
call fcn.00402efe
push dword [0x425f94]
mov esi, eax
call fcn.00402efe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40592c
test edi, edi
je 0x40592c
call esi
test eax, eax
je 0x405923
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405923
test byte [ebp - 0xc], 1
jne 0x40592c
or dword [ebp + 0x10], 0x200000
jmp 0x405965
mov eax, dword [0x425f88]
cmp eax, ebx
je 0x405965
push eax
call fcn.00402efe
pop ecx
test eax, eax
je 0x405965
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405965
mov eax, dword [0x425f8c]
cmp eax, ebx
je 0x405965
push eax
call fcn.00402efe
pop ecx
test eax, eax
je 0x405965
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425f84]
call fcn.00402efe
pop ecx
test eax, eax
je 0x405985
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405987
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41afc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x3f7caa0]
xor edx, edx
cmp eax, edx
jne 0x41afe6
xor eax, eax
mov byte [eax + 0x3f7c9a0], al
inc eax
cmp eax, 0x100
jl 0x41afce
mov dword [0x3f7caa0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x3f7c9a0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x41b077
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x41b04a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x41b018
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41b0f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41b143
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41b12a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret