joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a60
Capabilities:
Encode data using xor

Disassembly:
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov al, byte [0x4102d8]
test byte [edi], dl
and bl, ch
invalid
push ebp
mov ebp, esp
sub esp, 0xc
jb 0x404aad
or al, 0x53
push esi
push edi
lea edi, [ecx + ebp - 0x30]
loop 0x404a6a
cmp edx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], edx
jae 0x404a15
mov eax, dword [eax + 0x26]
sub byte [esi + 0x2468461], 0
add byte [edx + 0xc], ch
invalid
adc byte [esi + 0x2f], bl
rcr dword [ebx - 0x28], 0xe5
pop ebp
ret 0x2fae
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1fbb7197
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x3ef65784
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4cd710
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7f000]
lea eax, [edi + 0xbda28]
push dword [eax]
mov dword [eax], 0xe1971557
push eax
push edi
or ebp, 0xffffffff
jmp 0x4cd742
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4cd749
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cd738
mov eax, 1
add ebx, ebx
jne 0x4cd75b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4cd76c
jne 0x4cd78b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cd78b
dec eax
add ebx, ebx
jne 0x4cd778
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4cd750
add ebx, ebx
jne 0x4cd787
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4cd7dd
xor ecx, ecx
sub eax, 3
jb 0x4cd7a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4cd812
sar eax, 1
mov ebp, eax
jmp 0x4cd7ae
add ebx, ebx
jne 0x4cd7ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cd77c
inc ecx
add ebx, ebx
jne 0x4cd7bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cd77c
add ebx, ebx
jne 0x4cd7c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4cd7be
jne 0x4cd7da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4cd7be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4cd7fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4cd7ee
jmp 0x4cd73e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4cd7fc
add edi, ecx
jmp 0x4cd73e
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x29f7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4cd81e
cmp byte [edi], 0x26
jne 0x4cd81e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4cd823
lea edi, [esi + 0xc8000]
mov eax, dword [edi]
or eax, eax
je 0x4cd892
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xcd1dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcd25c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4cd850
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcd264]
or eax, eax
je 0x4cd88c
mov dword [ebx], eax
add ebx, 4
jmp 0x4cd86d
call dword [esi + 0xcd260]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4cd8c3
cmp al, 0xef
ja 0x4cd8b6
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4cd898
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4cd8a5
mov ebp, dword [esi + 0xcd268]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4cd8f7
sub esp, 0xffffff80
jmp 0x450cac
Function at 0x1000233e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp eax, 0x10
jl 0x1000239f
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, dword [ebp + 0x10]
push esi
shr eax, 4
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 8]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10001451
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
push 0x10
pop esi
mov cl, byte [ebx + eax]
xor byte [eax], cl
inc eax
dec esi
jne 0x1000237a
mov edi, dword [ebp + 0xc]
add dword [ebp - 4], 0x10
lea esi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub ebx, 0x10
dec dword [ebp - 8]
movsd dword es:[edi], dword [esi]
mov dword [ebp + 0x10], eax
jne 0x1000235b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100030d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x1000310a
push esi
movzx esi, byte [ecx]
dec dword [ebp + 8]
mov edx, eax
shr edx, 0x18
xor edx, esi
and edx, 0xff
shl eax, 8
xor eax, dword [edx*4 + 0x10017288]
inc ecx
cmp dword [ebp + 8], 0
jne 0x100030e5
pop esi
pop ebp
ret

Function at 0x10003200
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x10021ca8]
cmp eax, 0x270
jl 0x100031cc
push esi
push edi
xor esi, esi
mov edx, closesocket
mov ecx, esi
mov eax, dword [ecx*4 + 0x100212ec]
xor eax, dword [ecx*4 + 0x100212e8]
and eax, edx
xor eax, dword [ecx*4 + 0x100212e8]
mov edi, eax
shr eax, 1
and edi, 1
xor eax, dword [edi*4 + 0x1001ce14]
xor eax, dword [ecx*4 + 0x1002191c]
inc esi
mov dword [ecx*4 + 0x100212e8], eax
cmp esi, 0xe3
jl 0x10003125
cmp esi, 0x26f
jge 0x1000319e
lea ecx, [esi*4 + 0x100212e8]
mov eax, dword [ecx]
xor eax, dword [ecx + 4]
and eax, edx
xor eax, dword [ecx]
mov edi, eax
and edi, 1
mov edi, dword [edi*4 + 0x1001ce14]
xor edi, dword [ecx - 0x38c]
shr eax, 1
xor edi, eax
mov dword [ecx], edi
add ecx, 4
cmp ecx, 0x10021ca4
jl 0x10003172
mov ecx, dword [0x10021ca4]
mov eax, dword [0x100212e8]
xor eax, ecx
and eax, edx
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
xor eax, dword [ecx*4 + 0x1001ce14]
pop edi
xor eax, dword [0x10021918]
pop esi
mov dword [0x10021ca4], eax
xor eax, eax
mov ecx, dword [eax*4 + 0x100212e8]
inc eax
mov dword [0x10021ca8], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x100212e0]
je 0x10003247
mov dword [0x100212e0], eax
mov dword [0x100212e8], eax
xor eax, eax
inc eax
mov ecx, 0x100212e8
push esi
mov edx, dword [ecx]
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul esi, esi, 0x6c078965
add esi, eax
mov dword [ecx + 4], esi
add ecx, 4
inc eax
cmp ecx, 0x10021ca4
jl 0x10003221
mov dword [0x10021ca8], eax
pop esi
jmp 0x1000310c
Function at 0x100032d2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov cl, byte [eax + 0x100]
push ebx
push esi
inc cl
movzx edx, cl
lea esi, [edx + eax]
mov dl, byte [esi]
mov byte [ebp - 1], dl
mov dl, byte [eax + 0x101]
add dl, byte [ebp - 1]
push edi
movzx edi, dl
add edi, eax
mov bl, byte [edi]
mov byte [esi], bl
mov bl, byte [ebp - 1]
mov byte [edi], bl
movzx esi, byte [esi]
movzx edi, bl
add esi, edi
and esi, 0xff
mov bl, byte [esi + eax]
mov esi, dword [ebp + 8]
xor byte [esi], bl
xor esi, esi
inc esi
mov dword [ebp - 0xc], esi
cmp dword [ebp + 0xc], esi
jbe 0x10003371
inc cl
movzx esi, cl
mov bl, byte [esi + eax]
add dl, bl
mov byte [ebp - 1], bl
movzx edi, dl
add edi, eax
mov bl, byte [edi]
mov byte [esi + eax], bl
mov bl, byte [ebp - 1]
mov byte [edi], bl
mov ebx, dword [ebp + 8]
movzx esi, byte [esi + eax]
mov dword [ebp - 8], edi
mov edi, dword [ebp - 0xc]
add ebx, edi
mov dword [ebp - 0xc], ebx
movzx ebx, byte [ebp - 1]
add esi, ebx
and esi, 0xff
mov bl, byte [esi + eax]
mov esi, dword [ebp - 0xc]
xor byte [esi], bl
inc edi
mov dword [ebp - 0xc], edi
cmp edi, dword [ebp + 0xc]
jb 0x10003326
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
leave
ret

Function at 0x100033bc
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
push 0x1001eeb0
call fcn.10003382
mov al, byte [esi + edi - 1]
xor byte [esi], al
xor eax, eax
inc eax
pop ecx
pop ecx
cmp edi, eax
jbe 0x100033e5
mov cl, byte [eax + esi - 1]
xor byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x100033d9
pop esi
ret

Function at 0x10003411
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x100034df
cmp dword [ebp + 8], 0
jbe 0x100034d0
push ebx
lea edx, [ebp - 4]
push esi
sub eax, edx
push edi
mov ebx, eax
xor edi, edi
xor esi, esi
cmp dword [ebp + 8], 0
jbe 0x1000344d
dec dword [ebp + 8]
lea eax, [ebp + esi - 4]
mov dl, byte [ebx + eax]
inc edi
mov byte [eax], dl
jmp 0x10003452
mov byte [ebp + esi - 4], 0
inc esi
cmp esi, 3
jb 0x10003438
movzx eax, byte [ebp - 4]
mov edx, eax
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
