joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bfb0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00551820
mov edi, dword [esp + 0x6c]
add esp, 0xc
xor eax, eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push edi
push eax
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
jne 0x40c021
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._CreateProcess___s_CreateProcess_failure_:__8.8x
push 1
call fcn.00409a10
add esp, 0x10
pop edi
xor eax, eax
pop esi
add esp, 0x54
ret
cmp dword [esp + 0x64], 1
jne 0x40c035
mov eax, dword [esp + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40c046
push eax
call edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40c051
push eax
call edi
pop edi
mov eax, esi
pop esi
add esp, 0x54
ret

Function at 0x40e7b0
Capabilities:
Get common file path

Disassembly:
push esi
push 0x412
mov esi, ecx
push 0
push esi
mov byte [esi + 0x412], 0
call fcn.00551820
add esp, 0xc
push esi
push 0x209
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
mov eax, esi
je 0x40e7e3
mov byte [esi + 0x412], 1
pop esi
ret

Function at 0x40fa79
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x5f8320]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00551820
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
inc eax
cmp dword [ebp - 0x7c], 6
ja 0x40faca
jne 0x40fac8
cmp dword [ebp - 0x78], eax
jae 0x40faca
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0055189a
add ebp, 0x98
leave
ret

Function at 0x410aca
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5f8320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00551820
xor eax, eax
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00551820
add esp, 0x18
test edi, edi
je 0x410b6a
push edi
call fcn.00554811
pop ecx
test eax, eax
jbe 0x410b6a
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x410b6a
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x58f0e4
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00410a73
add esp, 0x14
test eax, eax
jl 0x410b6a
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x410b6c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0055189a
leave
ret
Function at 0x410b79
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0x18], 0
test ebx, ebx
jne 0x410b8c
push 0x57
pop eax
leave
ret
push edi
mov edi, str.wintrust.dll
call fcn.00410aca
mov edi, eax
test edi, edi
jne 0x410bb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x410c6a
push 0x7e
pop eax
jmp 0x410c6a
push esi
call fcn.0040fa79
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WinVerifyTrust
push edi
mov dword [ebp - 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push edi
mov dword [ebp - 4], eax
call esi
push str.WTHelperGetProvSignerFromChain
push edi
mov dword [ebp - 8], eax
call esi
push str.WTHelperGetProvCertFromChain
push edi
mov dword [ebp - 0xc], eax
call esi
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 4], eax
je 0x410c17
cmp dword [ebp - 8], eax
je 0x410c17
cmp dword [ebp - 0xc], eax
je 0x410c17
cmp dword [ebp - 0x10], eax
je 0x410c17
cmp dword [ebp - 0x14], eax
jne 0x410c31
push str.WintrustLoadFunctionPointers
push edi
call esi
mov esi, eax
test esi, esi
jne 0x410c36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x410c26
push 0x7f
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x410c69
mov esi, dword [ebp - 0x18]
jmp 0x410c38
xor eax, eax
push 0x18
push eax
push ebx
call fcn.00551820
mov eax, dword [ebp - 4]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x10]
add esp, 0xc
cmp dword [ebp - 0x14], 0
mov dword [ebx], edi
mov dword [ebx + 0x10], eax
jne 0x410c67
mov dword [ebx + 0x14], esi
xor eax, eax
pop esi
pop edi
leave
ret
Function at 0x4116aa
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xf8
mov eax, dword [0x5f8320]
xor eax, ebp
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x7c]
xor ecx, ecx
push ebx
push esi
mov dword [ebp - 0x8c], eax
cmp edi, ecx
je 0x41185e
cmp dword [ebp + 0x78], ecx
jl 0x41185e
jg 0x4116e8
cmp dword [ebp + 0x74], ecx
jbe 0x41185e
cmp eax, ecx
je 0x41185e
cmp dword [ebp + 0x78], ecx
mov ebx, pe_nt_image_headers32
jg 0x41170b
jl 0x411701
cmp dword [ebp + 0x74], ebx
ja 0x41170b
mov eax, 0x22000009
jmp 0x411863
push ebx
push ecx
lea eax, [ebp - 0x88]
push eax
call fcn.00551820
push edi
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x88]
push 0x40
push eax
call fcn.00558213
add esp, 0x1c
cmp eax, esi
je 0x41173d
mov eax, 0x22000005
jmp 0x411863
push 2
lea eax, [ebp - 0x88]
push 0x595ea8
push eax
call fcn.00555de1
add esp, 0xc
test eax, eax
jne 0x411701
movzx eax, byte [ebp - 0x49]
movzx ecx, byte [ebp - 0x4a]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x4b]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x4c]
shl eax, 8
or eax, ecx
xor ecx, ecx
cmp dword [ebp + 0x78], ecx
jg 0x411788
jl 0x411701
cmp dword [ebp + 0x74], eax
jbe 0x411701
push 0
push eax
push edi
call fcn.00557ed1
add esp, 0xc
test eax, eax
jl 0x411733
push edi
push esi
lea eax, [ebp - 0x48]
push 4
push eax
call fcn.00558213
add esp, 0x10
cmp eax, esi
jne 0x411733
push 4
lea eax, [ebp - 0x48]
push 0x595ea0
push eax
call fcn.00555de1
add esp, 0xc
test eax, eax
jne 0x411701
push edi
push esi
lea eax, [ebp - 0x44]
push 0x14
push eax
call fcn.00558213
add esp, 0x10
cmp eax, esi
jne 0x411733
push edi
push esi
lea eax, [ebp - 0x30]
push 2
push eax
call fcn.00558213
add esp, 0x10
cmp eax, esi
jne 0x411733
movzx ax, byte [ebp - 0x2f]
movzx cx, byte [ebp - 0x30]
shl ax, 8
or ax, cx
mov ecx, 0x20b
cmp ax, cx
jne 0x411847
push edi
push esi
push 0x96
lea eax, [ebp - 0x2e]
push eax
call fcn.00558213
add esp, 0x10
cmp eax, esi
jne 0x411733
push ebx
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x8c]
call fcn.00552ae0
add esp, 0xc
xor eax, eax
jmp 0x411863
mov ecx, 0x10b
cmp ax, cx
jne 0x411701
push edi
push esi
push 0x86
jmp 0x411819
mov eax, 0x22000001
mov ecx, dword [ebp + 0x68]
pop esi
xor ecx, ebp
pop ebx
call fcn.0055189a
add ebp, 0x6c
leave
ret
Function at 0x42e699
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, eax
mov edx, esi
shr edx, 2
xor eax, eax
test edx, edx
je 0x42e6d5
push ebx
push edi
movzx edi, byte [ecx + 3]
movzx ebx, byte [ecx + 2]
shl edi, 8
or edi, ebx
movzx ebx, byte [ecx + 1]
shl edi, 8
or edi, ebx
movzx ebx, byte [ecx]
shl edi, 8
or edi, ebx
xor dword [esp + 0x10], edi
dec edx
add ecx, 4
test edx, edx
jne 0x42e6a9
pop edi
pop ebx
and esi, 3
dec esi
je 0x42e6f1
dec esi
je 0x42e6e8
dec esi
jne 0x42e6f6
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, dword [esp + 8]
pop esi
ret

Function at 0x42e75b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
je 0x42e79d
cmp dword [ebp + 0xc], 0
je 0x42e79d
push dword [ebp + 8]
call fcn.00557640
mov esi, eax
cmp esi, 0xff
pop ecx
jg 0x42e79d
push dword [ebp + 0xc]
inc esi
push 1
push esi
push dword [ebp + 8]
call fcn.0055395c
add esp, 0x10
test eax, eax
jne 0x42e799
push 0xfffffffffffffff6
pop eax
jmp 0x42e7a0
mov eax, esi
jmp 0x42e7a0
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x42e7a3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
test esi, esi
je 0x42e7d6
cmp dword [ebp + 8], 0
je 0x42e7d6
push dword [ebp + 8]
lea eax, [ebp - 4]
push 1
push 4
push eax
call fcn.00558213
add esp, 0x10
test eax, eax
jne 0x42e7cd
push 0xfffffffffffffffe
pop eax
leave
ret
mov eax, dword [ebp - 4]
mov dword [esi], eax
push 4
jmp 0x42e7ca
or eax, 0xffffffff
leave
ret

Function at 0x42e7db
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 8], 0
jne 0x42e7e6
or eax, 0xffffffff
ret
push dword [esp + 8]
lea eax, [esp + 8]
push 1
push 4
push eax
call fcn.0055395c
add esp, 0x10
neg eax
sbb eax, eax
and eax, 0xe
add eax, 0xfffffff6
ret

Function at 0x42e806
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
test esi, esi
je 0x42e83b
cmp dword [ebp + 8], 0
je 0x42e83b
push dword [ebp + 8]
lea eax, [ebp - 4]
push 1
push 2
push eax
call fcn.00558213
add esp, 0x10
test eax, eax
jne 0x42e830
push 0xfffffffffffffffe
pop eax
leave
ret
mov ax, word [ebp - 4]
mov word [esi], ax
push 2
jmp 0x42e82d
or eax, 0xffffffff
leave
ret

Function at 0x42e840
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 8], 0
jne 0x42e84b
or eax, 0xffffffff
ret
push dword [esp + 8]
lea eax, [esp + 8]
push 1
push 2
push eax
call fcn.0055395c
add esp, 0x10
neg eax
sbb eax, eax
and eax, 0xc
add eax, 0xfffffff6
ret
Function at 0x42e86b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 8], eax
je 0x42e8f8
cmp ebx, eax
je 0x42e8f8
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
je 0x42e892
push 0xfffffffffffffffc
pop eax
jmp 0x42e8fb
push ebx
lea esi, [ebp - 8]
call fcn.0042e7a3
pop ecx
test eax, eax
jl 0x42e8fb
push ebx
lea esi, [ebp - 4]
call fcn.0042e7a3
pop ecx
test eax, eax
jl 0x42e8fb
movzx esi, word [ebp - 4]
cmp esi, edi
jbe 0x42e8ba
push 0xfffffffffffffffb
jmp 0x42e88f
push ebx
push 1
push esi
push dword [ebp + 8]
call fcn.00558213
add esp, 0x10
test eax, eax
jne 0x42e8d1
push 0xfffffffffffffffe
jmp 0x42e88f
mov ecx, dword [ebp + 8]
push 0
mov eax, esi
call fcn.0042e699
push eax
push 4
pop eax
lea ecx, [ebp - 4]
call fcn.0042e699
pop ecx
pop ecx
cmp eax, dword [ebp - 8]
je 0x42e8f4
push 0xfffffffffffffffa
jmp 0x42e88f
mov eax, esi
jmp 0x42e8fb
or eax, 0xffffffff
pop edi
pop esi
leave
ret

Function at 0x42e8ff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push esi
test ecx, ecx
je 0x42e973
test ebx, ebx
je 0x42e973
cmp edi, 0x8000
jbe 0x42e91c
push 0xfffffffffffffffc
pop eax
jmp 0x42e976
push 0
mov eax, edi
call fcn.0042e699
pop ecx
push ebx
push eax
mov esi, edi
shl esi, 0x10
push 4
or esi, edi
pop eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.0042e699
pop ecx
push eax
call fcn.0042e7db
pop ecx
pop ecx
test eax, eax
jl 0x42e976
push ebx
push esi
call fcn.0042e7db
pop ecx
pop ecx
test eax, eax
jl 0x42e976
push ebx
push 1
push edi
push dword [ebp + 8]
call fcn.0055395c
add esp, 0x10
test eax, eax
jne 0x42e96e
push 0xfffffffffffffff6
jmp 0x42e919
lea eax, [edi + 8]
jmp 0x42e976
or eax, 0xffffffff
pop esi
leave
ret

Function at 0x42f700
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x18], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
xor eax, eax
inc eax
ret
Function at 0x430ad8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5f8320]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp edi, eax
je 0x430b9b
cmp dword [ebp + 0xc], eax
jl 0x430b9b
jg 0x430b06
cmp dword [ebp + 8], eax
jbe 0x430b9b
cmp ebx, eax
je 0x430b9b
cmp dword [ebp + 0xc], eax
jg 0x430b22
jl 0x430b1b
cmp dword [ebp + 8], 0x3c
jae 0x430b22
mov eax, 0x22000009
jmp 0x430ba0
push 0x3c
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00551820
push edi
push 1
lea eax, [ebp - 0x40]
push 0x3c
push eax
call fcn.00558213
add esp, 0x1c
cmp eax, 1
je 0x430b4b
mov eax, 0x22000005
jmp 0x430ba0
push 4
lea eax, [ebp - 0x40]
push str.MSCF
push eax
call fcn.00555de1
add esp, 0xc
test eax, eax
jne 0x430b1b
test byte [ebp - 0x22], 4
jne 0x430b6f
mov eax, 0x2200000e
jmp 0x430ba0
movzx ax, byte [ebp - 0x1b]
movzx cx, byte [ebp - 0x1c]
shl ax, 8
or ax, cx
push 0x14
pop ecx
cmp cx, ax
jne 0x430b68
push 0x3c
lea eax, [ebp - 0x40]
push eax
push ebx
call fcn.00552ae0
add esp, 0xc
xor eax, eax
jmp 0x430ba0
mov eax, 0x22000001
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055189a
leave
ret

Function at 0x43d210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
je 0x43d218
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0043cf2a
inc ecx

Function at 0x43d5d0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x43d5de
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x43d5d9
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x43d5c3
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x43d5cb
cmp edx, ebx
jne 0x43d719
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
or byte [edx], al
or byte [edx], al
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x43d59a
add eax, dword [eax + 4]
jmp 0x43d587
mov dword [ebp + 0xc], ebx
jmp 0x43d5e9
Function at 0x43d630
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x43d601
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x43d61f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x43d67d
mov edx, edi
mov dword [ebp + 8], edi
jge 0x43d64a
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x43d664
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x43d66d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x43d5e3
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x43d6ca
dec eax
je 0x43d6c1
sub eax, 3
je 0x43d6b8
mov dword [ebp - 4], 0x40
jmp 0x43d6e7
mov dword [ebp - 4], 4
jmp 0x43d6cd
mov dword [ebp - 4], 0x20
jmp 0x43d6cd
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x43d719
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x43d699
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0043cf2a
mov dword [edx + 0x75ffcb29], ecx
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x43d725
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43d670
Capabilities:
Inspect section memory permissions

Disassembly:
je 0x43d677
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x43d659

Function at 0x43da70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x660], 0xb0
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
test dword [ecx + edi*8 - 0x39460001], esp
test dword [ebp - 0x6b000007], esp
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
invalid
invalid
test al, 0xf9
invalid

