joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1820
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4f1851
dec al
je 0x4f188c
dec al
je 0x4f18d1
dec al
je 0x4f193a
jmp 0x4f19c4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4f19c4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4f1861
jmp 0x4f19c4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4f19c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4f189c
jmp 0x4f19c4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4f19c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4f1900
xor ebp, ebp
jmp 0x4f1910
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4f1919
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4f18e1
jmp 0x4f19c4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4f19c4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4f1993
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004ee894
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4f194e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x54a950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x54a9dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x104
call fcn.0040766c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0040737c
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x54a9bc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.0040766c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.005257d0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004072f0
jmp 0x54a9c6
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004072f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54a9e3
lea eax, [ebp - 0x10]
call fcn.004072e0
ret

Function at 0x54ed28
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004072f0
mov dword [ebp - 0xc], 0xf
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x54ed61
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.0040742c
mov esp, ebp
pop ebp
ret
Function at 0x57c710
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov ebx, 0x625c78
test edx, edx
jne 0x57c723
xor eax, eax
jmp 0x57c838
mov dword [esp], 1
cmp byte [esp], 0
je 0x57c740
push ecx
push edx
push eax
call fcn.0057c83c
add esp, 0xc
jmp 0x57c838
push ecx
push edx
push eax
call fcn.0057cb40
add esp, 0xc
jmp 0x57c838
pop edx
pop esi
pop ebx
ret
Function at 0x57e490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x57e4cb
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x57e54c
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.0057c39c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x57e519
mov cx, word [ebp - 4]
sub cx, si
jmp 0x57e51b
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x57e502
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x57e541
mov cx, word [ebp - 4]
sub cx, si
jmp 0x57e543
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x57e52a
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x57e632
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.0057e204
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x57e59d
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x74]
cmp eax, 0x106
jae 0x57e5b3
mov edx, dword [ebx]
cmp dword [edx + 4], 0
jne 0x57e49f
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x16c0]
cmp ecx, edx
jbe 0x57e632
mov esi, dword [ebx + 0x6c]
add esi, eax
cmp esi, edx
jbe 0x57e5f5
mov edi, ecx
sub edi, esi
cmp edi, 0x102
jbe 0x57e5da
mov edi, 0x102
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, esi
push eax
call fcn.0057c384
add esp, 0xc
add edi, esi
mov dword [ebx + 0x16c0], edi
jmp 0x57e632
lea edx, [esi + 0x102]
mov eax, dword [ebx + 0x16c0]
cmp edx, eax
jbe 0x57e632
mov edi, edx
mov edx, dword [ebx + 0x3c]
sub edx, eax
sub edi, eax
cmp edi, edx
jbe 0x57e61b
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x16c0]
push edi
push 0
mov edx, dword [ebx + 0x38]
add edx, eax
push edx
call fcn.0057c384
add esp, 0xc
add dword [ebx + 0x16c0], edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x591d4c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x591d7a
mov eax, ebx
call fcn.00592800
cmp dword [ebx + 0x40], 0
je 0x591d73
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x591deb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x591ddd
cmp dword [ebx + 8], 0
je 0x591d9c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x591dae
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x591ddd
cmp dword [ebx + 8], 0
je 0x591d8f
cmp eax, 3
je 0x591dc1
dec eax
jne 0x591d8f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x591d8f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x591d8f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x591e09
cmp dword [ebx + 0x14], 0xcc
je 0x591e09
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00591e14
pop ebx
ret

Function at 0x5a8cb4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
dec ecx
js 0x5a8d05
lea eax, [ebp - 0x30]
cmp word [eax + 0x20], 3
je 0x5a8cec
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x5a8cdc
jmp 0x5a8d05
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x5a8ced
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5bee28
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
cmp dword [ebp - 4], 0
jne 0x5bee4a
push 0
call sub.kernel32.dll_GetModuleHandleW_2
mov dword [ebp - 0x10], eax
jmp 0x5bee5b
mov eax, dword [ebp - 4]
call fcn.0040737c
push eax
call sub.kernel32.dll_GetModuleHandleW_2
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5bef1a
push pe_nt_image_headers32
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindResourceW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5bef1a
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5bef1a
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x30]
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x34]
shr eax, 0x10
mov edx, dword [ebp - 8]
mov word [edx + 4], ax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
mov dx, word [edx + 0x34]
mov word [eax + 6], dx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44]
and eax, 1
cmp eax, 1
sete al
mov edx, dword [ebp - 8]
mov byte [edx + 8], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44]
and eax, 2
cmp eax, 2
sete al
mov edx, dword [ebp - 8]
mov byte [edx + 9], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44]
and eax, 8
cmp eax, 8
sete al
mov edx, dword [ebp - 8]
mov byte [edx + 0xa], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x44]
and eax, 0x20
cmp eax, 0x20
sete al
mov edx, dword [ebp - 8]
mov byte [edx + 0xb], al
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x5c7b1c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea eax, [eax + eax*2]
mov edx, dword [0x631bbc]
mov eax, dword [edx + eax*4 + 8]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea eax, [eax + eax*2]
mov edx, dword [0x631bbc]
mov eax, dword [edx + eax*4 + 8]
cmp byte [eax + 0x48], 0
jne 0x5c7b81
mov eax, dword [0x631bc4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
dec dword [0x62a8c8]
mov eax, dword [0x631bc4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 4]
xor eax, eax
push ebp
push 0x5c7bc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea eax, [eax + eax*2]
mov edx, dword [0x631bbc]
mov eax, dword [edx + eax*4 + 8]
call fcn.004052b4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea eax, [eax + eax*2]
mov edx, dword [0x631bbc]
xor ecx, ecx
mov dword [edx + eax*4 + 8], ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c7bd0
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5ca1a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x5ca339
xor eax, eax
push ebp
push 0x5ca32f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
push 4
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
mov word [ebp - 0x1c], 0
mov word [ebp - 0x1a], 0
push 4
lea eax, [ebp - 0x1c]
push eax
push 0x80
push 0xffff
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
push 4
lea eax, [ebp - 0x14]
push eax
push 1
push 6
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00404b1c
mov word [ebp - 0x3c], 2
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_ntohl
mov dword [ebp - 0x38], eax
mov ax, word [ebp - 8]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x3a], ax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x28]
push eax
push 0x8004667e
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_ioctlsocket
push pe_nt_image_headers32
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_connect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ca339
lea eax, [ebp - 0x140]
call fcn.004e9ea0
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 0x18]
call fcn.004e9e90
mov eax, dword [ebp - 0xc]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x140]
push eax
push 0
push 0
call sub.wsock32.dll_select
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 0x8004667e
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_ioctlsocket
xor eax, eax
push ebp
push 0x5ca31c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5ca326
cmp dword [ebp - 0x2c], 0
setne byte [ebp - 0xd]
ret
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d9b40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004072d8
xor eax, eax
push ebp
push 0x5d9bcf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x62a958], 0
je 0x5d9b9c
cmp dword [0x631c24], 0
je 0x5d9b9c
push 0xa
push 0
mov eax, dword [ebp - 8]
call fcn.0040737c
push eax
mov eax, dword [0x631c24]
call fcn.0040737c
push eax
push 0x5d9bdc
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x5d9bb9
push 0xa
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040737c
push eax
push 0x5d9bdc
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d9bd6
lea eax, [ebp - 8]
call fcn.004072e0
ret

Function at 0x5da4d4
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebx
push edi
push esi
xchg edx, ecx
mov esi, ecx
shr ecx, 2
je 0x5da503
mov edi, dword [eax]
imul edi, edi, 0xcc9e2d51
rol edi, 0xf
imul edi, edi, 0x1b873593
xor edx, edi
rol edx, 0xd
lea edx, [edx + edx*4 - 0x19ab949c]
lea eax, [eax + 4]
dec ecx
jne 0x5da4e0
mov ecx, esi
and ecx, 3
je 0x5da531
xor ebx, ebx
dec ecx
mov bl, byte [ecx + eax]
je 0x5da520
shl ebx, 8
dec ecx
mov bl, byte [ecx + eax]
je 0x5da520
shl ebx, 8
mov bl, byte [eax]
imul ebx, ebx, 0xcc9e2d51
rol ebx, 0xf
imul ebx, ebx, 0x1b873593
xor edx, ebx
xor edx, esi
mov eax, edx
shr edx, 0x10
xor edx, eax
imul edx, edx, 0x85ebca6b
mov eax, edx
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr edx, 0x10