movzx edx, byte [ebp - 3]
and eax, 3
mov esi, edx
shl eax, 4
shr esi, 4
or esi, eax
mov al, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ebx, 3
mov byte [ecx + 1], al
cmp edi, 1
jbe 0x100034a2
movzx eax, byte [ebp - 2]
and edx, 0xf
shr eax, 6
shl edx, 2
or eax, edx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x100034a4
mov al, 0x3d
mov byte [ecx + 2], al
cmp edi, 2
jbe 0x100034bb
movzx eax, byte [ebp - 2]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x100034bd
mov al, 0x3d
mov byte [ecx + 3], al
add ecx, 4
cmp dword [ebp + 8], 0
ja 0x10003434
pop edi
pop esi
pop ebx
mov eax, dword [ebp + 0x10]
mov byte [ecx], 0
test eax, eax
je 0x100034df
sub ecx, dword [ebp + 0xc]
mov dword [eax], ecx
leave
ret
Function at 0x100035e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1001c050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov esi, ecx
push esi
mov dword [ebp - 0x20c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
xor ecx, ecx
mov edi, 0xff
mov eax, ecx
cdq
idiv ebx
mov byte [ebp + ecx - 0x104], cl
inc ecx
mov al, byte [edx + esi]
mov byte [ebp + ecx - 0x205], al
cmp ecx, edi
jle 0x10003614
xor esi, esi
mov dword [ebp - 0x208], esi
movzx ecx, byte [ebp + esi - 0x204]
lea eax, [ebp + esi - 0x104]
movzx edx, byte [eax]
add ecx, edx
add ecx, dword [ebp - 0x208]
and ecx, 0x800000ff
jns 0x10003661
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x208], ecx
lea ecx, [ebp + ecx - 0x104]
mov bl, byte [ecx]
inc esi
mov byte [eax], bl
mov byte [ecx], dl
cmp esi, edi
jle 0x10003637
xor ecx, ecx
xor esi, esi
mov dword [ebp - 0x208], 0xc00
inc ecx
and ecx, 0x800000ff
jns 0x10003698
dec ecx
or ecx, 0xffffff00
inc ecx
lea eax, [ebp + ecx - 0x104]
movzx edx, byte [eax]
add esi, edx
and esi, 0x800000ff
jns 0x100036b4
dec esi
or esi, 0xffffff00
inc esi
dec dword [ebp - 0x208]
lea edi, [ebp + esi - 0x104]
mov bl, byte [edi]
mov byte [eax], bl
mov byte [edi], dl
jne 0x10003687
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x10003765
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], edi
inc ecx
and ecx, 0x800000ff
jns 0x10003702
dec ecx
or ecx, 0xffffff00
inc ecx
lea eax, [ebp + ecx - 0x104]
movzx edx, byte [eax]
add esi, edx
and esi, 0x800000ff
jns 0x1000371e
dec esi
or esi, 0xffffff00
inc esi
lea edi, [ebp + esi - 0x104]
mov bl, byte [edi]
mov byte [eax], bl
mov byte [edi], dl
movzx eax, byte [eax]
add eax, edx
and eax, 0x800000ff
jns 0x1000373e
dec eax
or eax, 0xffffff00
inc eax
mov dl, byte [ebp + eax - 0x104]
mov eax, dword [ebp - 0x208]
mov edi, dword [ebp - 0x210]
xor dl, byte [edi + eax]
mov byte [eax], dl
inc eax
dec dword [ebp - 0x20c]
mov dword [ebp - 0x208], eax
jne 0x100036f1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f62
leave
ret
Function at 0x10003774
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1001c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea esi, [ebp + 8]
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 6
xor edi, edi
inc edi
push edi
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
or eax, 0xffffffff
cmp esi, eax
je 0x1000383f
push ebx
lea eax, [ebp - 0x11c]
push eax
mov ebx, 0x8004667e
push ebx
mov dword [ebp - 0x11c], edi
mov edi, dword [sym.imp.WS2_32.dll_ioctlsocket]
push esi
call edi
cmp eax, 0xffffffff
je 0x1000383b
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
mov eax, dword [ebp + 0x18]
lea ecx, [ebp - 0x124]
push ecx
mov dword [ebp - 0x124], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x118]
push ecx
push eax
push eax
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x120], eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x10003834
and dword [ebp - 0x11c], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
call edi
cmp eax, 0xffffffff
je 0x10003834
mov eax, esi
jmp 0x1000383e
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10008f62
