joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e4c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x47e501.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x47e501.2
jmp dword [eax*4 + 0x47e58c]
mov word [esp + 0x48], di
jmp 0x47e53a
mov word [esp + 0x48], 2
jmp 0x47e53a
mov word [esp + 0x48], 3
jmp 0x47e53a
mov word [esp + 0x48], 4
jmp 0x47e53a
mov word [esp + 0x48], 7
jmp 0x47e53a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x47e584
cmp dword [esp + 0x70], edi
je 0x47e570
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x47f7f0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x47f81a
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x47f81a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
ret

Function at 0x47f870
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x47f902
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x47f8f4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x47f8ec
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x47f8b5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x47fff0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x480070
push edi
call dword [0x4a2798]
add esp, 4
test eax, eax
jbe 0x480070
test esi, esi
je 0x48002e
cmp esi, 0xffffffff
je 0x48002e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x4800b2
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x48005c
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x480070
jmp 0x48006b
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x480070
mov ebp, 1
test esi, esi
je 0x4800b2
cmp esi, 0xffffffff
je 0x4800b2
test ebp, ebp
jne 0x4800e9
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x4800bf
call edi
test eax, eax
je 0x4800b2
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x4800e9
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x48009a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x4800b2
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x4800e9
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x4800cc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call dword [0x4a2798]
inc eax
push eax
call fcn.0047bab0
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x480860
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x480876
mov eax, 1
pop edi
add esp, 0x10
ret
push edi
call fcn.004824d0
add esp, 4
test eax, eax
jne 0x48088d
mov eax, 1
pop edi
add esp, 0x10
ret
mov eax, dword [edi]
push ebx
push ebp
mov ebp, 1
cmp eax, ebp
push esi
mov dword [esp + 0x10], ebp
je 0x480931
cmp eax, 3
je 0x480931
cmp eax, 2
jne 0x4809d5
mov esi, dword [edi + 4]
mov ecx, esi
call fcn.00482710
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov edi, eax
cmp edi, ebx
jae 0x4809d5
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], 0
test eax, eax
je 0x4809d5
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4809d5
mov edx, dword [esi]
lea eax, [esp + 0x28]
push ebp
push eax
mov ecx, esi
call dword [edx + 0x20]
mov edx, dword [esi]
push 0
push edi
mov ecx, esi
mov ebx, eax
call dword [edx + 0x18]
test ebx, ebx
je 0x4809d5
mov al, byte [esp + 0x28]
test al, al
je 0x480923
cmp al, 0x1a
jne 0x4809d5
mov dword [esp + 0x10], ebp
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
mov esi, dword [edi + 4]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push esi
mov dword [esp + 0x24], eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4809d5
cmp ebx, dword [esp + 0x14]
jae 0x4809d5
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], 0
test eax, eax
je 0x4809d5
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4809d5
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x30]
push 1
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push esi
mov dword [esp + 0x24], eax
call ebp
cmp dword [edi], 3
jne 0x4809b9
mov ecx, dword [edi + 0xc]
lea eax, [edi + 0x10]
push eax
add edi, 0x34
push ecx
push edi
lea edx, [esp + 0x34]
push 1
push edx
push ebx
call fcn.004817a0
add esp, 0x18
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4809d5
mov al, byte [esp + 0x28]
test al, al
je 0x4809cd
cmp al, 0x1a
jne 0x4809d5
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x4809f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x480a05
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push edi
call fcn.004824d0
add esp, 4
test eax, eax
jne 0x480a18
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x28]
test esi, esi
jg 0x480a28
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi]
xor ebx, ebx
cmp eax, 1
jne 0x480a81
mov edi, dword [edi + 4]
push esi
call fcn.0048e7ae
add esp, 4
mov ebp, eax
lea eax, [esp + 0x1c]
push ebx
push eax
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x480a63
push ebp
call fcn.0048e7d7
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x1c]
push ecx
push ebp
call fcn.00481a60
push ebp
mov ebx, eax
call fcn.0048e7d7
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp eax, 2
jne 0x480acc
mov edi, dword [edi + 4]
lea edx, [esi + 8]
push edx
call fcn.0047bab0
mov ebx, eax
add esp, 4
lea ecx, [ebx + 8]
mov dword [ebx], 1
mov dword [ebx + 4], esi
mov eax, dword [edi]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x20]
test eax, eax
jne 0x480ac1
push ebx
call fcn.0047bc50
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
mov dword [ebx + 4], eax
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
cmp eax, 3
jne 0x480b45
mov ebx, dword [edi + 4]
push esi
call fcn.0048e7ae
add esp, 4
mov ebp, eax
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x1c]
push 0
push edx
push esi
push ebp
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x480b15
push ebp
call fcn.0048e7d7
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [edi + 0xc]
mov eax, dword [esp + 0x1c]
lea ecx, [edi + 0x10]
add edi, 0x34
push ecx
push edx
push edi
mov esi, eax
push eax
mov eax, dword [esp + 0x20]
push ebp
push eax
call fcn.004817a0
push esi
push ebp
call fcn.00481a60
push ebp
mov ebx, eax
call fcn.0048e7d7
add esp, 0x24
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x480f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x480f41
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x480f9b
inc edi
cmp edi, esi
jl 0x480f35
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x480fd0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x480f8a
cmp byte [eax], bl
je 0x480fa5
cmp byte [eax + 1], bl
je 0x480fae
cmp byte [eax + 2], bl
je 0x480fb8
cmp byte [eax + 3], bl
je 0x480fc4
add eax, 4
cmp eax, edi
jb 0x480f61
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x4815b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x4815e2
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], 0x100
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x481642
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x481619
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x4816f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x48178c
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x48171b
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret

Function at 0x491179
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4911bb
call fcn.004944ce
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4911bb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4911b2
xor eax, eax
jmp 0x4911c3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004911c9
pop edi
pop esi
pop ebx
ret 4
Function at 0x49215a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x495ca4
call fcn.00484490
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.004944ce
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x492199
call fcn.004944ce
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4921a7
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4921b5
or eax, 0xffffffff
jmp 0x49229d
mov ecx, esi
call fcn.004920d0
mov dword [ebp - 0x14], eax
call fcn.0048f7c4
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x4921ec
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4921ec
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0048f778
push dword [ebp - 0x14]
call fcn.0048f2a9
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00491e68
cmp eax, edi
je 0x49225f
test byte [esi + 0x24], 0x10
je 0x49222d
push 4
mov ecx, esi
pop ebx
call fcn.0048eca9
test ah, 1
je 0x492225
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.004912cb
cmp dword [esi + 0x1c], edi
je 0x49225f
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0048ecdd
jmp 0x49225f
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x492273
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x49228c
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x49228c
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0049210a
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x494040
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49406e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49408c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00493fa6
jmp 0x49408c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49408c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00493fa6
test edi, edi
mov eax, edi
jne 0x494076
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x7b1f2b02
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x6b3a5b4a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x43b663
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub edx, 0x4559282e
call fcn.0043b695
and ecx, edx
mov edx, 0xa7a0f564
xor dword [edi], eax
add ecx, edx
inc edi
dec ecx
cmp edi, esi
jne fcn.0043b663
dec edx
or edx, edx
and edx, ecx
ret
Function at 0x1000df80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10089280]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x3ebc9f98
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
sub eax, 0x3b6bce25
je 0x1000dff2
jmp 0x1000dfba
mov eax, dword [ebp - 0x20]
sub eax, 0x3ebc9f98
je 0x1000dfd2
jmp 0x1000dfcd
jmp 0x1000e035
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push eax
mov edx, esp
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
mov dword [ebp - 0x14], 0x3b6bce25
jmp 0x1000e035
mov edx, dword [ebp - 0x10]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [ebp - 0xc]
mov edi, dword [edx]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x63
sub byte [edi], 0x27
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x1000e004
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10029850
lea esp, [ebp - 4]
pop edi
pop ebp
ret
jmp 0x1000dfa4
Function at 0x100100f0
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Execute shellcode via indirect call
Hide graphical window
Parse credit card information
Parse pe header
Resume thread

Disassembly:
jmp 0x1001abba
push ebp
rcl eax, cl
lahf
mov ebp, esp
or eax, ebx
bswap ax
mov ah, 0x92
push ebx
add al, 0xd
push edi
push esi
lea esp, [esp - 0x204]
add ah, 0x33
adc ax, sp
mov eax, dword [0x10089280]
xor eax, ebp
mov dword [ebp - 0x10], eax
adc ax, bp
shld ax, bp, 0x95
mov dword [ebp - 0x20c], 0xade8baa7

Function at 0x1002e86a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002e8a9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002e8a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002e8a9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002e8a9
cmp dword [ecx + 0x74], 0xe
jbe 0x1002e8a9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10031234
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100312d1
push ebx
push esi
call fcn.100311fd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10031191
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1003127e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100312d0
push edi
push eax
call fcn.1002fb32
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1003129e
call fcn.1002fb80
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100312cf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10031191
add esp, 0x20
test eax, eax
jne 0x100312bd
push edi
call fcn.1002fb80
jmp 0x100312c5
push ebx
call fcn.1002fb80
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1003153e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100393e0
push 0x100393d8
push str.FlsAlloc
push 0x1f
call fcn.1003145a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10031572
push dword [ebp + 8]
mov ecx, esi
call dword [0x10037150]
call esi
jmp 0x10031578
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100315bc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100393f0
push 0x100393e8
push str.FlsGetValue
push 0x21
call fcn.1003145a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100315f3
push dword [ebp + 8]
mov ecx, esi
call dword [0x10037150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100315fb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100393f8
push 0x100393f0
push str.FlsSetValue
push 0x22
call fcn.1003145a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10031635
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10037150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]