xor eax, edx
pop esi
pop edi
pop ebx
ret
Function at 0x604898
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004072d8
xor eax, eax
push ebp
push 0x604956
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 7], 0
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00404b1c
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 0x41
mov ax, word [ebp - 6]
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040737c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x604940
push 0x1f4
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x102
je 0x60490c
cmp dword [ebp - 0xc], 0
sete byte [ebp - 7]
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60495d
lea eax, [ebp - 4]
call fcn.004072e0
ret

Function at 0x60f704
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x60f808
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x18]
push eax
push 0
call sub.Iphlpapi.dll_GetNetworkParams
mov eax, dword [ebp - 0x18]
call fcn.00404200
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.Iphlpapi.dll_GetNetworkParams
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x60f763
mov eax, dword [ebp - 0x10]
call fcn.00404250
jmp 0x60f7ed
mov eax, dword [ebp - 0x10]
add eax, 0x10c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.00407344
cmp dword [ebp - 0x14], 0
je 0x60f7b7
push dword [ebp - 0x20]
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
add edx, 4
mov ecx, pe_nt_image_headers32
call fcn.004074d8
push dword [ebp - 0x24]
push 0x60f824
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004078a8
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x60f77e
mov eax, dword [ebp - 8]
push dword [eax]
push 0x60f834
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x20]
call fcn.00413808
push dword [ebp - 0x28]
push 0x60f84c
mov eax, dword [ebp - 8]
mov edx, 4
call fcn.004078a8
mov eax, dword [ebp - 0x10]
call fcn.00404250
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60f80f
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004072e8
ret
Function at 0x1008f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1008f0f
pop dword [ebp - 0x24]
mov eax, 0x27bf0606
sub eax, 0x26be76f7
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x4d6775dd
add dword [ebp - 0x34], 0xeacf6e
mov dword [ebp - 0x30], 0x1d974c41
add dword [ebp - 0x30], 0x149c0004
mov dword [ebp - 0x2c], 0xc628b040
sub dword [ebp - 0x2c], 0x79dc6c12
mov dword [ebp - 0x28], 0x7f0ceabd
add dword [ebp - 0x28], 0x80f31543
lea eax, [ebp - 0x34]
push eax
mov eax, 0x176b9d7e
add eax, 0xe9947312
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xc5ae5bb4
add dword [ebp - 0x34], 0xaec40da2
mov dword [ebp - 0x30], 0x751bfa8a
sub dword [ebp - 0x30], 0x33af9915
mov dword [ebp - 0x2c], 0xd2cc9bfe
add dword [ebp - 0x2c], 0x90a2d06e
mov dword [ebp - 0x28], 0xab905f63
add dword [ebp - 0x28], 0x546fa09d
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x9ab23a8e
add eax, 0x664dd66e
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3a528
push 0
call eax
mov ecx, 0xc8c6b10d
sub ecx, 0xc8c65e1d
mov edx, eax
mov ebx, 0x3a311c8b
sub ebx, 0x392fcc8b
add ebx, dword [ebp - 0x24]
mov esi, 0x1afcfd0a
add esi, 0x148d44da
sub dword [ebp - 0x10], ecx
mov edi, dword [ebx]
add dword [ebp - 0x18], ebx
xor edi, esi
add dword [ebp - 0x10], 0x40ad6196
mov dword [edx], edi
xor dword [ebp - 0x18], 0xb144f300
add edx, 0x31f2630e
add edx, 0xce0d9cf6
add ebx, 0xa3852005
add ebx, 0x5c7adfff
loop 0x1009031
add eax, 0x13e93
xor ebx, ebx
add ebx, eax
add eax, 0x37ea354d
add eax, 0xc815cab8
mov ecx, 0x1000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x100dfc5
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10105d0
call fcn.0100e974
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1012680
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100ddda
cmp eax, esi
jne 0x100ddcd
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100dddd
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x100ddb4
xor esi, esi
inc esi
mov eax, dword [0x101267c]
cmp eax, esi
jne 0x100ddf0
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100de2b
mov eax, dword [0x101267c]
test eax, eax
jne 0x100de25
mov dword [0x101267c], esi
push 0x1001218
push 0x100120c
call fcn.01008f00
pop ecx
pop ecx
test eax, eax
je 0x100de2b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100def5
mov dword [0x1012340], esi
mov eax, dword [0x101267c]
cmp eax, esi
jne 0x100de4f
push 0x1001208
push 0x1001200
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x101267c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x100de5c
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x1012688], ebx
je 0x100de7d
push 0x1012688
call fcn.0100e8e9
pop ecx
test eax, eax
je 0x100de7d
push ebx
push 2
push ebx
call dword [0x1012688]
push dword [0x1012328]
push dword [0x101232c]
push dword [0x1012324]
call fcn.01008f00
add esp, 0xc
mov dword [0x101233c], eax
cmp dword [0x1012330], ebx
jne 0x100dedb
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1012340], ebx
jne 0x100dee9
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x101233c]
call fcn.0100e9b9
ret
call fcn.01008f00
jmp 0x100dd92
Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx