joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406592
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406baa
mov edi, eax
cmp edi, 0xffffffff
je 0x4065d5
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x4065b6
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4065bc
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4065c5
xor eax, eax
inc eax
jmp 0x4065d7
test byte [ebp + 0xc], 4
jne 0x4065d5
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x406645
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x4305d0
push ebx
call fcn.00406b27
push ebx
call fcn.00406bd2
mov esi, eax
test esi, esi
je 0x4066ba
push esi
call fcn.00406d4a
test byte [0x435a30], 0x80
je 0x40667e
movzx eax, word [esi]
test ax, ax
je 0x4066ba
cmp eax, 0x5c
je 0x4066ba
sub esi, ebx
sar esi, 1
jmp 0x406698
call fcn.004065dc
test eax, eax
je 0x406692
test byte [eax], 0x10
je 0x4066ba
push ebx
call fcn.00406d1d
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x406684
call fcn.00406563
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4066ba
xor eax, eax
inc eax
jmp 0x4066bc
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x4066e3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x42fd88], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x42fd88
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406722
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x406726
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00406645
mov dword [esp + 0x14], eax
test bl, 8
je 0x406768
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x435ae8], eax
jmp 0x4068e7
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x406785
test eax, eax
je 0x4068d6
test bl, 2
je 0x40689f
push esi
push 0x42fdd0
call fcn.00406b27
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x4067a8
push str..
push 0x42fdd0
call ebp
jmp 0x4067ae
push esi
call fcn.00406d1d
xor eax, eax
cmp word [esi], ax
jne 0x4067bf
cmp word [0x42fdd0], 0x5c
jne 0x4067c7
push 0x4092b0
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x42fdd0
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406888
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x406811
cmp word [esp + 0x4a], 0
je 0x40686a
cmp word [esp + 0x4a], ax
jne 0x406811
cmp word [esp + 0x4c], 0
je 0x40686a
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406b27
test byte [esp + 0x1c], 0x10
je 0x406838
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x40686a
push ebx
push esi
call fcn.00406726
jmp 0x40686a
push edi
push esi
call fcn.00406592
test eax, eax
jne 0x406862
test edi, edi
je 0x40685a
push esi
push 0xfffffffffffffff1
call fcn.00405d09
xor eax, eax
push eax
push esi
call fcn.0040624a
jmp 0x40686a
inc dword [0x435ae8]
jmp 0x40686a
push esi
push 0xfffffffffffffff2
call fcn.00405d09
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4067f3
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x4068e6
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x4068d6
push esi
call fcn.004065dc
test eax, eax
je 0x4068e6
push esi
call fcn.00406563
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406592
test eax, eax
jne 0x4068de
test edi, edi
je 0x4068d6
push esi
push 0xfffffffffffffff1
call fcn.00405d09
xor eax, eax
push eax
push esi
call fcn.0040624a
jmp 0x4068e6
inc dword [0x435ae8]
jmp 0x4068e6
push esi
push 0xffffffffffffffe5
call fcn.00405d09
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x406928
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x406984
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004062e5
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x4069f6
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x4069f6
cmp dword [ebp + 0x18], 1
je 0x4069fb
cmp dword [ebp + 0x18], 2
je 0x4069fb
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x406a00
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406a63
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406aad
test edi, edi
jne 0x406a70
mov word [esi], ax
jmp 0x406aaf
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406baa
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406bcc
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406e49
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x432424], 0
push esi
jne 0x406e83
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406e5a
mov dword [ecx*4 + 0x432420], edx
inc ecx
cmp ecx, 0x100
jl 0x406e55
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406ead
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x432420]
inc esi
sub edx, 1
jne 0x406e95
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..3ean
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x25fd03ae
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..7LWLf
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5d151240
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x43c0b2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
sub ebp, 1
jne 0x43c0b3
pop ebp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov edi, dword [eax + 0x10]
call 0x43c0cd
pop esi
lea edx, [edi + 0x1000]
lea ecx, [edx + 0x1c800]
lea ebx, [esi + 0x273]
lea ebp, [ebx + 0x20]
push edx
push ecx
push ebx
push ebp
call section.sect_4
add esp, 0x10
lea eax, [edi + 0x8430]
jmp eax

Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a
Function at 0xcafcd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x32b000]
push edi
or ebp, 0xffffffff
jmp 0xcafcf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xcafcf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xcafce8
mov eax, 1
add ebx, ebx
jne 0xcafd0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xcafd00
jne 0xcafd1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xcafd00
xor ecx, ecx
sub eax, 3
jb 0xcafd30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xcafda2
mov ebp, eax
add ebx, ebx
jne 0xcafd3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xcafd48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xcafd6c
inc ecx
add ebx, ebx
jne 0xcafd58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xcafd4d
jne 0xcafd69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xcafd4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xcafd8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xcafd7d
jmp 0xcafcee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xcafd8c
add edi, ecx
jmp 0xcafcee
pop esi
mov edi, esi
mov ecx, 0x70f4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xcafdaa
cmp byte [edi], 0x28
jne 0xcafdaa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xcafdaf
lea edi, [esi + 0x8ab000]
mov eax, dword [edi]
or eax, eax
je 0xcafe27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8b25ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8b272c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xcafddc
mov ecx, edi
jns 0xcafe0b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8b2730]
or eax, eax
je 0xcafe21
mov dword [ebx], eax
add ebx, 4
jmp 0xcafdf9
call dword [esi + 0x8b2740]
mov ebp, dword [esi + 0x8b2734]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xcafe5b
sub esp, 0xffffff80
jmp 0x4ea001
Function at 0x40127b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
jmp 0x40131c
mov edx, edi
call fcn.004011e2
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.0040267d
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 0
jmp 0x40135a
or bl, 1
idiv ebx
mov edx, dword [0x404050]
mov ebx, esi
add edx, eax
mov eax, 0x404054
call fcn.004011e2
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x40338d
push eax
sub edi, fcn.00402b27
push edi
push fcn.00402b27
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x4012be
mov eax, fcn.00402b27
mov ebx, esi
jmp 0x4012a6
sub ebp, 0x82
mov esi, eax
mov ebx, dword [0x404050]
cdq
jmp 0x4012cf
call fcn.00401fff
lea eax, [esi + 0x1c000]
lea ebx, [ebp - 2]
test esi, esi
je 0x40136e
add eax, eax
dec esi
and esi, 0x404054
mov edx, eax
mov eax, esi
call fcn.00402b27
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x187657c2
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x368802df
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..retplne
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0xee73d6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x4304d8
nop
mov ecx, 0x249853ab
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408918
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.00408947
mov ecx, 0xacbe663c
push ecx
pop ecx
xor dword [edx], eax
sub ebx, 0x76f56bd7
add edx, 1
cmp edx, edi
jne fcn.00408918
and ecx, ebx
sub esp, 4
mov dword [esp], ecx
pop ebx
ret
Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
mov ebp, 0x144d8b82
mov edx, dword [ebp + 0x10]
mov al, byte [0xd67eb85f]
add dword [eax], eax
mov dword [ecx], edx
pop esi
pop ebp
or eax, 0x3875c085
pop edi
dec ebp
adc byte [ebp - 0x74ed8a37], al
lodsb al, byte [esi]
adc al, 0x8b
pop ebp
clc
pop ebx
pop edi
mov eax, 0x1801117e
mov dword [ecx], edx
pop esi
pop ebp
ret
pop ebp
ret
push ebp
mov ebp, esp
push ecx
cmp dword [ebx + 0x468a0834], ecx
sub al, 0x84
ror byte [edi], 0x84
mov esi, 0x8b003000
dec esi
dec eax
xor eax, eax
jle 0x40b26d
stc
add dword [ecx - 0x7603446d], esp
inc ebp
or byte [edi], cl
test dword [eax + eax + 0x7ed8007c], ebx
cmp al, 0x71
clc
je 0x40b3dd
mov ebx, dword [esi + 0x38]
cmp edi, 0xffffffff
sub al, byte [0xebffc883]
add cl, byte [ebx + 0x4568bc7]
lea ecx, [ebp - 4]
push 0
push ecx
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
out dx, eax
sal byte [edi + ebp - 0x75], 0x45
cld
mov edx, dword [esi + 0x50]
js 0x40b37f
add edx, eax
adc ecx, 0
sub edi, eax
mov dword [0x385689d8], eax
test edi, edi
mov dword [esi + 0x54], ecx
ja 0x40b2c8
mov eax, dword [ebp + 0xb]
pop edi
leave
inc esi
cmp al, 0
test eax, 0x8b5bd229
mov esp, ebp
ret 4
inc ebp
push eax
mov dword [esi + 0x50], edx
aas
rol dword [eax], 1
test dword [ecx], eax
mov dword [esi + 0x54], ecx
jne 0x40b395
mov dword [esi + 0x3c], 0xaa8100
mov al, byte [0x5b5f0845]
pop esi
mov esp, ebp
pop ebp
ret 4
nop
nop
nop
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
mov dh, pe_nt_image_headers32
or al, 0
push esi
add byte [ebp - 0x3e], bl
or al, 0
nop
push 0x905890ac
nop
nop
outsd dx, dword [esi]
mov edi, dword [ebp - 0x75]
pop es
adc byte [ebp + 0x45], cl
invalid
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x1000ba30
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
mov dword [0x10018c40], eax
jne 0x1000ba4b
pop ecx
ret
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 2
push 0x110
push 0xf01ff
push str.Rz_mmw_Opsog_Awkgi_h_Wftl
push str.Zcbrs_OsrzjjmO_j
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
mov dword [0x10018c3c], eax
jne 0x1000ba84
pop ecx
ret
mov edx, dword [0x10018c40]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov ecx, dword [0x10018c3c]
mov esi, eax
lea eax, [esp + 4]
mov dword [esp + 4], str.Enk_tapcJujavvwwq_Rvnearu_Fwtqohot_Uc
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push esi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, 1
pop esi
pop ecx
ret

Function at 0x1000bac0
Capabilities:
Modify service

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
push 0xf003f
push str.Zcbrs_OsrzjjmO_j
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
xor eax, eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0x15180
mov dword [esp + 0x28], 0x3e8
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 1
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
lea edx, [esp + 0xc]
push edx
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2c
ret