leave
ret
Function at 0x1000489c
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [edi + 0xc], 0
push ebx
push esi
je 0x10004909
cmp dword [ebp + 8], 0
je 0x10004909
test eax, eax
je 0x10004909
push 3
pop ecx
add eax, 2
xor edx, edx
div ecx
mov esi, eax
shl esi, 2
lea eax, [esi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
and dword [ebp - 4], 0
mov ebx, eax
mov dword [ebp - 0xc], ebx
test esi, esi
je 0x10004947
lea eax, [ebp - 8]
push eax
push dword [edi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x10004902
cmp dword [ebp - 8], 0
jne 0x10004911
push 0
push dword [edi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x10004942
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
pop ebx
leave
ret 4
mov ebx, esi
sub ebx, dword [ebp - 4]
cmp dword [ebp - 8], ebx
jge 0x1000491e
mov ebx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
push ebx
push eax
push dword [edi + 0xc]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x1000497a
cmp ebx, dword [ebp - 0x10]
jne 0x1000497a
add dword [ebp - 4], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebp - 4], esi
jb 0x100048dc
xor eax, eax
test esi, esi
je 0x1000495c
cmp byte [eax + ebx], 0x20
jne 0x10004957
mov byte [eax + ebx], 0x2b
inc eax
cmp eax, esi
jb 0x1000494d
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov ecx, esi
mov eax, ebx
call fcn.100034e1
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
jmp 0x1000490b
push dword [ebp - 0xc]
jmp 0x10004903

Function at 0x10004a0b
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1001c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1ff
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.1000f670
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
mov esi, 0x200
push 0
mov dword [ebp - 0x208], esi
call dword [sym.imp.urlmon.dll_ObtainUserAgentString]
test eax, eax
jne 0x10004a7d
push esi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x10004a8a
push str.Mozilla_5.0__Windows_NT_10.0__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_71.0.3578.98_Safari_537.36
push esi
mov ecx, edi
call fcn.100023fc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10008f62
leave
ret
Function at 0x10005379
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x1001c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x10019d00
push 0x200
mov ecx, edi
mov dword [ebp - 0x8c], 0x89c9f045
mov dword [ebp - 0x88], 0x76297766
mov dword [ebp - 0x84], 0xc4e4a970
mov dword [ebp - 0x80], 0x7b159cd3
mov dword [ebp - 0x7c], 0xf5f50dc1
mov dword [ebp - 0x78], 0x1d82cd5e
mov dword [ebp - 0x74], 0x64d8c230
mov dword [ebp - 0x70], 0xae9d0dba
mov dword [ebp - 0x6c], 0xf1ea2a92
mov dword [ebp - 0x68], 0xdde7e3f6
mov dword [ebp - 0x64], 0x286fb852
mov dword [ebp - 0x60], 0x15a3c9b5
mov dword [ebp - 0x5c], 0x52bae853
mov dword [ebp - 0x58], 0x8fbc7db6
mov dword [ebp - 0x54], 0x9db6393a
mov dword [ebp - 0x50], 0xdfba5f8c
mov dword [ebp - 0x4c], 0xb20033e1
mov dword [ebp - 0x48], 0xa65a84ae
mov dword [ebp - 0x44], 0x81099d85
mov dword [ebp - 0x40], 0xa59da7dc
mov dword [ebp - 0x3c], 0xdd9278b5
mov dword [ebp - 0x38], 0x1df45e4c
mov dword [ebp - 0x34], 0x9f773229
mov word [ebp - 0x30], 0x5be3
mov dword [ebp - 0x2c], 0x89daf05d
mov dword [ebp - 0x28], 0x762e777b
mov dword [ebp - 0x24], 0xc4f6a962
mov dword [ebp - 0x20], 0x7b1f9cd2
mov dword [ebp - 0x1c], 0xf5ff0def
mov dword [ebp - 0x18], 0x1d9ccd5a
mov dword [ebp - 0x14], 0x64f9c236
mov dword [ebp - 0x10], 0xae9f0da7
mov dword [ebp - 0xc], 0xf1ed2a8f
mov dword [ebp - 8], 0xdd89e3fe
call fcn.100023fc
mov esi, 0x1001eea0
push esi
lea eax, [ebp - 0x190]
call fcn.10003275
lea eax, [ebp - 0x8c]
push 0x5e
push eax
lea eax, [ebp - 0x190]
call fcn.100032d2
push esi
lea eax, [ebp - 0x190]
call fcn.10003275
lea eax, [ebp - 0x2c]
push 0x28
push eax
lea eax, [ebp - 0x190]
call fcn.100032d2
add esp, 0x18
lea eax, [ebp - 0x194]
push eax
push 1
push 0
lea eax, [ebp - 0x8c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x10005532
lea eax, [ebp - 0x198]
push eax
push edi
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x194]
mov dword [ebp - 0x198], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x194]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x10005534
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008f62
leave
ret
Function at 0x10005540
Capabilities:
Encode data using xor
Get hostname
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x1001c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x808], 0x200
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov esi, dword [ebp - 0x808]
add esi, esi
push esi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.10010500
add esp, 0xc
lea edi, [ebp - 0x404]
call fcn.10005379
mov eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
call edi
add eax, eax
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp + esi - 0x804]
push eax
call fcn.10010500
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call edi
mov ecx, dword [0x1002255c]
lea eax, [esi + eax*2]
mov dword [ebp + eax - 0x804], ecx
add eax, 4
cmp byte [0x100212e4], 0
jne 0x10005619
xor edx, edx
push 8
mov ecx, edx
pop esi
test cl, 1
je 0x100055fd
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x100055ff
shr ecx, 1
dec esi
jne 0x100055ee
mov dword [edx*4 + 0x10020ee0], ecx
inc edx
cmp edx, 0x100
jb 0x100055e9
mov byte [0x100212e4], 1
or ecx, 0xffffffff
xor edx, edx
test eax, eax
je 0x10005641
movzx esi, byte [ebp + edx - 0x804]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x10020ee0]
inc edx
cmp edx, eax
jb 0x10005622
not ecx
mov dword [ebx], ecx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.10008f62
leave
ret

Function at 0x10005656
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x10005668
xor eax, eax
jmp 0x100056bd
lea eax, [ebp - 4]
push eax
push 1
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100056bb
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push edi
push str.ProductName
push dword [ebp - 4]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100056b2
xor edi, edi
inc edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret
Function at 0x100056c0
Capabilities:
Get hostname
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x2dd
push 0
push 0x10022988
call fcn.1000f670
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
and dword [0x100229cd], 0
mov dword [0x100229d9], eax
lea eax, [ebp - 4]
push eax
push 0x1002298d
mov dword [ebp - 4], 0x20
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x10005706
leave
ret
push ebx
push esi
push 0x100229d1
call fcn.100052b7
mov dword [esp], 0x100229dd
call fcn.10005656
mov ebx, 0x10022989
call fcn.10005540
mov eax, dword [0x1002255c]
mov dword [esp], 0x104
mov esi, 0x10022a5d
push esi
push 0
mov dword [0x100229d5], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push esi
call fcn.1000903f
pop ecx
pop ecx
test eax, eax
je 0x10005766
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor eax, eax
inc eax
jmp 0x10005768
xor eax, eax
pop esi
pop ebx
leave
ret

Function at 0x1000576c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.1000f670
add esp, 0xc
xor eax, eax
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x64], edi
xor edi, edi
inc edi
push esi
mov dword [ebp - 0x38], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100057e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x1998
push 4
mov ecx, edi
pop ebx
call fcn.1000389c
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
jmp 0x10005805
mov esi, dword [0x10022984]
push edi
push 0x1990
push dword [0x100230b0]
call fcn.10003990
add esp, 0xc
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
dec eax
pop ebx
leave
ret