Function at 0x43ef20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add ch, byte [edx]
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x43ef74
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x43ef79
jmp 0x43e8cc
and dword [ebp - 0x37c], 0
Function at 0x453480
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x45350b
mov edx, dword [esp + 8]
lea ecx, [edx - 1]
not edx
shr edx, 0x1f
push esi
mov esi, dword [edi + 4]
shr ecx, 0x1f
and ecx, edx
mov edx, dword [eax + 4]
xor edx, esi
dec ecx
and edx, ecx
xor esi, edx
mov dword [edi + 4], esi
xor dword [eax + 4], edx
mov esi, dword [edi + 0xc]
mov edx, dword [eax + 0xc]
xor edx, esi
and edx, ecx
xor esi, edx
mov dword [edi + 0xc], esi
xor dword [eax + 0xc], edx
mov esi, dword [edi + 0x10]
mov edx, dword [eax + 0x10]
xor edx, esi
and edx, ecx
and edx, 4
xor esi, edx
mov dword [edi + 0x10], esi
xor dword [eax + 0x10], edx
xor esi, esi
cmp dword [esp + 0x18], esi
jle 0x45350a
push ebx
push ebp
mov edx, dword [edi]
mov ebx, dword [edx + esi*4]
lea ebp, [edx + esi*4]
mov edx, dword [eax]
mov edx, dword [edx + esi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + esi*4], edx
lea ebx, [ebx + esi*4]
inc esi
cmp esi, dword [esp + 0x20]
jl 0x4534e3
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x4537d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test byte [eax + 0x10], 4
mov ecx, dword [eax + 4]
push esi
lea esi, [ecx - 1]
je 0x4537eb
pop esi
mov dword [esp + 4], eax
jmp fcn.00453040
test ecx, ecx
jne 0x4537f3
xor eax, eax
pop esi
ret
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
push ecx
call fcn.00452fb0
shl esi, 5
add esp, 4
add eax, esi
pop esi
ret

Function at 0x4550b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret

Function at 0x457405
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 0
push 0
call fcn.00433300
add esp, 0xc
test eax, eax
jne 0x457405
xor eax, eax
ret
push 0
push 0x5fc0f8
call fcn.00455090
add esp, 8
test eax, eax
je 0x457402
push ebx
push 0
push 0x5fc0fc
call fcn.00455090
add esp, 8
test eax, eax
je 0x457495
mov eax, dword [0x5fc108]
mov ecx, dword [0x5f64d8]
push esi
push eax
push ecx
xor ecx, ecx
lea ebx, [ecx + 1]
call fcn.004571f0
mov esi, eax
add esp, 8
test esi, esi
je 0x45747d
push esi
call fcn.00457060
add esp, 4
test eax, eax
jne 0x457467
push esi
call fcn.00456690
add esp, 4
xor esi, esi
jmp 0x45747d
push 0x1c
push str.OpenSSL_NIST_SP_800_90A_DRBG
mov dword [esi + 0x58], ebx
push esi
mov dword [esi + 0x5c], ebx
call fcn.00456710
add esp, 0xc
mov dword [0x5fc100], esi
test esi, esi
pop esi
jne 0x4574a6
push 0x5fc0fc
call fcn.00455100
add esp, 4
push 0x5fc0f8
call fcn.00455100
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret
Function at 0x459b40
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.005530f0
mov eax, dword [0x5f8320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x459bb5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x459bb5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call fcn.0055b76f
add esp, 0x10
test eax, eax
jge 0x459b98
mov eax, 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
push eax
lea edx, [ebp - 0x204]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x459cfe
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x459bc0
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0055b690
mov esi, esp
test esi, esi
jne 0x459be4
mov esi, str.no_stack_
jmp 0x459c6f
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x459c11
test edi, edi
jbe 0x459c11
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
movsx dx, byte [eax + ecx]
mov word [esi + eax*2], dx
inc eax
cmp eax, edi
jb 0x459c00
xor eax, eax
test edi, edi
jbe 0x459c6f
cmp word [esi + eax*2], 0x25
jne case.0x459c34.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x459c34.43
movzx edx, byte [edx + 0x459d30]
jmp dword [edx*4 + 0x459d18]
inc eax
add ecx, 2
jmp 0x459c22
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x459c34.43
mov edx, 0x73
jmp 0x459c65
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x459c34.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x459c17
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call fcn.00557a46
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x459ce8
call fcn.00459a00
test eax, eax
jle 0x459ce8
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x459cfe
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x459cfe
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055189a
mov esp, ebp
pop ebp
ret